Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1584231
MD5:	e4988eb723ce5d55a74e5797c22f5d83
SHA1:	6440cdb22f83128c928269b09425f030ed158ccf
SHA256:	d7e8681893924d22c41513ebf851a219cc2fc08322a9353afaf2b2575c107ae1
Tags:	exeuser-jstrosch
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2144 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E4988EB723CE5D55A74E5797C22F5D83)

conhost.exe (PID: 1824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

file.exe (PID: 5336 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E4988EB723CE5D55A74E5797C22F5D83)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "5", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Process Memory Space: file.exe PID: 5336	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: file.exe PID: 5336	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: file.exe PID: 5336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1407220.1.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.file.exe.1407220.1.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
3.2.file.exe.400000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
3.2.file.exe.400000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
3.2.file.exe.400000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
3.2.file.exe.400000.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
0.2.file.exe.1407220.1.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.file.exe.1407220.1.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfbcdc:$str01: emoji 0xfe4d8:$str02: %d-%m-%Y, %H:%M:%S 0xfe540:$str03: [UTC 0xfe54c:$str04: user_name 0xfe570:$str05: computer_name 0xfe594:$str06: timezone 0xfe4c4:$str07: current_path() 0xfbca8:$str08: [json.exception. 0x111c2e:$str09: GDI32.dll 0x111ea0:$str10: GdipGetImageEncoders 0x111f18:$str10: GdipGetImageEncoders 0x111548:$str11: GetGeoInfoA
Click to see the 3 entries

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T22:58:13.672112+0100	2049441	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T22:58:13.672112+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-04T22:58:13.677099+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T22:58:13.672112+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-04T22:58:13.677099+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.file.exe.1407220.1.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "5", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 57%			Perma Link
Source: file.exe	ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0047A610 CryptUnprotectData,LocalFree,	3_2_0047A610
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043D4A0 BCryptDestroyKey,	3_2_0043D4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0047A950 CryptProtectData,LocalFree,	3_2_0047A950
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0047AAE0 BCryptDecrypt,BCryptDecrypt,	3_2_0047AAE0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00440B60 CryptUnprotectData,LocalFree,	3_2_00440B60
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0047AE10 BCryptCloseAlgorithmProvider,	3_2_0047AE10
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0047AE80 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	3_2_0047AE80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ABE9A FindFirstFileExW,	0_2_009ABE9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ABF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009ABF4B
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004402D0 FindFirstFileW,FindNextFileW,	3_2_004402D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	3_2_004B84C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_004B8545
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B84E0 FindFirstFileExW,	3_2_004B84E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004BAB85 FindFirstFileExW,	3_2_004BAB85
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009ABE9A FindFirstFileExW,	3_2_009ABE9A
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009ABF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_009ABF4B

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00487550 GetLogicalDriveStringsW,

3_2_00487550

Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.6:49709 -> 66.63.187.173:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.6:49709 -> 66.63.187.173:15666

Source: global traffic

TCP traffic: 192.168.2.6:49709 -> 66.63.187.173:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.6:49709 -> 66.63.187.173:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00485350 recv,recv,recv,recv,recv,recv,closesocket,WSACleanup,

3_2_00485350

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/x
Source: file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000003.00000003.2157138062.0000000004D3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157138062.0000000004D54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000003.00000003.2157138062.0000000004D3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157138062.0000000004D54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000003.00000003.2157138062.0000000004D3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157138062.0000000004D54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000003.00000002.3391417827.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48
Source: file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000003.00000003.2161442931.0000000004229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.moz
Source: file.exe, 00000003.00000003.2166824887.0000000003FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: file.exe, 00000003.00000003.2166824887.0000000003FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000003.00000003.2166824887.0000000003FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000003.00000002.3391417827.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=
Source: file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000003.00000003.2161080066.0000000004638000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2167631628.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2166824887.0000000003FB8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2162796947.000000000532A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2167955403.0000000004D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000003.00000003.2166824887.0000000003FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000003.00000003.2166824887.0000000003FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000003.00000003.2166824887.0000000003FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000003.00000003.2166824887.0000000003FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00485F00 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

3_2_00485F00

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.file.exe.1407220.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 3.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 3.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.file.exe.1407220.1.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0048A0A0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,		3_2_0048A0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,		3_2_0048A710

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1000	0_2_009A1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A5235	0_2_009A5235
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B1542	0_2_009B1542
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004422D0	3_2_004422D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043A2B0	3_2_0043A2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00446400	3_2_00446400
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00488400	3_2_00488400
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043E4F0	3_2_0043E4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004395D0	3_2_004395D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00487780	3_2_00487780
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00485840	3_2_00485840
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043C970	3_2_0043C970
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004479C0	3_2_004479C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00459A06	3_2_00459A06
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0046EB70	3_2_0046EB70
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0046BCE0	3_2_0046BCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00439D60	3_2_00439D60
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00470EF0	3_2_00470EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043BF70	3_2_0043BF70
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00462080	3_2_00462080
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004320A0	3_2_004320A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004A70A7	3_2_004A70A7
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042D150	3_2_0042D150
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00479130	3_2_00479130
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00474190	3_2_00474190
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00461250	3_2_00461250
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00408270	3_2_00408270
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B6380	3_2_004B6380
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00407470	3_2_00407470
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00462410	3_2_00462410
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004A5426	3_2_004A5426
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0045C4C0	3_2_0045C4C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043D4A0	3_2_0043D4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0047E580	3_2_0047E580
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0046B620	3_2_0046B620
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00468750	3_2_00468750
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00419770	3_2_00419770
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0045C700	3_2_0045C700
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004917CA	3_2_004917CA
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0045D7A0	3_2_0045D7A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004627A0	3_2_004627A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0049687E	3_2_0049687E
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B6870	3_2_004B6870
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043A800	3_2_0043A800
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00493800	3_2_00493800
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0049F8A2	3_2_0049F8A2
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00461940	3_2_00461940
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00445950	3_2_00445950
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00478990	3_2_00478990
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004ACA4B	3_2_004ACA4B
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00406AE0	3_2_00406AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B3AE0	3_2_004B3AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00430AF0	3_2_00430AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0048AA80	3_2_0048AA80
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00414AA0	3_2_00414AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0045EAA0	3_2_0045EAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00476AB6	3_2_00476AB6
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00462B50	3_2_00462B50
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00482C4B	3_2_00482C4B
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004BCC40	3_2_004BCC40
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B6C40	3_2_004B6C40
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00461CC0	3_2_00461CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00478D40	3_2_00478D40
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B6D30	3_2_004B6D30
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B1D30	3_2_004B1D30
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00440DE0	3_2_00440DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043AE50	3_2_0043AE50
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042EEA0	3_2_0042EEA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00406F40	3_2_00406F40
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00444F50	3_2_00444F50
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00443F00	3_2_00443F00
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00456F00	3_2_00456F00
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00412FA0	3_2_00412FA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A1000	3_2_009A1000
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A5235	3_2_009A5235
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009B1542	3_2_009B1542

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004AC500 appears 58 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004517F0 appears 76 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009A970F appears 36 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009A51F0 appears 64 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.file.exe.1407220.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 3.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 3.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.file.exe.1407220.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: file.exe

Static PE information: Section: .bss ZLIB complexity 1.0003138195647467

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/2

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_0048CB50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

3_2_0048CB50

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_004473D0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

3_2_004473D0

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00477EE0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

3_2_00477EE0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69636699A203

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000003.00000003.2160139140.0000000004D54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 57%
Source: file.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static file information: File size 1293312 > 1048576

Source: file.exe

Static PE information: Raw size of .bss is bigger than: 0x100000 < 0x120a00

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

3_2_00446400

Source: file.exe

Static PE information: section name: .OO

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A46A3 push ecx; ret	0_2_009A46B6
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004ACE0C push ecx; ret	3_2_004ACE1F
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A46A3 push ecx; ret	3_2_009A46B6

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_0047E240 GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,ExitProcess,ReleaseMutex,CloseHandle,

3_2_0047E240

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-58064

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ABE9A FindFirstFileExW,	0_2_009ABE9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ABF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009ABF4B
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004402D0 FindFirstFileW,FindNextFileW,	3_2_004402D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	3_2_004B84C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_004B8545
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004B84E0 FindFirstFileExW,	3_2_004B84E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004BAB85 FindFirstFileExW,	3_2_004BAB85
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009ABE9A FindFirstFileExW,	3_2_009ABE9A
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009ABF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_009ABF4B

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00487550 GetLogicalDriveStringsW,

3_2_00487550

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00498574 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

3_2_00498574

Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000003.00000002.3391417827.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000003.00000003.2160139140.0000000004D3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lqeMuUnwoUAFmVChtHrzZUujZ1qMtmQu;
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000003.00000003.2159262957.0000000003F5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_3-58084

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,

3_2_0048A710

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009A78CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009A78CC

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00498574 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

3_2_00498574

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

3_2_00446400

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BA1A9 mov edi, dword ptr fs:[00000030h]	0_2_009BA1A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1770 mov edi, dword ptr fs:[00000030h]	0_2_009A1770
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A1770 mov edi, dword ptr fs:[00000030h]	3_2_009A1770

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009A9726 GetProcessHeap,

0_2_009A9726

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A78CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009A78CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A501B SetUnhandledExceptionFilter,	0_2_009A501B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A5027 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009A5027
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A45B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009A45B7
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004AC6BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004AC6BF
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004AC80A SetUnhandledExceptionFilter,	3_2_004AC80A
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00497B2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00497B2D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004ABFD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_004ABFD4
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A501B SetUnhandledExceptionFilter,	3_2_009A501B
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A5027 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_009A5027
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A45B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_009A45B7
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_009A78CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_009A78CC

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009BA1A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_009BA1A9

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_0047D2F0 ShellExecuteW,OpenProcessToken,GetCurrentProcess,GetTokenInformation,std::ios_base::_Ios_base_dtor,

3_2_0047D2F0

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00486C50 cpuid

3_2_00486C50

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004A6109
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_004B824D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	3_2_004A620F
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_004A62E5
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_0049C70E
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_004A5970
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_004A5C67
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_004A5C1C
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	3_2_0049CCB0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_004A5D02
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_004A5D8D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	3_2_004A5FE0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009A48D3 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_009A48D3

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_004863F0 GetUserNameW,

3_2_004863F0

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_004A1074 GetTimeZoneInformation,

3_2_004A1074

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: file.exe PID: 5336, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.file.exe.1407220.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.1407220.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5336, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000003.00000002.3391417827.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\Local State
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5336, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: file.exe PID: 5336, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.file.exe.1407220.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.1407220.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5336, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 Software Packing	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	58%	Virustotal		Browse
file.exe	74%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://support.moz	0%	Avira URL Cloud	safe
https://imp.mt48	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000003.00000003.2157138062.0000000004D3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157138062.0000000004D54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000003.00000003.2157138062.0000000004D3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157138062.0000000004D54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.moz	file.exe, 00000003.00000003.2161442931.0000000004229000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	file.exe, 00000003.00000003.2166824887.0000000003FC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/x	file.exe, 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000003.00000003.2157138062.0000000004D3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157138062.0000000004D54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=	file.exe, 00000003.00000002.3391417827.0000000001522000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	file.exe, 00000003.00000003.2166824887.0000000003FB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000003.00000003.2157371141.0000000004D54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000003.00000003.2166824887.0000000003FC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48	file.exe, 00000003.00000002.3391417827.0000000001522000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000003.00000003.2168693559.0000000001575000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
66.63.187.173	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584231
Start date and time:	2025-01-04 22:57:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 82 Number of non-executed functions: 130
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	api.ipify.org/
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.74.152
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	104.26.12.205
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	104.26.12.205
	Statement of Account - USD 16,720.00.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Loader.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	Jx6bD8nM4qW9sL3v.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	104.26.13.205
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	markiz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.64.1
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	SOElePqvtf.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	m4lz5aeAiN.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	ehD7zv3l4U.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	rdFy6abQ61.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	HMhdtzxEHf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	162.159.138.232
	9cOUjp7ybm.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
ASN-QUADRANET-GLOBALUS	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	104.223.10.34
	1.elf	Get hash	malicious	Unknown	Browse	72.11.146.74
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	193.111.248.108
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	162.220.9.64
	Hilix.ppc.elf	Get hash	malicious	Mirai	Browse	45.199.228.221
	Hilix.m68k.elf	Get hash	malicious	Mirai	Browse	45.199.228.219
	Hilix.x86.elf	Get hash	malicious	Mirai	Browse	45.199.228.215

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.26.12.205
	HGwpjJUqhW.exe	Get hash	malicious	GhostRat	Browse	104.26.12.205
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.26.12.205
	nv8401986_110422.exe	Get hash	malicious	Qjwmonkey	Browse	104.26.12.205
	adguardInstaller.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	adguardInstaller.exe	Get hash	malicious	PureLog Stealer	Browse	104.26.12.205
	RisingStrip.exe	Get hash	malicious	Vidar	Browse	104.26.12.205
	adguardVPNInstaller.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.26.12.205

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.959252484978052
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'293'312 bytes
MD5:	e4988eb723ce5d55a74e5797c22f5d83
SHA1:	6440cdb22f83128c928269b09425f030ed158ccf
SHA256:	d7e8681893924d22c41513ebf851a219cc2fc08322a9353afaf2b2575c107ae1
SHA512:	316c14812b8ceb3a00b52913d4da44ebdb666ead9be82eddedac1e41f323c6cbfd6d4df57ef94829fd6842a85c524b3b345fe347441ef476442047640a1112ac
SSDEEP:	24576:Bdl/JxIgevnHodySw5KP8lXkV8sWGzv6VD0iNKlsTEc8GF71X:/l/E5vnIdyd5Q8lXkBmLNfk27F
TLSH:	6955235131C0C4B1CBA3983645B0BB56553DF9314FB0A9FF278D59A15E22AD08A3CAFB
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...bI\g..........".................\L............@.......................................@.................................D~..(..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x404c5c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x675C4962 [Fri Dec 13 14:49:06 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2716f32d1d63b3fc977d6064633b778d

Entrypoint Preview

Instruction
call 00007FF0A545981Ah
jmp 00007FF0A5459439h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FF0A54595CFh
neg eax
pop ecx
sbb eax, eax
neg eax
dec eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0041B4F0h], FFFFFFFFh
push dword ptr [ebp+08h]
jne 00007FF0A54595C9h
call 00007FF0A545BBE1h
jmp 00007FF0A54595CDh
push 0041B4F0h
call 00007FF0A545BB64h
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
cmove ecx, dword ptr [ebp+08h]
mov eax, ecx
pop ebp
ret
push 00000008h
push 00418D38h
call 00007FF0A5459B00h
and dword ptr [ebp-04h], 00000000h
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
jne 00007FF0A545961Fh
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FF0A545960Eh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FF0A5459600h
mov eax, dword ptr [ebp+08h]
mov ecx, 00400000h
sub eax, ecx
push eax
push ecx
call 00007FF0A5459742h
pop ecx
pop ecx
test eax, eax
je 00007FF0A54595E9h
cmp dword ptr [eax+24h], 00000000h
jl 00007FF0A54595E3h
mov dword ptr [ebp-04h], FFFFFFFEh
mov al, 01h
jmp 00007FF0A54595E1h
mov eax, dword ptr [ebp-14h]
mov eax, dword ptr [eax]
xor ecx, ecx
cmp dword ptr [eax], C0000005h
sete cl
mov eax, ecx
ret
mov esp, dword ptr [ebp-18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17e44	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e000	0x12fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x12808	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17fac	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10c15	0x10e00	05d7420100633613bdbd5a889171c5f7	False	0.5704427083333333	data	6.50620173764596	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x7294	0x7400	4965eb04eb8b1b66b8d84a097bc01bc3	False	0.3977976831896552	data	4.65662016842751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x1c10	0x1200	6a2a147d595c2e66ddd7fdd872225955	False	0.4281684027777778	data	4.604642940636322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.OO	0x1c000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1d000	0xe8	0x200	0713d2c4e51a805f2ce8d9843bcbad43	False	0.306640625	data	2.337865625306241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e000	0x12fc	0x1400	c56221e7af6185e7585b1796050bcf12	False	0.778515625	data	6.424268394395036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x20000	0x120a00	0x120a00	758e5e316c6a0231fc6fbe8edfce45a4	False	1.0003138195647467	data	7.999822106926655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1d060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-04T22:58:13.672112+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-04T22:58:13.672112+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-04T22:58:13.672112+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-04T22:58:13.677099+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-04T22:58:13.677099+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49709	66.63.187.173	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 22:58:08.773092985 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:08.777945995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:08.778024912 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:09.458374977 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:09.458434105 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:09.458499908 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:09.505877972 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:09.505899906 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:10.034733057 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:10.034817934 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:10.131495953 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:10.131525040 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:10.131854057 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:10.131918907 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:10.135380983 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:10.183331966 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:10.259530067 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:10.259592056 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:10.259594917 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:10.259648085 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:10.260500908 CET	49710	443	192.168.2.6	104.26.12.205
Jan 4, 2025 22:58:10.260516882 CET	443	49710	104.26.12.205	192.168.2.6
Jan 4, 2025 22:58:13.672111988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.677000999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677037001 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677052021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677061081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677089930 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677098989 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677098989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.677120924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.677139997 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677176952 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.677192926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.677200079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677212954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677225113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.677238941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.677301884 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.681940079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.681950092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.681978941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.681991100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682018042 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682029009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682039022 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682041883 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682070017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682070971 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682080984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682082891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682116032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682120085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682135105 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682152987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682164907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682173014 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682189941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682205915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.682219982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.682251930 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.686865091 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.686940908 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.686990976 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.687005043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687017918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687055111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687058926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.687098980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687104940 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.687112093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687130928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687149048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.687161922 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.687218904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687263012 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.687283993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687362909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.687416077 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.691826105 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.691885948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.691899061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.691920996 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.691934109 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.691951990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.691953897 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.691966057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.691970110 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.691993952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692008018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692019939 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692035913 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692039967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692047119 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692053080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692078114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692080021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692091942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692095995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692105055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692115068 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692116976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692137957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692157984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692164898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692178011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692203045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692212105 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692220926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692244053 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692253113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692259073 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692260027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692272902 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692286968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692297935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692297935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692310095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.692318916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.692342997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.696836948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.696851969 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.696865082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.696893930 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.696908951 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.696913004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.696927071 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.696932077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.696945906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.696959019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.696969032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.696985006 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697052956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697155952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697170019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697194099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697205067 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697216034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697217941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697235107 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697236061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697249889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697263002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697279930 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697293997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697300911 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697313070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697323084 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697344065 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697365046 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697376966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697381020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697393894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697413921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697426081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697431087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697444916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697451115 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697458029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697483063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697484016 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697495937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697498083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697515011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697526932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697539091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697540045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697559118 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697580099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.697580099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697592020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697602987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.697644949 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.701729059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701741934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701772928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701781034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701791048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.701803923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701811075 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.701817036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701834917 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.701844931 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701858044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701862097 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.701886892 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.701909065 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.701970100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.701996088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702003956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702050924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702131033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702140093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702178955 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702187061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702199936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702241898 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702260017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702277899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702286005 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702300072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702327013 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702331066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702337980 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702342987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702366114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702368975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702378035 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702380896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702409983 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702416897 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702421904 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702430010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702466965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702486992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702505112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702514887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702537060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702545881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702558041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702568054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702579021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702590942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702604055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702611923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702622890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702636003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702650070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702661037 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.702662945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702672958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.702699900 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706660032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706669092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706692934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706701040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706723928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706727028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706734896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706763983 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706788063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706820011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706831932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706841946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706855059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706862926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706868887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706878901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706883907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706911087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706933975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.706963062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.706971884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707004070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707015038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707099915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707109928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707133055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707138062 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707145929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707154989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707165003 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707184076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707212925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707226038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707247972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707261086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707320929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707330942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707343102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707364082 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707374096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707442999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707467079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707484007 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707496881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707501888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707505941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707515001 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707523108 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707540035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707544088 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707547903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707555056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707556963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707567930 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707607031 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707638979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707648993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707683086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707742929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707772017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707779884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707788944 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707803965 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707813025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.707823038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707839966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.707871914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.711633921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711643934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711652994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711713076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.711745024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711785078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.711816072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711824894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711833000 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711863041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.711864948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711906910 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711915970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711927891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.711934090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711950064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711951971 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.711958885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711965084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.711990118 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.711993933 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712003946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712009907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712024927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712025881 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712033033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712045908 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712054968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712063074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712073088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712076902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712095976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712110996 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712111950 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712119102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712127924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712146044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712168932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712306023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712325096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712340117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712348938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712368011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712379932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712424994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712440968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712455988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712475061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712486029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712496042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712498903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712516069 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712517977 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712538958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712542057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712548018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712553024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712558031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712565899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712574005 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712595940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712604046 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712605000 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712622881 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712652922 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712678909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712687969 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712713957 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712723017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712726116 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712733030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712743044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712745905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712750912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.712784052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.712795973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.716514111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716532946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716545105 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716559887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716589928 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.716609001 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.716649055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716711044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.716775894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716816902 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716864109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.716922998 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716938972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716948032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716955900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716964006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.716973066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717015982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717015982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717025042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717032909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717041016 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717082024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717117071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717134953 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717144012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717150927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717159986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717168093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717175961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717180967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717184067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717199087 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717200994 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717206955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717211962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717222929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717255116 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717308044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717348099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717389107 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717406034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717415094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717423916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717430115 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717432976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717461109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717475891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717535973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717545033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717576981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717617035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717633963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717643023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717652082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717653990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717659950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717668056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717673063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717704058 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717720985 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717751980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717761040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717770100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717777967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717786074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717792988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717793941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717802048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717809916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.717828035 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.717878103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721391916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721479893 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721493006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721545935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721571922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721580982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721596003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721611023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721626997 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721632957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721658945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721741915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721795082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721803904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721837997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721846104 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721854925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721869946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721879005 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.721890926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721901894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721925974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.721997023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722014904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722029924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722038031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722053051 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722068071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722069025 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722083092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722096920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722101927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722120047 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722146988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722152948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722162008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722170115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722207069 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722266912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722275972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722286940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722300053 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722309113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722317934 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722320080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722331047 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722342968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722357988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722374916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722383976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722392082 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722395897 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722404957 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722408056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722423077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722440004 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722440958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722455025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722470045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722480059 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722496986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722507954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722510099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722549915 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722584009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722600937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722618103 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722626925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722646952 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722657919 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722740889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722749949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722758055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722774982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722785950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722791910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722801924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722805977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722810984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722819090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722826958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.722827911 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722860098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.722872019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726442099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726450920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726460934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726484060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726497889 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726499081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726509094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726520061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726526976 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726552010 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726566076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726723909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726732969 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726768970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726769924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726778030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726807117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726818085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726841927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726851940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726876974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726880074 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726886034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726892948 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726892948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726907015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726917982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726922035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726943970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726969957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726982117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.726986885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.726995945 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727004051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727030039 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727040052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727211952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727221966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727256060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727269888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727278948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727318048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727354050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727363110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727396011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727435112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727452993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727464914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727473974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727488041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727494001 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727497101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727521896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727530003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727531910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727545977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727554083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727579117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727597952 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727643013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727652073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727669001 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727678061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727686882 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727689981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727709055 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727715015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727724075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727731943 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727746964 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727781057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727837086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727854013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727868080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727878094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727885008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727893114 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727904081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727916002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727926016 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727931023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727940083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727947950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727956057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727969885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727977991 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727978945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.727987051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.727994919 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.728029966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.731282949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731306076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731328964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731338978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731369019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.731389046 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.731424093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731471062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731479883 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731494904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731503963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731513977 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.731520891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.731539011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.731564045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.731671095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.733048916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.767803907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.769192934 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.769282103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774072886 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774095058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774104118 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774112940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774126053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774149895 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774173975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774199963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774214983 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774223089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774233103 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774241924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774252892 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774292946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774297953 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774301052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774312973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774317026 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774326086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774333000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774341106 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774348021 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774349928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774365902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774375916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774384022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774396896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774415016 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774416924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774432898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774457932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774457932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774466991 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774467945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774497986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774506092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774518013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774527073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774544001 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774557114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774571896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774585962 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.774599075 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.774629116 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.815648079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.815864086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.815954924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.815973997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.867638111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.867852926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.867944002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.867964029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.872808933 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872818947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872843027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872852087 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872859001 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.872868061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872888088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872895002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.872903109 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872910976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872929096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.872942924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.872958899 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.872976065 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872983932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872992039 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.872999907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873023987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873034000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873037100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873045921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873059988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873068094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873075962 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873081923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873094082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873094082 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873109102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873115063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873116970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873136997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873145103 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873153925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873167992 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873187065 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873209953 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873218060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873225927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873234034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873258114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873260021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873266935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873267889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873291969 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873313904 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873323917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873332024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873366117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873368979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873377085 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873411894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873437881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873445988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873491049 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873579025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873590946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873605967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873614073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873620987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873624086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873635054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873646975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873648882 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873656988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873661041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873665094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873677969 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873704910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873714924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873723984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873732090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873755932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873764038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873764038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873778105 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873785019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873810053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873897076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873913050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873920918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873929024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873944044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873944044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873951912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.873966932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873980045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.873990059 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.874002934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874013901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874027967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874043941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874052048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.874058008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874063969 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.874067068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874075890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874083042 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.874093056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874100924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874109030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874113083 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.874124050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874131918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874131918 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.874140024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.874155998 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.874182940 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.877723932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877733946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877741098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877748966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877784014 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.877830982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877875090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.877929926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877938986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877945900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.877975941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.877989054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878020048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878036022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878062010 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878065109 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878071070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878076077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878089905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878098011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878102064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878110886 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878117085 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878125906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878134966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878139973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878149033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878165960 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878182888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878185987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878190994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878199100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878210068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878225088 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878230095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878238916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878257036 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878268957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878299952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878318071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878325939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878334045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878338099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878348112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878355980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878360033 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878388882 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878406048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878504992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878513098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878520966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878528118 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878535986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878544092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878550053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878561974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878566980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878582954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878591061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878592968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878598928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878606081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878612995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878623962 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878624916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878640890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878649950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878649950 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878658056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878665924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878669977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878674984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878683090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878689051 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878701925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878711939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878715038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878716946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878732920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878740072 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878747940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878756046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878757954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878776073 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878813982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878833055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878871918 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878921986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878930092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878942013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878961086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878962040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878984928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.878988981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.878993988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879002094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879007101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.879009962 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879018068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879038095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879038095 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.879051924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879051924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.879060030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879067898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879067898 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.879086018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879101038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879101992 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.879108906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879117012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.879123926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.879149914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.879165888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.882620096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.882630110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.882654905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.882663012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.882666111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.882692099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.882700920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.882715940 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.882734060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883018017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883027077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883035898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883044004 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883074045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883090973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883099079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883128881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883133888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883136988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883162022 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883167982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883176088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883183956 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883199930 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883204937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883215904 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883218050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883255005 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883264065 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883272886 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883291006 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883306026 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883321047 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883322954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883332968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883343935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883349895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883367062 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883371115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883378983 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883379936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883388042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883399010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883404016 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883418083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883424997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883440018 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883441925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883456945 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883459091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883466005 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883496046 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883512974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883521080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883528948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883537054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883554935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883567095 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883589029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883589983 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883599043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883630991 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883636951 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883646011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883675098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883677006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883692026 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883707047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883716106 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883718967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883728027 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883730888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883743048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883753061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.883754015 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883766890 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.883801937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.926073074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.926275015 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.926359892 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.926395893 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931142092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931163073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931195021 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931221962 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931231022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931261063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931272984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931274891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931299925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931318045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931356907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931365967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931405067 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931504965 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931516886 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931546926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931557894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931627989 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931637049 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931662083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931669950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931674004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931704044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931755066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931763887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931772947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931797981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931809902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931821108 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931860924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931863070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931869984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931909084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931929111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931941986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931951046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931958914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.931972027 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.931983948 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932007074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932010889 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932014942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932029963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932038069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932049990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932063103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932089090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932110071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932118893 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932137012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932143927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932152033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932158947 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932161093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932168961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932178020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932180882 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932185888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932200909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932205915 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932209015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932218075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.932228088 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932245970 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.932269096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.975616932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:13.975805044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.975881100 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:13.975914001 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.013082981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.013262033 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.013331890 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.013376951 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018125057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018135071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018162966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018171072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018179893 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018202066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018237114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018240929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018263102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018280029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018307924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018316031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018317938 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018337011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018337965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018356085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018376112 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018383980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018412113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018419027 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018420935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018474102 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018562078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018615961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018656969 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018695116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018703938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018734932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018747091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018776894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018785000 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018819094 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018855095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018863916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018893003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018897057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018901110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018934965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.018939018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.018976927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019023895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019041061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019048929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019057035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019062042 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019064903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019083977 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019092083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019099951 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019124985 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019193888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019202948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019211054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019213915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019222021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019229889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019237995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019241095 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019257069 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019263029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019273043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019273043 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019284964 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019288063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019292116 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019295931 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019304991 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019316912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019324064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019325972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019335985 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.019336939 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019361973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.019375086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.059701920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.061201096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.061273098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.061305046 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.074960947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.076704025 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.076795101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.076838970 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081584930 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081600904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081609964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081666946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081676006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081703901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081718922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081727982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081756115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081760883 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081773996 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081782103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081788063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081796885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081814051 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081825018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081831932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081839085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081864119 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081871986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081878901 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081901073 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081902027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081911087 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081943989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.081950903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081959009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.081999063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082006931 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082017899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082046986 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082051039 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082056999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082058907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082092047 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082129002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082148075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082175016 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082185984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082221985 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082231045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082245111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082254887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082268000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082274914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082281113 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082283974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082295895 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082314968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082324028 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082334995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082351923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082355022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082362890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082371950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082375050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082410097 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082411051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082418919 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082427025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082448959 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082465887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082494020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082505941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082518101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082525969 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082540989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082545996 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082554102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082562923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082568884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082576990 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082582951 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082591057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082603931 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082604885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082614899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082616091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082654953 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082663059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082667112 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082670927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082684994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082709074 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082716942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082721949 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082758904 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082760096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082768917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082804918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082808018 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082813025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082833052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082851887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082876921 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082882881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082900047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082910061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.082930088 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.082947016 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.083044052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.083108902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086608887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086651087 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086658001 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086658955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086677074 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086692095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086709023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086726904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086731911 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086771011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086774111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086800098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086815119 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086839914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086859941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086878061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086908102 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086926937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.086976051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.086985111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087002993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087013006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087028027 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087048054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087065935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087080956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087107897 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087131023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087145090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087182045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087198973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087228060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087233067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087239981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087263107 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087349892 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087393045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087424994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087467909 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087531090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087538958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087560892 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087570906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087578058 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087614059 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087681055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087688923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087707043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087733984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087743044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087768078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087815046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087822914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087831974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087852955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087866068 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087896109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087898970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.087941885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.087964058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088002920 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.088004112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088047028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.088052988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088092089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.088095903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088140011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.088141918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088150978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088186026 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.088198900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088216066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088226080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.088241100 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.088258982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.088274956 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091475964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091499090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091515064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091533899 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091556072 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091578007 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091608047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091619015 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091646910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091646910 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091685057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091705084 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091753006 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091798067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091837883 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091876030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091897964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091921091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091923952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.091939926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.091953993 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.092032909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.092042923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.092051029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.092091084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.092117071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.092134953 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.092153072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.092161894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.092176914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.092190981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.139594078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.139801025 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.139883995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.139926910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.152306080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.152506113 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.152605057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.152642965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157429934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157447100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157486916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157506943 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157516003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157551050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157561064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157586098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157598972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157624960 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157625914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157675982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157710075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157747984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157763004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157783031 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157874107 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157882929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157915115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157922983 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157927990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157960892 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.157970905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.157985926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158015966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158029079 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158098936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158113956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158152103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158188105 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158236980 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158289909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158299923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158320904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158330917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158340931 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158369064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158391953 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158413887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158422947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158444881 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158464909 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158489943 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158516884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158534050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158556938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158561945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158590078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158600092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158601999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158627987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158638000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158647060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158677101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158687115 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158696890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158746004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158746004 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158759117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158771992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158787966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158807039 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.158914089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158931971 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158940077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158955097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158963919 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.158993959 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.159002066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.159045935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162297964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162353992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162364006 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162393093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162451982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162472010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162508011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162542105 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162580967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162589073 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162607908 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162616014 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162651062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162652016 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162687063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162698030 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162734032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162756920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162766933 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162806034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162815094 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162862062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162870884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162889957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162904978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162911892 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162921906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162925959 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162945032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162955046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.162960052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.162998915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163000107 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163027048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163036108 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163043022 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163079977 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163084030 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163134098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163136959 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163184881 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163228035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163273096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163275003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163326025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163330078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163336039 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163376093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163383961 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163383961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163415909 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163439035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163474083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163489103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163518906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163557053 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163573027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163577080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163582087 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163645029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163676023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163691044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163698912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163711071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163732052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163736105 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163770914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163784981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163836002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163857937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163871050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163887978 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163897038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163902998 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163907051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.163913012 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163932085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.163953066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167169094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167186975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167201042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167234898 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167270899 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167324066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167373896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167404890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167419910 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167428017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167450905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167469025 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167510986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167557001 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167593956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167653084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167699099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167707920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167748928 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167815924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167860031 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167880058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167887926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167897940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167943954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.167982101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.167992115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168011904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168028116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168032885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168035984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168051958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168081045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168085098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168124914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168126106 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168134928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168180943 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168234110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168253899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168292999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168332100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168355942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168386936 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168397903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168446064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168493032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168534994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168550968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168581009 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168595076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168621063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168659925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168668032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168715954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168771029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168780088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168828011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168847084 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168869019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168884039 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168894053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168900013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168901920 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168914080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168924093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168931007 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168941021 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168960094 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168981075 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.168986082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.168996096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.169004917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.169028997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.169039011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.169043064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.169051886 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.169085026 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.169095039 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172106981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172164917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172164917 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172205925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172209024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172255993 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172257900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172301054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172373056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172383070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172431946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172507048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172553062 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172595024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172621965 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172635078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172640085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172643900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172669888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172676086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172698975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172713995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172789097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172832012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172832012 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172842979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172878027 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.172919035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.172965050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173134089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173214912 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173253059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173284054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173295975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173316002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173321962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173353910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173363924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173373938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173413038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173455954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173466921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173475981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173504114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173516989 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173521996 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173527002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173552036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173567057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173571110 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173578024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173597097 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173648119 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173683882 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173693895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173718929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173727989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173763037 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173767090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173825979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173831940 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173873901 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173891068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173899889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173930883 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173948050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173958063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.173964024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.173993111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.174001932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.174005032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.174026012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.174030066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.174046040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.174058914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.176940918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.176989079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.176996946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177032948 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177095890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177104950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177145004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177233934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177242994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177279949 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177303076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177359104 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177417040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177444935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177462101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177488089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177522898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177531958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177542925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177562952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177571058 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177572012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177606106 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177614927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177623034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177635908 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177644014 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177675962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177685022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177695990 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177735090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.177787066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.177833080 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178004980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178056002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178071976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178081989 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178111076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178124905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178148031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178181887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178193092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178225040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178227901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178236961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178246021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178278923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178356886 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178400993 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178426027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178436995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178446054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178450108 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178478956 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178493977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178497076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178527117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178538084 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178540945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178558111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178584099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178607941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178628922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178638935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178661108 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178663015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178682089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178714037 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178718090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178723097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178754091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178765059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178805113 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178817034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178870916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178885937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178905010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178915024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.178929090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.178961992 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.179014921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.179055929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.179071903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.179111004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.181868076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.181881905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.181929111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183114052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183125973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183135033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183139086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183150053 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183160067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183167934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183176041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183180094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183186054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183191061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183207035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183214903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183223009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183232069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183232069 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183247089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183255911 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183259964 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183269978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183279991 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183281898 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183288097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183295965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183296919 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183306932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183321953 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183340073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183348894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183350086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183358908 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183361053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183378935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183387995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183402061 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183403969 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183422089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183429003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183437109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183439970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183448076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183481932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183485031 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183510065 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183518887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183554888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183604002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183655024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183691025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183716059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183749914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183799028 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183808088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183815956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183840036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183855057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183897972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183916092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183932066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.183978081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.183990955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.184001923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.184047937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.184092999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.184102058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.184109926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.184118032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.184145927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.184164047 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188257933 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188287020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188323021 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188349009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188404083 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188483000 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188522100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188535929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188568115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188569069 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188577890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188622952 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188652992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188674927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188683987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188692093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188698053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188724041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188734055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188734055 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188780069 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188816071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188824892 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188883066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188884974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188894033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188915968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188932896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188952923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.188967943 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.188977957 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189022064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189022064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189073086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189150095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189172029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189179897 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189189911 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189197063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189213037 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189224958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189268112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189290047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189316988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189335108 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189410925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189419985 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189460993 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189503908 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189559937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189598083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189606905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189624071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189637899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189646006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189649105 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189659119 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189661980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189687967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189697027 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189713955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189723015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189726114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189764977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189806938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189815998 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189822912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189858913 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189868927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189877033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189881086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189913988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189917088 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.189922094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.189964056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.193171978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193218946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193258047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193278074 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.193295002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.193398952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193437099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193439960 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.193501949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193546057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.193547964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193586111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.193650007 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193694115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193732023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193734884 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.193880081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193892002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.193928957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194027901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194037914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194077015 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194118023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194179058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194216967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194225073 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194278955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194308043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194322109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194353104 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194463968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194473982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194482088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194504976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194519043 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194550037 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194583893 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194607973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194655895 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194771051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194819927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194866896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194916964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194951057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194988966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.194996119 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.194998026 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195035934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195055962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195126057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195142984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195153952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195161104 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195163012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195173025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195173979 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195203066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195235014 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195251942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195261002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195271015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195310116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195331097 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195355892 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195357084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195369005 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195384979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195403099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195409060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195424080 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195445061 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195481062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195496082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195512056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195538998 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195549965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195557117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195617914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195627928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195653915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195662975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195677042 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195686102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195703983 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195729971 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195739031 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195751905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195770979 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195771933 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195790052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195811987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195842981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195867062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195898056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195908070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195909023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195916891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195925951 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.195954084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.195966005 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.201039076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.201195002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.201364994 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.201431036 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.201478958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.201543093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.201559067 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.206219912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206278086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206348896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.206478119 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206639051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206753016 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206764936 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.206784010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206830025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206841946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.206846952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206865072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206890106 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.206907988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.206917048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206952095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206958055 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.206981897 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.206995964 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207032919 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207034111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207046032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207073927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207084894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207098961 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207118988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207132101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207154036 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207216978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207226038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207232952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207263947 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207279921 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207309961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207325935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207334042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207350016 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207372904 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207375050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207384109 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207391024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207426071 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207439899 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207473040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207482100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207489967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207523108 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207524061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207532883 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207540989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207572937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207577944 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207597017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207612991 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207621098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207628965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207662106 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207669020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207711935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207720995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207730055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207777977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207808018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207823038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207839012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.207851887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.207881927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211144924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211203098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211311102 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211667061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211714983 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211723089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211745024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211767912 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211783886 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211807013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211815119 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211854935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211905956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211922884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211934090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.211955070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211973906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.211998940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212014914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212034941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212042093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212044954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212052107 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212086916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212111950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212163925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212166071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212177038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212203979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212214947 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212239981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212286949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212296009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212320089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212333918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212337017 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212342024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212353945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212389946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212400913 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212459087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212485075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212500095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212517977 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212541103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212567091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212578058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212621927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212635040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212644100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212683916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212691069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212698936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212727070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212738991 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212752104 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212784052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212795019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212825060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212836027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212884903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.212949038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212970972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.212980032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213013887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213032007 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213042021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213083029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213100910 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213110924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213139057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213151932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213164091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213176966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213177919 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213191986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213212013 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213219881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213229895 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213233948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213262081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213268995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213299036 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213318110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213339090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213362932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213362932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213376999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213382959 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213387012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.213392973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213409901 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.213423967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216176033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216186047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216228962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216531038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216573954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216618061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216651917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216664076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216694117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216695070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216736078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216742039 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216788054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216794968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216825008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216833115 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216865063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216907024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216936111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216954947 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216960907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.216979980 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.216993093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217015982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217037916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217060089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217072964 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217128992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217138052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217164040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217180014 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217195988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217225075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217258930 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217267990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217299938 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217325926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217343092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217365980 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217377901 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217439890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217470884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217485905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217497110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217502117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217535019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217570066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217592955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217609882 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217616081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217622995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217647076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217670918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217711926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217716932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217753887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217777014 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217820883 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217824936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217839003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217864990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217866898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217875957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217907906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217909098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217948914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.217952013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.217995882 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218030930 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218045950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218055964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218079090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218099117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218131065 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218139887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218178034 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218225956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218235016 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218255997 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218275070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218291044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218312979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218334913 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218358040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218370914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218400002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218442917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218445063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218496084 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218498945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218538046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218539000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218576908 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218590975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218599081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218636990 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218638897 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218645096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218681097 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218719959 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218770981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218842030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218857050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218867064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218874931 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218885899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218902111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218903065 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218913078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.218926907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218956947 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.218964100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.219000101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.219042063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.219050884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.219054937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.219111919 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.219116926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.219131947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.219141960 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.219170094 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.219182968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221004009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221026897 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221054077 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221069098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221163988 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221205950 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221398115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221529007 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221575975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221594095 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221612930 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221674919 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221684933 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221726894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221735954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221765995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221802950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221826077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221900940 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.221935034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221945047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221960068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.221995115 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222009897 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222027063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222073078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222132921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222181082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222198009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222235918 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222285032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222316980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222325087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222356081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222393036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222404003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222439051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222445011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222474098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222500086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222531080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222548008 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222558975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222564936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222626925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222628117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222683907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222727060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222770929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222786903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222795963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222866058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222909927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222918987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.222923040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.222956896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223006010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223021984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223048925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223063946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223093033 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223145962 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223181009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223212957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223221064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223270893 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223299980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223310947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223342896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223362923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223376036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223391056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223434925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223463058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223511934 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223654032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223700047 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223795891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.223841906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.223964930 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224097013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224129915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224147081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224188089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224189997 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224231958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224275112 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224356890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224373102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224383116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224420071 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224462032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224534035 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224536896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224580050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224658012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224668026 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224675894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224725008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224735022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224750996 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224782944 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224801064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224812031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224852085 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224862099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224869967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224889040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224905014 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224934101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224935055 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.224970102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.224986076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.225028038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.225040913 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.225079060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.225089073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.225140095 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.225800991 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.225917101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.225971937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.226001978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226424932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226433992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226480007 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.226505995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226561069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226569891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226598024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226617098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.226635933 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.226700068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226753950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226795912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226803064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.226840973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.226845026 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226958990 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226978064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.226988077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227014065 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227094889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227123022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227133989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227165937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227195024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227224112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227242947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227269888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227292061 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227332115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227348089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227380037 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227385044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227387905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227423906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227444887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227474928 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227487087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227503061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227524042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227545023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227560997 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227566004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227699995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227752924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227786064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227814913 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227864027 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.227904081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227912903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227957964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.227971077 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228003025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228005886 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228049040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228092909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228110075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228126049 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228162050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228176117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228209019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228216887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228245020 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228254080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228262901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228281975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228301048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228319883 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228368044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228414059 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228574991 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228599072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228615999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228632927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228898048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228939056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.228941917 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.228979111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229089022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229132891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229149103 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229173899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229266882 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229311943 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229324102 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229334116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229346037 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229372025 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229372978 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229404926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229422092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229434013 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229446888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229489088 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229592085 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229629993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229635954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229662895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229675055 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229698896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229758024 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229798079 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229840994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229854107 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229873896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229887962 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229892015 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229896069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229906082 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229923964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229935884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229938984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229955912 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229959965 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.229976892 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.229995966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.230034113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230056047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230070114 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230077028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.230086088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230102062 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.230106115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230110884 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.230144024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.230149984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230191946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.230771065 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230818033 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.230901003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.230942965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231224060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231250048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231267929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231290102 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231403112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231416941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231426954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231442928 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231450081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231467009 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231477976 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231488943 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231523037 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231534004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231563091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231571913 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231616974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231654882 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231695890 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231776953 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231812954 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231815100 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231854916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231854916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231894970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231899023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231909990 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.231934071 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.231945038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.232019901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.232058048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.232062101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.232096910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.232105017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.232146978 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.232157946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.232201099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.232475042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.232513905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.232917070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.232968092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.233294010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233303070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233310938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233319044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233328104 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233355045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.233387947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233397007 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233405113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233412981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233419895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233438969 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.233449936 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.233470917 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.233555079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.233593941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234222889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234266996 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234678030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234688044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234703064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234711885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234719038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234731913 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234735012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234741926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234745979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234759092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234764099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234774113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234776020 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234781981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234786987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234790087 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234797955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234802961 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234807014 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234817028 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234817982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234831095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234833956 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234844923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234853029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234860897 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234867096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234878063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234889984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234899044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234903097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234905005 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234910011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234924078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234925985 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234932899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234947920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234956980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234957933 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.234963894 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234973907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.234982967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.235011101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.235025883 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.235210896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.235253096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.235291958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.235301018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.235358953 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.235754967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.235801935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.235914946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.235959053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236196041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236215115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236226082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236238956 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236253977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236262083 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236284018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236293077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236325979 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236615896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236625910 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236633062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236641884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236665964 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236685038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236761093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236769915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236809969 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.236901045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236912012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.236952066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.237035036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237164974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237174034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237181902 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237234116 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.237291098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237335920 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.237459898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237471104 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237499952 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.237503052 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237509966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.237550020 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.237900019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.237943888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.238382101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238392115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238399982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238404036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238410950 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238428116 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.238447905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.238459110 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.238465071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238472939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238481045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238491058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238521099 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.238677979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238719940 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.238837004 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238846064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.238883972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.238972902 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.239016056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.239500999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.239547014 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240313053 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240320921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240328074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240361929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240427971 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240437984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240446091 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240453959 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240480900 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240490913 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240531921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240540028 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240549088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240581036 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240596056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240643978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240653038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240660906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240669966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240691900 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240706921 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240736961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240788937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240797997 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240807056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240818024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240823030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240829945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240833044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240840912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240840912 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240850925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240852118 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240859032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240866899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240876913 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240885019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240885019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240892887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240900993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240910053 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240919113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240921974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240942955 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.240945101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240953922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240962029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.240969896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241018057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241048098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241111994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241121054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241128922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241147041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241149902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241156101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241159916 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241167068 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241172075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241179943 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241200924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241203070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241209984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241219044 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241221905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241252899 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241266012 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241288900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241297960 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241306067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241338968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241497993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241538048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241571903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241580963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241588116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241614103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241631985 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.241698980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241708040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.241739035 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.283668041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.283866882 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.283945084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.283989906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.284038067 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.284073114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.334455967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 4, 2025 22:58:14.335360050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.335447073 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.335520029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 4, 2025 22:58:14.335586071 CET	49709	15666	192.168.2.6	66.63.187.173

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 22:58:09.339297056 CET	192.168.2.6	1.1.1.1	0x6316	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 22:58:09.346060991 CET	1.1.1.1	192.168.2.6	0x6316	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 4, 2025 22:58:09.346060991 CET	1.1.1.1	192.168.2.6	0x6316	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 4, 2025 22:58:09.346060991 CET	1.1.1.1	192.168.2.6	0x6316	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	104.26.12.205	443	5336	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 21:58:10 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-01-04 21:58:10 UTC	423	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 21:58:10 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8fce7d09af714295-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1734&min_rtt=1734&rtt_var=867&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4182&recv_bytes=738&delivery_rate=112976&cwnd=252&unsent_bytes=0&cid=6b514b6db2f2cfbb&ts=258&x=0"
2025-01-04 21:58:10 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	16:58:07
Start date:	04/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9a0000
File size:	1'293'312 bytes
MD5 hash:	E4988EB723CE5D55A74E5797C22F5D83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:58:07
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:58:07
Start date:	04/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9a0000
File size:	1'293'312 bytes
MD5 hash:	E4988EB723CE5D55A74E5797C22F5D83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000003.00000002.3391417827.00000000014A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.9%
Total number of Nodes:	1336
Total number of Limit Nodes:	11

Executed Functions

Function 009BA1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,009BA11B,009BA10B), ref: 009BA33F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 009BA352
Wow64GetThreadContext.KERNEL32(0000010C,00000000), ref: 009BA370
ReadProcessMemory.KERNELBASE(00000110,?,009BA15F,00000004,00000000), ref: 009BA394
VirtualAllocEx.KERNELBASE(00000110,?,?,00003000,00000040), ref: 009BA3BF
WriteProcessMemory.KERNELBASE(00000110,00000000,?,?,00000000,?), ref: 009BA417
WriteProcessMemory.KERNELBASE(00000110,00400000,?,?,00000000,?,00000028), ref: 009BA462
WriteProcessMemory.KERNELBASE(00000110,?,?,00000004,00000000), ref: 009BA4A0
Wow64SetThreadContext.KERNEL32(0000010C,00980000), ref: 009BA4DC
ResumeThread.KERNELBASE(0000010C), ref: 009BA4EB

Strings

ress, xrefs: 009BA231
VirtualAlloc, xrefs: 009BA26E
TerminateProcess, xrefs: 009BA3CE
ResumeThread, xrefs: 009BA2E3
WriteProcessMemory, xrefs: 009BA2BA
Load, xrefs: 009BA1E5
CreateProcessW, xrefs: 009BA25B
aryA, xrefs: 009BA1ED
VirtualAllocEx, xrefs: 009BA2A7
SetThreadContext, xrefs: 009BA2CD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 009BA33E
GetP, xrefs: 009BA229
ReadProcessMemory, xrefs: 009BA294
GetThreadContext, xrefs: 009BA281

Memory Dump Source

Source File: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: aba553202450b39f9cdcbf24903983d6fe70be683a71636a562ca45e9e6ba17e
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: F2B1087260024AAFDB60CF68CD80BDA73A5FF88724F158524EA0CAB341D774FA51CB94

Function 009A94CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,E99BA2FA,?,009A95DD,?,?,00000000), ref: 009A958F

Strings

api-ms-, xrefs: 009A9525
ext-ms-, xrefs: 009A9539

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction ID: a85474ac283111abf3178413e80806fcab9311c6e02d78736d2aacf71f32731b
Opcode Fuzzy Hash: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction Fuzzy Hash: 1A215035E05211A7C7229B64DC41A6E77ACFB8B7B1F140610FD06A72D1DB70EE01D6D0

Function 009A1930 Relevance: 9.2, APIs: 6, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009A19D0
GetFileSize.KERNEL32 ref: 009A1A01
CloseHandle.KERNEL32 ref: 009A1A1E

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction ID: 01dbf0d9918108c55e6b4145a7798ef981f9bb530ca0a367eb947cb308af8286
Opcode Fuzzy Hash: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction Fuzzy Hash: F481F0B4D0A258DFCB00DFA8D584BAEBBF0BF4A314F104929E455A7381D7789948CF96

Function 009AD525 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 009AD5AA
__alloca_probe_16.LIBCMT ref: 009AD673
__freea.LIBCMT ref: 009AD6DA

Part of subcall function 009AB3B5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,009A3C34,?,?,009A2442,00001000,?,009A23AA), ref: 009AB3E7

__freea.LIBCMT ref: 009AD6ED
__freea.LIBCMT ref: 009AD6FA

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: be25caeff3c76fd51f2c8156eeb3c609f1068380a2843cfded3a49d8a625dc4b
Instruction ID: 274e42a4a04f457c7af23c7a05c44a0231417b70685d8ef8d5a8b197426a4369
Opcode Fuzzy Hash: be25caeff3c76fd51f2c8156eeb3c609f1068380a2843cfded3a49d8a625dc4b
Instruction Fuzzy Hash: 0951C372602246AFEF205F64CC81EBB37ADEF8A714B190529FD0AD6551EB75CC10C6E0

Function 009A17E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 009A1849
VirtualProtect.KERNELBASE ref: 009A18F7

Strings

@, xrefs: 009A18EB

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: 3366da4662ad41591c863ead7e174367602c92419c7a2b47eb059d441977b7ea
Instruction ID: 201863e6c95d973326811e8a48b58f6d2c527140b21287903a36903d71b8e2f5
Opcode Fuzzy Hash: 3366da4662ad41591c863ead7e174367602c92419c7a2b47eb059d441977b7ea
Instruction Fuzzy Hash: AF31B1B0904308DFDB04EFA9D59969EBBF0FF49318F118529E448AB350D7749944CF95

Function 009A67F4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(009A34C0,?,Function_0000690C,00000000,?,009A34C0), ref: 009A683D
GetLastError.KERNEL32(?,00000000,00000000,?,009A3379), ref: 009A6849
__dosmaperr.LIBCMT ref: 009A6850

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 2d876ae943e00324297c0163106d2222dca7846d94199fd4963fd919224f0f30
Instruction ID: 1e3001c5fff246c77931e4d7c7ffb2b6172fd9569bcf3ff62370483b29dcf73c
Opcode Fuzzy Hash: 2d876ae943e00324297c0163106d2222dca7846d94199fd4963fd919224f0f30
Instruction Fuzzy Hash: F2019E72904219EBDF15AFA4CC06AAF7B7DEF82364F144118F90192150DB78C950DBD1

Function 009AA0BA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009AA2BF: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 009AA2EA

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,009AA4CA,?,00000000,?,00000000,?), ref: 009AA11B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,009AA4CA,?,00000000,?,00000000,?), ref: 009AA157

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 136ce0e1a261d644a6376a654c352102283f896b05ddf7125bcf35f93af321ec
Instruction ID: e279b2d9e7e2d517ff6281f25a33d57180a20641fb3fa57d01f0db75f31883f1
Opcode Fuzzy Hash: 136ce0e1a261d644a6376a654c352102283f896b05ddf7125bcf35f93af321ec
Instruction Fuzzy Hash: 93515570A043459FDB21CF75C8857BABBF9EF82310F18846ED4A68B251E7759942CBC2

Function 009A3C1A Relevance: 3.1, APIs: 2, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009A44C7
___raise_securityfailure.LIBCMT ref: 009A45AF

Part of subcall function 009A556E: RaiseException.KERNEL32(E06D7363,00000001,00000003,009A44BB,?,?,?,?,009A44BB,00001000,009B875C,00001000), ref: 009A55CF

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 3749517692-0
Opcode ID: 18dfcbda479b07ca0accd96e8fdcd8443fb145868dbfc8ba1f6d90bc24b8a3ea
Instruction ID: 029790744d08ded9a50211cebb7e375cbbf1f2c34e3e724f6ae11b0c04f385b2
Opcode Fuzzy Hash: 18dfcbda479b07ca0accd96e8fdcd8443fb145868dbfc8ba1f6d90bc24b8a3ea
Instruction Fuzzy Hash: 68315D74528208AFD704DF59FE567497BA8FB59320F108629F9249A2F1EBF09940EB84

Function 009A9EAC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,009A9D9B,009B90B8,0000000C), ref: 009A9EF8
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,009A9D9B,009B90B8,0000000C), ref: 009A9F0A

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 130e339aa17b110fcbfaa4fb18dc644e1ce68b13666d047f75db63b5c36ec788
Instruction ID: 514ecc4adb0175f6cf523d1595d3aaaf817d7344959aecffa6ea40a9ea983d29
Opcode Fuzzy Hash: 130e339aa17b110fcbfaa4fb18dc644e1ce68b13666d047f75db63b5c36ec788
Instruction Fuzzy Hash: D311B1315187414AC7308E3E8C88623BA98BB97370B380B5EE1B6C65F6C734DD86D6C4

Function 009A690C Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(009B8D78,0000000C), ref: 009A691F
ExitThread.KERNEL32 ref: 009A6926

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 6aa2b3cdd0a07e620e0a662088f0a209ae3cb9f5773785d50f4f19aa7038996b
Instruction ID: 35c90710430566f93836189e11a4738c5a6978eefeb8fb0906e57fd9fec00b01
Opcode Fuzzy Hash: 6aa2b3cdd0a07e620e0a662088f0a209ae3cb9f5773785d50f4f19aa7038996b
Instruction Fuzzy Hash: 98F0AF74A582049FDB01AFB0C94AB6E7B78FFC6320F104649F40297292CB349900DBE0

Function 009A9357 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,009AD615,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 009A938B
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,009AD615,?,?,-00000008,?,00000000), ref: 009A93A9

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: e602d6bc9e3aa85e01c3edd9eff7d13649df84d75396ef68a098878b742d2206
Instruction ID: 4cad842d209cc93480a0fbf28ad87a823eb3fd9d37596372d2fb433db5198c4a
Opcode Fuzzy Hash: e602d6bc9e3aa85e01c3edd9eff7d13649df84d75396ef68a098878b742d2206
Instruction Fuzzy Hash: 9AF0283240511ABBCF126F90DD09ADE7E66BF897A0B058510FA1965160CA36C971AB90

Function 009AA83B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,009AB3A9,?,00000000,?,?,009AB2C5,?,00000007,?,?,009AB8DE,?,?), ref: 009AA851
GetLastError.KERNEL32(?,?,009AB3A9,?,00000000,?,?,009AB2C5,?,00000007,?,?,009AB8DE,?,?), ref: 009AA85C

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8eb9401049f7ab4e3c22a75b1d2a003b71f2246fe8d72125b3e412f7e09e552b
Instruction ID: 73eb7f728ab23abde04a720a7dbf142874140e3fecec19758da5b6b5d04242bc
Opcode Fuzzy Hash: 8eb9401049f7ab4e3c22a75b1d2a003b71f2246fe8d72125b3e412f7e09e552b
Instruction Fuzzy Hash: 05E08C32108204ABCB112FE4ED09B9A3A6CEB853A5F100021F608A6060CB78C950D7CA

Function 009AA649 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,009AA4CA,?), ref: 009AA67B

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 93f617ad8351819b41dd0c329ba238b0563d6bd2c794dbeb3ddd1f897e008b0e
Instruction ID: 7fa1ce8094873295afdbbbd327a72ef4cf61cf3914719680bd6d5486ca0f5f1f
Opcode Fuzzy Hash: 93f617ad8351819b41dd0c329ba238b0563d6bd2c794dbeb3ddd1f897e008b0e
Instruction Fuzzy Hash: 565139B1908158AFDB118F28CD84BEABBBCEB57300F1405E9E499C7182D3359E45DFA1

Function 009A32D0 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009A33B3

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 842316b09da73e2cb9295805de4fc644ef262b1b8d3d846644279b23c2e55411
Instruction ID: c1424dccda464e555cc5cdc51eea3138218b7d8e5e8d092bae5e2555550030ed
Opcode Fuzzy Hash: 842316b09da73e2cb9295805de4fc644ef262b1b8d3d846644279b23c2e55411
Instruction Fuzzy Hash: B731B2B59112089FCB04DFA8C545B9EFBF0FB4A314F10C56AE819AB351D7759A04CFA1

Function 009A9599 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba143aa04d08f6e868f59c081e54b62f987e86bce2c2834706461eecc24d0ab
Instruction ID: 426d6600f848bf76fa7e9d075905370aaf824e59c381b8834be471e2396473c4
Opcode Fuzzy Hash: 0ba143aa04d08f6e868f59c081e54b62f987e86bce2c2834706461eecc24d0ab
Instruction Fuzzy Hash: E1012833A28214AF8B128F68ED91A1A33A9FBC67303394224F901C7098DF30D800D7C5

Function 009AB3B5 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,009A3C34,?,?,009A2442,00001000,?,009A23AA), ref: 009AB3E7

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8a8e7ff4748bbb642bd1f9c3b7f57c4f071f98e388cfc032c974a3f9bb7f07c0
Instruction ID: b5f5f83da4b7381b7ba5a5dee8f068ff108fe3a4f37b81e7517247fa00add110
Opcode Fuzzy Hash: 8a8e7ff4748bbb642bd1f9c3b7f57c4f071f98e388cfc032c974a3f9bb7f07c0
Instruction Fuzzy Hash: 14E06D3120A625A7DF213B769D02BAB7A4CEF833B0F150560AE459A1D2DFA8CC0082E1

Function 009A17A0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 009A17D5

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 45137b88dff520a9ab5897397a588b9e65709846456d2a510d0fd0e4a8219326
Instruction ID: 73edb055628724b9f792a8733d133aac82557b9b173b3e54fb99d7646543a1ed
Opcode Fuzzy Hash: 45137b88dff520a9ab5897397a588b9e65709846456d2a510d0fd0e4a8219326
Instruction Fuzzy Hash: A2E0C230A18208ABD300EF79CC0479A7BE4EF4A320F418038E988CB344DA34E8408796

Non-executed Functions

Function 009ABF4B Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009AC03B

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 4c9102af5bfc20c85b56e6cca22f084281f4f2287bc2bf131e62df7cd2a5d273
Instruction ID: 361cf21a114be61aae24ad28b791fd7dfc5b1c57f930a5884e0693c4a4243192
Opcode Fuzzy Hash: 4c9102af5bfc20c85b56e6cca22f084281f4f2287bc2bf131e62df7cd2a5d273
Instruction Fuzzy Hash: E571D8B19091689FDF20AF28CC8DABEB7B9EF46304F1441D9E40DA7252DB354E859F90

Function 009A5027 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 009A5033
IsDebuggerPresent.KERNEL32 ref: 009A50FF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009A5118
UnhandledExceptionFilter.KERNEL32(?), ref: 009A5122

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 07a1f03c9ba84d87ace61368335bc5fe2bc0c396918eded940e1d64fc633ea95
Instruction ID: 322b30c106090feb4ba349b24dafb1523542fb2f956019d2a8b9c0bc2d5c8015
Opcode Fuzzy Hash: 07a1f03c9ba84d87ace61368335bc5fe2bc0c396918eded940e1d64fc633ea95
Instruction Fuzzy Hash: 38312975D05218DBDF20EFA4D9497CDBBB8BF08300F1041AAE40CAB250EB709A84CF85

Function 009A78CC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 009A79C4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 009A79CE
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 009A79DB

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bd38d527c8e62e891740035053cd47ce91f4d3930fda4331cfa7d1552e3c378e
Instruction ID: 2fa09dd8cd3c8485fb0552213996473a70a752ef7644b4b98d5fb15250a345d5
Opcode Fuzzy Hash: bd38d527c8e62e891740035053cd47ce91f4d3930fda4331cfa7d1552e3c378e
Instruction Fuzzy Hash: 9931D3749012199BCB61DF64DD89B8DBBB8BF48310F5042EAE41CA6250EB709B858F45

Function 009A48D3 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,009A4844,?,?,?,?,009A4868,000000FF,?,?,?,009A4780,00000000), ref: 009A490B
GetSystemTimeAsFileTime.KERNEL32(?,E99BA2FA,?,?,009B1B3D,000000FF,?,009A4844,?,?,?,?,009A4868,000000FF,?), ref: 009A490F

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: cef6daea4f57ec4a42ea7d921f674ee55bb3c774785b98b0e37271350c15076d
Instruction ID: 1e965eebcc0eda7302fcb39feb3e4f57a7ccdded04f9d3608a0d95c3924dcd40
Opcode Fuzzy Hash: cef6daea4f57ec4a42ea7d921f674ee55bb3c774785b98b0e37271350c15076d
Instruction Fuzzy Hash: 26F0A07291C558EFCB019F44DD40B9AB7A8FB89F30F00472AE81293290DBB469009A80

Function 009B1542 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009B149D,?,?,00000008,?,?,009B106F,00000000), ref: 009B176F

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7fa87736b37089d49c70f2615b57555682a49e7427471b5295ae04bc722592fc
Instruction ID: c35a8b3a686a25476e146a2f068a68e81de44d8d759d22bbceaeec47b51a572d
Opcode Fuzzy Hash: 7fa87736b37089d49c70f2615b57555682a49e7427471b5295ae04bc722592fc
Instruction Fuzzy Hash: A5B17E31610608DFD719CF28C59ABA47BE0FF45364F69865CE89ACF2A1C735D992CB40

Function 009A5235 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009A524B

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c781cc53eab90a83bd73c58f60cbec986851fd2133e2ce4b508c2a9835cdc374
Instruction ID: df1cf6e6ba1017b9755f8f59eed6cc1daf664062aac89684631d62d322885c3f
Opcode Fuzzy Hash: c781cc53eab90a83bd73c58f60cbec986851fd2133e2ce4b508c2a9835cdc374
Instruction Fuzzy Hash: E1A1B1B1E25604CFDB19CF59EA89299BBF5FB49330F19822AD419E73A0D3749840CF91

Function 009ABE9A Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009AAF77: HeapAlloc.KERNEL32(00000008,?,?,?,009A97D4,00000001,00000364,?,00000002,000000FF,?,009A6931,009B8D78,0000000C), ref: 009AAFB8

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009AC03B
FindNextFileW.KERNEL32(00000000,?), ref: 009AC12F
FindClose.KERNEL32(00000000), ref: 009AC16E
FindClose.KERNEL32(00000000), ref: 009AC1A1

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: e1ac476da1c96a9b1f2ce3497cf0db6c2f005c2d6169bc2e8e85568ce60cfd0d
Instruction ID: 9a9bbd830bedca2ee9a3d7f61e716d1205a0e60780ea6e1785d20283409fd159
Opcode Fuzzy Hash: e1ac476da1c96a9b1f2ce3497cf0db6c2f005c2d6169bc2e8e85568ce60cfd0d
Instruction Fuzzy Hash: 52513975904118AFDF24AF289C85AFEB7ADDF87354F284199F41997202EB308D429FE0

Function 009A501B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000513C,009A4ACD), ref: 009A5020

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ddda61707dc807ae78a08d0cac42aa7c806b9a24a5f75ba729d6dffbbe3af3ec
Instruction ID: cddc9908a9bf00e25f628a35dd8185046de524e1ab33abd478eb7ead5c4e8579
Opcode Fuzzy Hash: ddda61707dc807ae78a08d0cac42aa7c806b9a24a5f75ba729d6dffbbe3af3ec
Instruction Fuzzy Hash:

Function 009A9726 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 009A9726

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 59d98c05383cdda0de75be7570194aa4639b16de44d16586c17b254b83542b06
Instruction ID: d33ca6a5e0bfe99cadc899763ecf8e49da88ffc2dd4a63d63bab38074a5619da
Opcode Fuzzy Hash: 59d98c05383cdda0de75be7570194aa4639b16de44d16586c17b254b83542b06
Instruction Fuzzy Hash: 62A0113022A2008B83008F30AF0822A3BA8AA882E03080228A008C02A0EB388088BA00

Function 009A1000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de833190065c281e4c59c4b97fc940f557d3fffbfb6dbd4246990f0bf234e24
Instruction ID: 61c23a42e0a4c70f97472f71b195e2905685b2013adfba454fd70ad84df8593e
Opcode Fuzzy Hash: 0de833190065c281e4c59c4b97fc940f557d3fffbfb6dbd4246990f0bf234e24
Instruction Fuzzy Hash: 9B519CB4D0421D9FCB40CFA8C591AEEBBF4EB49350F24845AE415FB310D734AA41CBA5

Function 009A1770 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8820505454afb2c4dbda9d98820f600b461d38d1dc6edc1ad5d484576f57d8
Instruction ID: f64957d39cd97ebaa91e780d50ee7ad9df96e537e2e63e727d1d93187ac7130a
Opcode Fuzzy Hash: ae8820505454afb2c4dbda9d98820f600b461d38d1dc6edc1ad5d484576f57d8
Instruction Fuzzy Hash: 9DD0927A655A58EFC610DF49E440D41F7B8FB8DA70B168166EA0893B20C331FC11CAE0

Function 009AF878 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00E805D8,00E805D8,00000000,7FFFFFFF,?,009AF863,00E805D8,00E805D8,00000000,00E805D8,?,?,?,?,00E805D8,00000000), ref: 009AF91E
__alloca_probe_16.LIBCMT ref: 009AF9D9
__alloca_probe_16.LIBCMT ref: 009AFA68
__freea.LIBCMT ref: 009AFAB3
__freea.LIBCMT ref: 009AFAB9
__freea.LIBCMT ref: 009AFAEF
__freea.LIBCMT ref: 009AFAF5
__freea.LIBCMT ref: 009AFB05

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8b247963671dc457030f398971ed3b4e6c9161701d92ba7c5fd4e74df975e9ba
Instruction ID: 30098e30e494c8bad2174f3113632eeb4d6fe41f97203ac291abca1d767197d7
Opcode Fuzzy Hash: 8b247963671dc457030f398971ed3b4e6c9161701d92ba7c5fd4e74df975e9ba
Instruction Fuzzy Hash: B871A372A002066BDF209BD4CC71BEF77BD9F8B314F294465E959A7282E7359C0087E0

Function 009A5C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009A5CB7
___except_validate_context_record.LIBVCRUNTIME ref: 009A5CBF
_ValidateLocalCookies.LIBCMT ref: 009A5D48
__IsNonwritableInCurrentImage.LIBCMT ref: 009A5D73
_ValidateLocalCookies.LIBCMT ref: 009A5DC8

Strings

csm, xrefs: 009A5D5D

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 84de25382fdff9bc768f5ef44ec691e27ee6db108f70e7680c5203d6dcd08c45
Instruction ID: 461fd20b615458a13ebcc93630798c4ef1ff6a66eb2ccec7fcca31495f361113
Opcode Fuzzy Hash: 84de25382fdff9bc768f5ef44ec691e27ee6db108f70e7680c5203d6dcd08c45
Instruction Fuzzy Hash: 7441B334A00619EBCF10DF68C888A9EBBB5FF86324F158155E8149B392D731AE41CBD1

Function 009A489F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 009A48A5
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 009A48B3
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 009A48C4

Strings

GetSystemTimePreciseAsFileTime, xrefs: 009A48AD
GetTempPath2W, xrefs: 009A48B9
kernel32.dll, xrefs: 009A48A0

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction ID: b34c87e8097b9f3c3ee6df09a95954731a0815f6fec601da13503c03224605d2
Opcode Fuzzy Hash: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction Fuzzy Hash: 80D09E316AA620AF8350AF747F0D8DB7EA9EB496B53064216F511E2261DBB44504DB90

Function 009A7F49 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009A7F40,009A5A6B,009A5180), ref: 009A7F57
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009A7F65
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009A7F7E
SetLastError.KERNEL32(00000000,009A7F40,009A5A6B,009A5180), ref: 009A7FD0

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3928c1046ab0db9c52f6bc9df5bd9df68d59ddccb5fa94073e3d2cb5f72471e7
Instruction ID: 0347aee122adfd4ccf86276ea0daabdae4a8c1a56758d8923d5243ba4a158e74
Opcode Fuzzy Hash: 3928c1046ab0db9c52f6bc9df5bd9df68d59ddccb5fa94073e3d2cb5f72471e7
Instruction Fuzzy Hash: D701F77251D2127EE61527F4ADCBA67BBACDB877B47200339F410450F0EF114C02A1D0

Function 009A87D9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009A88F8
CallUnexpected.LIBVCRUNTIME ref: 009A8B71

Strings

csm, xrefs: 009A892F
csm, xrefs: 009A8883
csm, xrefs: 009A8816

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 4a72702d4310071c175c1b7991267e06501531079fc49fc026ef44c3859a9272
Instruction ID: 40b251a1df3fc350a080cf0c510fc48fb691ece20f5d9b8013d5b25cd9ef1f62
Opcode Fuzzy Hash: 4a72702d4310071c175c1b7991267e06501531079fc49fc026ef44c3859a9272
Instruction Fuzzy Hash: F4B16B71800209EFCF18DFA4C881AAFBBB9FF86310F55455AE8116B212DB35DA51CBE1

Function 009AC2C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\file.exe, xrefs: 009AC2E0

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\file.exe
API String ID: 0-3695852857
Opcode ID: 0a05f609badd52dc5240a1e9a41d75fea421e49b3c09078c830089d5689ddea5
Instruction ID: 05507d55ab378ad77012b7e0a0c70fbd9d7593f76e689c04475c192514aa4026
Opcode Fuzzy Hash: 0a05f609badd52dc5240a1e9a41d75fea421e49b3c09078c830089d5689ddea5
Instruction Fuzzy Hash: 8C216DB1604205AFDF20AFB5C881A6B77ADAF463687108A15F929EB151DB35EC40CBE1

Function 009A6A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E99BA2FA,?,?,00000000,009B1B77,000000FF,?,009A6B21,00000002,?,009A6BBD,009A7DE9), ref: 009A6A95
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009A6AA7
FreeLibrary.KERNEL32(00000000,?,?,00000000,009B1B77,000000FF,?,009A6B21,00000002,?,009A6BBD,009A7DE9), ref: 009A6AC9

Strings

CorExitProcess, xrefs: 009A6A9F
mscoree.dll, xrefs: 009A6A8E

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction ID: c90c5b911599311d384dfbf4fb694a9f234e078919072ae645309173d3991b86
Opcode Fuzzy Hash: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction Fuzzy Hash: B3018431958519EBCB119F80CD05FBEB7BCFB48B64F084625A811A2290DB749804CA84

Function 009A46F6 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009A470A
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4729
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4757
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47B2
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47C9

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 621655cd93056934d67174f84aa8f6b1c5cf74be6eac924badd68353f50ab94e
Instruction ID: 3ca6a88fedcde88c12fcad319cb7f3d8516d2de825da09f77564b99f192a8789
Opcode Fuzzy Hash: 621655cd93056934d67174f84aa8f6b1c5cf74be6eac924badd68353f50ab94e
Instruction Fuzzy Hash: 51414A30910686DFCB20DF69D984AAAB3F9FF87310B504A2AD45697A40D7B4F944CFD1

Function 009AD200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748), ref: 009AD20D
GetLastError.KERNEL32(?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748,00000000,?,009A8E2C), ref: 009AD217
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009AD23F

Strings

api-ms-, xrefs: 009AD224

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction ID: d79eb59beefabec8c9a5e5fc1b309fdebffbf904ceb2f1ce7c05f0f86d008f97
Opcode Fuzzy Hash: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction Fuzzy Hash: 75E0D870298204B7DF112F50DC06FA93F6C9B85BA0F140020FD0DE44E1DB71E995D5C0

Function 009ADCA8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E99BA2FA,00000000,00000000,?), ref: 009ADD0B

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009ADF5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009ADFA3
GetLastError.KERNEL32 ref: 009AE046

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 71f5ac62476ce1d6fb3d90b754c54030c2f9b189a90062fcebf77ea2fda14e7d
Instruction ID: ab360b0bec38862491303f8b94eb5905db546f83b05f4926d5eec648f4170ce5
Opcode Fuzzy Hash: 71f5ac62476ce1d6fb3d90b754c54030c2f9b189a90062fcebf77ea2fda14e7d
Instruction Fuzzy Hash: 20D1AF75D042589FCF14CFA8C9809EDBBB9FF4A314F28452AE416EB751D730A942CB90

Function 009A8500 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009A85C7
___AdjustPointer.LIBCMT ref: 009A85EA
___AdjustPointer.LIBCMT ref: 009A8686

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9f4434b05531692d1851ead5088034e89c00f9ec6c880990a3e6f45d73c0a6e9
Instruction ID: 64eb0d958b18bc1c6ef1e9a5ab8750c24b95537435cdfc67330fac35c1d6284f
Opcode Fuzzy Hash: 9f4434b05531692d1851ead5088034e89c00f9ec6c880990a3e6f45d73c0a6e9
Instruction Fuzzy Hash: AB51E272A05606AFEB298F54D941BBB77A8FF46310F15456DEC02972A1EB31EC50CBD0

Function 009ABD28 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,009AC0CE,?,?,?,00000000), ref: 009ABD8C
__dosmaperr.LIBCMT ref: 009ABD93
GetLastError.KERNEL32(00000000,009AC0CE,?,?,00000000,?,?,?,00000000,00000000,?,009AC0CE,?,?,?,00000000), ref: 009ABDCD
__dosmaperr.LIBCMT ref: 009ABDD4

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f05f385384b0de71ebd2d610496399c1b4d85874f241a30bfc415241a960314e
Instruction ID: eccb56bab440cbaf77b51c30396320524af657333288217487c52a5cea59894d
Opcode Fuzzy Hash: f05f385384b0de71ebd2d610496399c1b4d85874f241a30bfc415241a960314e
Instruction Fuzzy Hash: AF21A4B1600206BFDB20AF66C881E6BB7ADFF463687118919F81997192D734EC40DBD1

Function 009AC99D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009AC9A5

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9FD

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: af4c3897fe8b515ce2c431340ef3e668c8ac88aa3d17d6eda54dc436fcfdd1e6
Instruction ID: 349e1d20f2aeed0942e84ce737000675205ba597ec21927584cdadd0c8e2ab8b
Opcode Fuzzy Hash: af4c3897fe8b515ce2c431340ef3e668c8ac88aa3d17d6eda54dc436fcfdd1e6
Instruction Fuzzy Hash: F31104F5915219BF6611A7B59C8DCBF695CDEDB3A43110124F401E9200EA28CD0291F1

Function 009A1E00 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009A1E2D
GetCurrentThreadId.KERNEL32 ref: 009A1E3B
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E54
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E93

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: d712e8c894e125d99cee007e307dbcadc6ddf9f1cbb911202c22b7d4c8661dc4
Instruction ID: e28c2aeaaf5c3a040c85ecc6c965378effdf32fa309211f74cfd85a1637c5f8b
Opcode Fuzzy Hash: d712e8c894e125d99cee007e307dbcadc6ddf9f1cbb911202c22b7d4c8661dc4
Instruction Fuzzy Hash: 3121E4B0E042098FCB04EFA8C5857AEBBF5EF89300F11845DE849AB351D7389A41CF91

Function 009AFD00 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000), ref: 009AFD17
GetLastError.KERNEL32(?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?,?,009AD9E0,00000000), ref: 009AFD23

Part of subcall function 009AFD74: CloseHandle.KERNEL32(FFFFFFFE,009AFD33,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?), ref: 009AFD84

___initconout.LIBCMT ref: 009AFD33

Part of subcall function 009AFD55: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009AFCF1,009AF48E,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD68

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD48

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction ID: d5653beaa3dc4be1b3262693e083b589b4e8550667f4f386525d479a7ba7cda1
Opcode Fuzzy Hash: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction Fuzzy Hash: C0F01C36414116BBCF232FD1DD08A8A3F6AFB493B1B004220FA0985570DB32C860EBD1

Function 009A4F01 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009A4F13
GetCurrentThreadId.KERNEL32 ref: 009A4F22
GetCurrentProcessId.KERNEL32 ref: 009A4F2B
QueryPerformanceCounter.KERNEL32(?), ref: 009A4F38

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction ID: 249e697ac7c80175cdc73755d8fdc4735cdd91e78fe27fa41fa217d7d6f19e67
Opcode Fuzzy Hash: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction Fuzzy Hash: 9CF06774D1420DEBCB00EBB4DA49ADFB7F8FF1D254B514A95A412E7110EB30A748EB51

Function 009A8BFD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,009A8AFE,?,?,00000000,00000000,00000000,?), ref: 009A8C22

Strings

MOC, xrefs: 009A8C34
RCC, xrefs: 009A8C3C

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 506913a0be1e3cf64139a302bef5eee10b0f706d4473a170e38788dee1134567
Instruction ID: 390a7c09216b659692ea9dda0a0bb16a51e3ea6b253e92099ff5ed3820b8f932
Opcode Fuzzy Hash: 506913a0be1e3cf64139a302bef5eee10b0f706d4473a170e38788dee1134567
Instruction Fuzzy Hash: 8A41AB71900209AFCF15CF94CD81AEEBBBAFF49310F144168F90467291D7359A50CFA0

Function 009A8469 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009A86E0

Strings

csm, xrefs: 009A8702
csm, xrefs: 009A8773

Memory Dump Source

Source File: 00000000.00000002.2139254104.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2139240281.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139272702.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139287630.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139300161.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139312633.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139326320.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction ID: e5eb7fef57c388b1591a1162c3e1c9b1a461c8bec64cc51ab6a3ef1869e36f37
Opcode Fuzzy Hash: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction Fuzzy Hash: 7831C436400219DFCF268F50CC449ABBBAAFF4A365B38455AF85449221DB36CCA1DFD1

Analysis Process: file.exePID: 5336, Parent PID: 2144COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.6%
Total number of Nodes:	1713
Total number of Limit Nodes:	87

Executed Functions

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 00485F72
GetSystemMetrics.USER32(0000004D), ref: 00485F7C
GetSystemMetrics.USER32(0000004E), ref: 00485F86
GetSystemMetrics.USER32(0000004F), ref: 00485F90
GetDC.USER32(00000000), ref: 00485F9A
GetDeviceCaps.GDI32(00000000,00000008), ref: 00485FAF
GetDeviceCaps.GDI32(?,0000000A), ref: 00485FBB
CreateCompatibleDC.GDI32(?), ref: 00485FC5
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 00485FDA
SelectObject.GDI32(?,00000000), ref: 00485FEE
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,40CC0020), ref: 0048601D
SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 0048604F
DeleteDC.GDI32(?), ref: 0048606E
ReleaseDC.USER32(00000000,?), ref: 00486077
DeleteObject.GDI32(?), ref: 00486083
IStream_Size.SHLWAPI(?,?,?), ref: 004860F5
IStream_Reset.SHLWAPI(?), ref: 00486104
IStream_Read.SHLWAPI(?,00000000,?,?), ref: 0048611E
DeleteDC.GDI32(?), ref: 00486175
ReleaseDC.USER32(00000000,?), ref: 00486183
DeleteObject.GDI32(?), ref: 0048618F

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Delete$CreateMetricsObjectStream_System$CapsCompatibleDeviceRelease$BitmapCallbackDispatcherReadResetSelectSizeStreamUser
String ID:
API String ID: 2798906502-0
Opcode ID: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction ID: 1540f068b23de5c11a4fec01122546931e44dbb37a8a944e45ab45a1281bc334
Opcode Fuzzy Hash: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction Fuzzy Hash: F4812971C01218AFDB11EB64DC49BEDBBB8EF09314F1041AAE509B7291DB742E84CF99

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000000,00000348,00000001), ref: 00486A68
Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000001), ref: 00486ABD

Part of subcall function 004868B0: RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Part of subcall function 004863F0: GetUserNameW.ADVAPI32(?,?), ref: 00486464

Part of subcall function 004864E0: GetComputerNameW.KERNEL32(?,?), ref: 00486554

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044BAD0: Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

GlobalMemoryStatusEx.KERNEL32(?,00000003), ref: 00488A6C
GetDesktopWindow.USER32 ref: 0048936A
GetWindowRect.USER32(00000000), ref: 00489371
_strftime.LIBCMT ref: 0048956B
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,system,00000006), ref: 0048979A

Strings

gpu, xrefs: 00488712
timezone, xrefs: 004899BF
system, xrefs: 004884CA, 00488633, 0048879C, 00488905, 00488A9E, 00488BDF, 00488D48, 00488F88, 004891A9, 00489507, 00489681, 00489933, 00489A78, 00489C87
time, xrefs: 004895E2
computer_name, xrefs: 00488CBE
%d-%m-%Y, %H:%M:%S, xrefs: 00489560
>wfw, xrefs: 0048920B
cpu, xrefs: 0048887B
ram, xrefs: 00488B55
user_name, xrefs: 004885A6

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Name$Concurrency::cancel_current_taskDevicesDisplayEnumWindow$ComputerDesktopFileGlobalMemoryModuleRectStatusUserValue_strftime
String ID: %d-%m-%Y, %H:%M:%S$>wfw$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 3994675093-2215247992
Opcode ID: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction ID: 1ab1bce1cb2369babe93dc2c843a9f66333b387f055d73d8335e63cf3a34051b
Opcode Fuzzy Hash: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction Fuzzy Hash: FC037970C052A99BDB26DF28C8547DDBBB1AF19308F2482DEE44867242DB751F85CF92

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,8047B0C5), ref: 0047E2A3
OpenProcessToken.ADVAPI32(00000000), ref: 0047E2AA
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 0047E2CE
CloseHandle.KERNEL32(00000000), ref: 0047E2F3
ExitProcess.KERNEL32 ref: 0047E32D
OpenMutexA.KERNEL32(001F0001,00000000,?), ref: 0047E411
ExitProcess.KERNEL32 ref: 0047E420
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 0047E436
ExitProcess.KERNEL32 ref: 0047E457
ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Strings

SeDebugPrivilege, xrefs: 0047E337
SeImpersonatePrivilege, xrefs: 0047E341

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$ExitMutex$CloseHandleOpenToken$CreateCurrentInformationRelease
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 1905835197-3768118664
Opcode ID: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction ID: e600725b129d9e3f70f3f4d3925b8df88ff981f4a24a656009bcaac003b6a44b
Opcode Fuzzy Hash: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction Fuzzy Hash: 80817F70D01258EFDB00EFE6D9457DDBBB4EF08308F10815EE51AA7281DB785A05DB69

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,8047B0C5), ref: 004464FE
GetProcAddress.KERNEL32(00000000,?), ref: 0044664C
GetProcAddress.KERNEL32(?,?), ref: 0044678C
GetProcAddress.KERNEL32(?,?), ref: 00446831
GetProcAddress.KERNEL32(?,?), ref: 004468D6
GetProcAddress.KERNEL32(?,?), ref: 0044697B
GetProcAddress.KERNEL32(?,?), ref: 00446A27
FreeLibrary.KERNEL32(00000000), ref: 004473A1

Strings

vault, xrefs: 00447225
system, xrefs: 004471E6
!F, xrefs: 00446482

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: system$vault$!F
API String ID: 2449869053-2452413646
Opcode ID: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction ID: b3fd50756066dde9c2bcdca3b11f87412f5b17b86e41c1a20d378922be8368ac
Opcode Fuzzy Hash: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction Fuzzy Hash: 2CA2DFB4D0426D8BDB25CFA8C884BEEBBB1BF59304F1081DAD948B7251DB385A85CF54

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00485AB8
InternetOpenUrlA.WININET(00000000,?,?,00000000,84880100,00000000), ref: 00485B23
HttpQueryInfoW.WININET(00000000,00000013,?,?,00000000), ref: 00485B7C
HttpQueryInfoW.WININET(00000000,00000005,?,00000040,00000000), ref: 00485C0D
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 00485C4F
InternetReadFile.WININET(00000000,00000000,?,0B911A77), ref: 00485CE0
InternetCloseHandle.WININET(00000000), ref: 00485DEE

Strings

dk{u, xrefs: 004858C5

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$Query$HttpInfoOpen$AvailableCloseDataFileHandleRead
String ID: dk{u
API String ID: 1359475806-1025949191
Opcode ID: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction ID: 61ea4010c365d261526b7633df9a1f3866779007c1279ae13805143fd257e1b9
Opcode Fuzzy Hash: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction Fuzzy Hash: 320203B0D057599BDB20CFA4C944BDDBBB5BF19304F20819AE848BB241EB746A84CF95

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000001,?,?), ref: 004B85DD
GetLastError.KERNEL32 ref: 004B85E7
FindFirstFileW.KERNEL32(000000FF,?), ref: 004B85FE
GetLastError.KERNEL32 ref: 004B8609
FindClose.KERNEL32(00000000), ref: 004B8615
___std_fs_open_handle@16.LIBCPMT ref: 004B86CE

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction ID: b482ff722bd6c6e5562e69f300935f677b27db246a655513dfd80cbad8c50a56
Opcode Fuzzy Hash: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction Fuzzy Hash: 6271A174A01619AFCB60CF28DC84BEAB7B8BF15314F24466AE854E3380DF389D41CB65

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,8047B0C5,8047B0C5,00000000,00000000), ref: 0048CBC1
OpenProcessToken.ADVAPI32(00000000), ref: 0048CBC8
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0048CBDF
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0048CC10
CloseHandle.KERNEL32(00000000), ref: 0048CC2E

Strings

SeDebugPrivilege, xrefs: 0048CBD9

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction ID: c2b5bf8999928723eaabf61e86e1a0babf1022b92d12b441156265fc3f808218
Opcode Fuzzy Hash: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction Fuzzy Hash: 4631A471D01208AFDB10DFA5DD85BEEBBB8EB09710F14422BE911B7280DB745A44CBB5

Function 004402D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 333fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 004403C0
FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Strings

Grabber, xrefs: 0044065F
content, xrefs: 0044063C
filename, xrefs: 004405E4

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: Grabber$content$filename
API String ID: 1690352074-1559270721
Opcode ID: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction ID: 3fd07a7a2c97014430c74f1e6d5836f1a3ad12268408335d8deab24a75892f91
Opcode Fuzzy Hash: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction Fuzzy Hash: 2BD1D430D01249DBEB15EB64CD457EEBBB4AF21308F1440AEE505A7292DB785F48CB96

Function 004473D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 301processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8047B0C5), ref: 0044741C
Process32FirstW.KERNEL32(00000000,?), ref: 00447468
Process32NextW.KERNEL32(?,0000022C), ref: 004475CD
CloseHandle.KERNEL32(?), ref: 004478D2

Strings

[PID: , xrefs: 004474B1

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: cefa39f860a061b5cdc928b49f93e6ea5fa11b751c85222641e7e19468bf29e5
Instruction ID: 3632983ffbfa210010dfb9a713b5006bf5dbac80d679a8e5b8b4f374b17b9b69
Opcode Fuzzy Hash: cefa39f860a061b5cdc928b49f93e6ea5fa11b751c85222641e7e19468bf29e5
Instruction Fuzzy Hash: 0AE14770D112689BDB2ADF24CC807AEBBB9BF59304F1481D9E84867251DB346F89CF45

Function 00485350 Relevance: 6.3, APIs: 4, Instructions: 316networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00002000,00000000), ref: 004854A4
recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(00000268), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction ID: ea48c0c3f42896101b1dfecbe024c21eb3956ad5c3a4809403442742827d540a
Opcode Fuzzy Hash: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction Fuzzy Hash: 4CE19C70D01298DEDB14EB64CC49BDEBBB2BF14308F1041DAE449AB292DB745E88DF95

Function 00487780 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 515timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,8047B0C5,00000000,000000BF), ref: 00487C87

Strings

@Zb=, xrefs: 00487A4F
[UTC, xrefs: 00487C45

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: @Zb=$[UTC
API String ID: 565725191-730387550
Opcode ID: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction ID: 6d71337f0f8cf227c7c56c381cd8fae4285dcd83216f0cb77706b7edbf0b928b
Opcode Fuzzy Hash: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction Fuzzy Hash: E0520270D052688BDB25CF28CC947DDBBB1BF59304F1082DAD949AB281DB756B85CF84

Function 004A1074 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049C0BD: RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
Part of subcall function 0049C0BD: GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Standard Time, xrefs: 004A117F
Eastern Summer Time, xrefs: 004A1193

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction ID: 53762b2ebd1cb462dfa51e434dc7c6f7f2cc61e8d19f93444a713380c049c16d
Opcode Fuzzy Hash: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction Fuzzy Hash: 73410871C00224ABDB10AF76DC45A9F7BB8EF6A754F10415BF510EB2A1E7349D04DB98

Function 004B84C0 Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,8047B0C5,00000001), ref: 004B84CC
FindFirstFileExW.KERNEL32(000000FF,00000001,8047B0C5,00000000,00000000,00000000,00000001,00000001,?,?,004B84EE,00000001,?,?,00437D69,?), ref: 004B84FB
GetLastError.KERNEL32(?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,8047B0C5,00000001), ref: 004B850D

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction ID: a5a0d7868366c0cca89b591e166bcddb9b03d08ebbd2c2fb18ba3c3c76c3338f
Opcode Fuzzy Hash: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction Fuzzy Hash: 0AF03071001109BFDB216FA4EC08AAA7B9DEB14360B10862ABD28C55A0EA359961DB79

Function 004479C0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 647COMMON

Download Yara Rule

APIs

Part of subcall function 00487290: RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,8047B0C5,?,0051C288), ref: 0048735B
Part of subcall function 00487290: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8047B0C5,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004487A3

Part of subcall function 004870B0: RegCloseKey.ADVAPI32(00000000), ref: 00487260

Strings

0hC, xrefs: 00448799

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Open$CloseEnumIos_base_dtorQueryValuestd::ios_base::_
String ID: 0hC
API String ID: 3553622603-2581318919
Opcode ID: ade7bf363ed15e6875cf1af1c8a60079e7d2754fd8a921585c80e4634e37238f
Instruction ID: d381e0b8d15ce89c3a027b92e8a5ae116750b180a2e65f5cba22683de7249f8f
Opcode Fuzzy Hash: ade7bf363ed15e6875cf1af1c8a60079e7d2754fd8a921585c80e4634e37238f
Instruction Fuzzy Hash: EA82CEB4E152688FEB25CF18C8957DDBBB0BF5A304F5082DAD98DA7241DB305A85CF81

Function 0047A610 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction ID: 0fc5e8941a16b16f9458543aa06cdc6e77fe0ca1878954e15eaf8ff6be4b297f
Opcode Fuzzy Hash: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction Fuzzy Hash: 86518B70C00249EBEB00DFA5D845BDEFBB4FF54708F14821AE81477281D7B96A98CBA5

Function 00487550 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,8047B0C5), ref: 00487605

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction ID: 0be71067b94349f3b163f10fc7865c9901b3f86c171c2f757c76e38bbf7f7ec5
Opcode Fuzzy Hash: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction Fuzzy Hash: 3351BD70C05318DBDB20DF64D85979EB7B0EF18304F1082DED409A7291EBB86A88CB95

Function 004863F0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00486464

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction ID: 991b9e5c4f1dd7985d860474454b41f109cd49006b683c09ab2e27c6457cb47f
Opcode Fuzzy Hash: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction Fuzzy Hash: AF217FB0D043189BD721DF15C844B9ABBF4FB08714F0046AEE84997380DBB9A6849BE5

Function 00486C50 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

cores, xrefs: 00486E4E

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction ID: e3a9e89045bf121aadbf864e887aeb25ba0c58f762de233e8adf5c73134b1a6d
Opcode Fuzzy Hash: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction Fuzzy Hash: 2B916871D003599BDB00CFA8C9547EEFBB4FF59304F14825AE404BB292EBB56A84CB91

Function 00480C80 Relevance: 19.8, APIs: 13, Instructions: 258
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004808F0: InitializeCriticalSectionEx.KERNEL32(0051C7AC,00000000,00000000), ref: 0048096F
Part of subcall function 004808F0: GetLastError.KERNEL32 ref: 00480979

EnterCriticalSection.KERNEL32(00000004,8047B0C5,?,?), ref: 00480CD8
GdiplusStartup.GDIPLUS(00000000,00000001,?), ref: 00480D08
LeaveCriticalSection.KERNEL32(00000004), ref: 00480D13
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00480D42
GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00480D50
__alloca_probe_16.LIBCMT ref: 00480D7E
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00480DCE
GdipCreateBitmapFromScan0.GDIPLUS(?,?,?,0026200A,?,?), ref: 00480EB3
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 00480ED0
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F33
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F4C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream__alloca_probe_16
String ID:
API String ID: 1308617310-0
Opcode ID: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction ID: f4feccb951fe1b922ecb3dfaf5b8302156747445c0b76c240fb24b0f4f51c94e
Opcode Fuzzy Hash: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction Fuzzy Hash: D1A165B1D10208DFDB50DFA4C984BAEBBF4FF49314F24452AE905A7340D778A949CBA9

Function 00481B10 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 293
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00485E30: GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

WSAStartup.WS2_32(00000202,00516D04), ref: 00481C85
socket.WS2_32(00000002,00000001,00000000), ref: 00481C98
htons.WS2_32(00000002), ref: 00481CBF
inet_pton.WS2_32(00000002,014BDCE8,00516E98), ref: 00481DA2
connect.WS2_32(00516E94,00000010), ref: 00481DB5
closesocket.WS2_32 ref: 00481DD5
WSACleanup.WS2_32 ref: 00481DDB

Strings

system, xrefs: 00481B74
NG, xrefs: 00481B1D
66.63.187.173, xrefs: 00481E15, 00481E2A
geo, xrefs: 00481C1D

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: 66.63.187.173$NG$geo$system
API String ID: 213021568-1796492518
Opcode ID: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction ID: a79096e42c26a1a604384fcb43a931ed9af1c00745f33276f8ffcea807cfd111
Opcode Fuzzy Hash: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction Fuzzy Hash: 1DC1AE70D01248DBDB00EFA8C8457DEBBB5FF15308F14421BE854AB391EBB86A85CB95

Function 004BC57A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BC233: CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

GetLastError.KERNEL32 ref: 004BC68E
__dosmaperr.LIBCMT ref: 004BC695
GetFileType.KERNEL32(00000000), ref: 004BC6A1
GetLastError.KERNEL32 ref: 004BC6AB
__dosmaperr.LIBCMT ref: 004BC6B4
CloseHandle.KERNEL32(00000000), ref: 004BC6D4
CloseHandle.KERNEL32(004BB653), ref: 004BC821
GetLastError.KERNEL32 ref: 004BC853
__dosmaperr.LIBCMT ref: 004BC85A

Strings

H, xrefs: 004BC7DF

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction ID: e4caf95108e2d56c13f9780512823c5111e6df0be3dd416bceb2684eca6e9c1f
Opcode Fuzzy Hash: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction Fuzzy Hash: 65A13632A041549FCF19AF68DCD1BEE3BA1AB46314F14015FF8119F391CB798906CBA9

Function 00481110 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 526
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004812EC
GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,000000B8), ref: 004812FC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00481388
ReadFile.KERNEL32(00000000,00000000,00516C10,00000000,00000000), ref: 004813A4

Strings

exists, xrefs: 0048181F
0hC, xrefs: 004812E2

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Ios_base_dtorPointerReadSizestd::ios_base::_
String ID: 0hC$exists
API String ID: 418202444-4085241440
Opcode ID: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction ID: 03b619e30c80654d4b10cf1501dd509fce63877f60a48615618d7203a258c35b
Opcode Fuzzy Hash: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction Fuzzy Hash: 3E425D70D01248DFDB10DFA9C9447DDBBF4BF19308F10819AE849A7291DB746A89CF95

Function 00453280 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00453446
___std_exception_destroy.LIBVCRUNTIME ref: 00453463

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,8047B0C5), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 004536B0
___std_exception_destroy.LIBVCRUNTIME ref: 004536CD

Strings

value, xrefs: 00453386, 004535E5
MC, xrefs: 0045343C, 00453458, 004536A6, 004536C2

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction ID: 0b049260404a019bd3923239173dd3b15bf9369a861e2bc94eedd162a5d5976f
Opcode Fuzzy Hash: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction Fuzzy Hash: 1EF16B70C05298DEEB20DB65C954BDEFBB4AF19304F1481DED84963282E7746B88CF96

Function 004823F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

encrypted_key, xrefs: 004825FA, 0048268E
0, xrefs: 004827FE
exists, xrefs: 0048291E
os_crypt, xrefs: 00482565, 004825ED, 00482681
0hC, xrefs: 00482852

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC$encrypted_key$exists$os_crypt
API String ID: 323602529-3393968299
Opcode ID: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction ID: 8ad686ceee80f5ac92384c61aa111afe13dce58c6585d204e44adfbc4e8d440e
Opcode Fuzzy Hash: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction Fuzzy Hash: 81D18070D0528CDAEB10DBA8CA45BDCBBF4AF19308F2440DDE4456B282DBB95F48DB56

Function 0049EF0E Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfc0c2450c919e5ca8e87a3f3fa153f15bbe28b91ce2660b0eab54348b933ba
Instruction ID: af9c87e70908a1ee06dfbc346dd9d7a470d4d3b04964572cafa80a59c2292356
Opcode Fuzzy Hash: ccfc0c2450c919e5ca8e87a3f3fa153f15bbe28b91ce2660b0eab54348b933ba
Instruction Fuzzy Hash: ACB13274A04249EFEF11CF99C841BAE7FB1AF46304F14417AE5009B392C7B99D4ACB99

Function 0049865A Relevance: 9.3, APIs: 6, Instructions: 265COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004987E2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004987FE
__allrem.LIBCMT ref: 00498815
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498833
__allrem.LIBCMT ref: 0049884A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498868

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction ID: bac2f8d64b4771d1480d5067db4f3a3676e567bfb19d99c183f063f20f68270c
Opcode Fuzzy Hash: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction Fuzzy Hash: A68107B26007069BDB20EA6DCC41B5B7BE9AF52364F24453FF111DB791EB78D9008B98

Function 00481F10 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D726
Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D750

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00482387

Part of subcall function 0043E440: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0043E4CF

Strings

exists, xrefs: 004823DA
os_crypt, xrefs: 0048208F, 00482117, 004821AB
Local State, xrefs: 00481F6F, 00481F88
0hC, xrefs: 0048237C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Ios_base_dtor___std_fs_convert_narrow_to_wide@20std::ios_base::_
String ID: 0hC$Local State$exists$os_crypt
API String ID: 1525435645-426690132
Opcode ID: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction ID: 349907f898d0770bf1c6c6bee16b757a414fbaa0545e2b95a55e182eb82389be
Opcode Fuzzy Hash: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction Fuzzy Hash: 1ED19F70D0528CDAEB10DBA8CA45BDCBBF0AF19308F2480DDD4456B282D7B95F58DB56

Function 004865D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 230registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FD70: ___std_fs_get_current_path@8.LIBCPMT ref: 0047FE92

GetVolumeInformationW.KERNEL32(?,?,00000100,?,?,?,?,00000100,00000000,?,8047B0C5,?,?), ref: 00486757
RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905
ProductName, xrefs: 00486900

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InformationValueVolume___std_fs_get_current_path@8
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2814272438-1787575317
Opcode ID: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction ID: 5513a57b40c567382305f19abecc614c7fb65df7785b10e0462d816fc7d7abf5
Opcode Fuzzy Hash: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction Fuzzy Hash: DFA18BB1C012199BDB21DF55CD59BE9B7B4FF14304F1042EAE419A7281EB786B88CF94

Function 004A0DE2 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Standard Time, xrefs: 004A117F
Eastern Summer Time, xrefs: 004A1193

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: f479341c917e5b85ea8d4f872af5b2a7ed3f0ffe6aef50257419f0e8574b0954
Instruction ID: d63cae11faca7fbaaedfd5ec0c01f193a5a5e64d1a9f5e85edff99bc4745f09f
Opcode Fuzzy Hash: f479341c917e5b85ea8d4f872af5b2a7ed3f0ffe6aef50257419f0e8574b0954
Instruction Fuzzy Hash: D5C15872D00211ABDB20AB65CC02ABF7BB9EF76754F10405BF901EB291E7788E41D798

Function 0047EE90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 0047F1C0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8047B0C5), ref: 0047F211
Part of subcall function 0047F1C0: RegCloseKey.ADVAPI32(00000000), ref: 0047F221

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047F194

Strings

Profiles, xrefs: 0047EF20
0hC, xrefs: 0047F18D

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseIos_base_dtorOpenstd::ios_base::_
String ID: 0hC$Profiles
API String ID: 1131316584-941608981
Opcode ID: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction ID: cfb713b882ce29762410958d43b6c09695d359a02ab63b143eff75d03a191730
Opcode Fuzzy Hash: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction Fuzzy Hash: 59911674C00298CBDB20DF68C845BDDBBB0AB19314F1086EAD45977282DB746E88CF95

Function 00438180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004381BC

Part of subcall function 004B849F: FindNextFileW.KERNELBASE(?,00000001,?,00437D97,?,00000001,?,004BDC4D,00000001,?,?,?,8047B0C5,00000001), ref: 004B84A8

Strings

directory_iterator::operator++, xrefs: 00438294
., xrefs: 004381CE

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID: .$directory_iterator::operator++
API String ID: 3878998205-1036657373
Opcode ID: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction ID: 735a56af49808cf236c7d8626bd4983a1e4e1118483563b87a501f55d85a1d57
Opcode Fuzzy Hash: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction Fuzzy Hash: C7318D70A047188BCF30DF59C8887ABF7B4EB49310F14429EE45997391DB395E85CA84

Function 004868B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905
ProductName, xrefs: 00486900

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction ID: c2d08890748770af0873008191db5a05c2fa34d27609d4939fc155a72502f57e
Opcode Fuzzy Hash: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction Fuzzy Hash: 95218EB09003599BDB20DF54C805BEABBF8FF04704F10465EE845A7681DBB86A44CB95

Function 00487290 Relevance: 4.7, APIs: 3, Instructions: 178registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,8047B0C5,?,0051C288), ref: 0048735B
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397
RegCloseKey.ADVAPI32(00000000), ref: 0048751D

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction ID: e90b3dd054a924dd9803ab5f17a38fc1c4cefb0d6438d00707aa441ccba3a8d8
Opcode Fuzzy Hash: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction Fuzzy Hash: E3717FF0D012189FDB20DF24CD94B9DB7B4EB54304F1082DAEA19A7281D774AE88CF99

Function 004870B0 Relevance: 4.6, APIs: 3, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8047B0C5,0051C570,0051C2A0), ref: 00487182
RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6
RegCloseKey.ADVAPI32(00000000), ref: 00487260

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction ID: b9c4edd99e38da91ddb4c738108b0054469e00b62f6e0a688ac56e9026d709b2
Opcode Fuzzy Hash: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction Fuzzy Hash: 905130B0D042189BDB20DF15CD54B9AB7F8FF45708F5042DEE609A7281DB74AA88CF99

Function 00485E30 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction ID: dee3d2b381a88aa75edb4726eebd2668ef991be1adfc48943d59dd3409b8a73b
Opcode Fuzzy Hash: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction Fuzzy Hash: 60219D70A40305ABE730DF65DD09B5BBBF8EB44B14F104A1EF545AB6C0D7B9AA048BE4

Function 00486F20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 00486F86

Strings

Unknown, xrefs: 0048705A

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction ID: 4cfd0b05124d6ad0cc2ed0fe670d1554fe3cca3eb32f1e14fa8b394e0e179909
Opcode Fuzzy Hash: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction Fuzzy Hash: 74418B71D00258CBDB20DF69C8407DEFBF4EF49704F1082AAD899A7281D774AA88CF91

Function 004ABC08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Strings

MC, xrefs: 00434FDC

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction ID: 040724f085c67d798f1d490f9b73413860191a50a7d7deb79defe6124e27c29a
Opcode Fuzzy Hash: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction Fuzzy Hash: 3611EB71800308ABCB10DF58DC01B9AB7ACEB15724F10466FF81597780EB79A940CBD8

Function 00447920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0044799C

Strings

0hC, xrefs: 00447996

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0hC
API String ID: 323602529-2581318919
Opcode ID: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction ID: 8ca8b340eaa0dfe9bad33bee777e0704730a4b63aab2394a13b70ad755bbc225
Opcode Fuzzy Hash: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction Fuzzy Hash: CD11ADB0840609DFDB10DF59C840A9DFBF8FB05328F208A6EE85197390EB74AA05CB80

Function 00460310 Relevance: 3.3, APIs: 2, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004604B4

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction ID: 66707b960993136107624c9d81ef05c918eca4bbb2b21c6d520a63eb0cd0cd41
Opcode Fuzzy Hash: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction Fuzzy Hash: 04A191B1E002159FDB14DF68C981AAFBBB4EB49314F24422FE815E7385E738AD05CB95

Function 00437CB0 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00437D64
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00437D92

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction ID: c774fac7b26238caf8a18ea1cc9dfb162d547f418ec2e445b27f5ef4f4107e88
Opcode Fuzzy Hash: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction Fuzzy Hash: E841A0B1D04218DBCB34DF64C480AEEB7B4EF19324F00516BE851AB381EB789D44CB94

Function 00480F90 Relevance: 3.1, APIs: 2, Instructions: 108COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,8047B0C5,?,?), ref: 0048101E
CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction ID: 3e538bd659216d3e4857fbb8bc962106784e19cd0647cea7878622876b38b54a
Opcode Fuzzy Hash: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction Fuzzy Hash: 4241ACB0D01748DBDB10CFA5C9457AEFBF4EF58314F20421EE811A7280EBB86A44CB94

Function 0047F1C0 Relevance: 3.1, APIs: 2, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8047B0C5), ref: 0047F211
RegCloseKey.ADVAPI32(00000000), ref: 0047F221

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction ID: 54b3090d3cf4edc9b1beeea5084ab922e7ff7cf66e968ba670c482e571a875e7
Opcode Fuzzy Hash: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction Fuzzy Hash: 1021F675E002199BDB10EF95DC81BEFB7B4EB48714F14827EE819B7382EB399D048694

Function 0049AD6F Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0049ADBB
GetFileType.KERNEL32(00000000), ref: 0049ADCD

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction ID: 9b806bec79c801feb13e2bd810877b0a9fec2b0519df56a68c4b4061daa9a1e0
Opcode Fuzzy Hash: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction Fuzzy Hash: B611B7311047514ACF304A3E8C886677E96AB56331B39073FD4B687AF1C338D9A691CB

Function 0049F3BE Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000), ref: 0049F3FA
GetLastError.KERNEL32(00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000,?,0049BE05,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0049F407

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction ID: e391caa542caa0dd86735aa216be2178a54a5bfb1c46ce41420e93566301b438
Opcode Fuzzy Hash: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction Fuzzy Hash: 57012232614215AFCF058F69DC49D9E3F2AEF95324F24422AF811DB290E775EE41CB94

Function 0047E47D Relevance: 3.1, APIs: 2, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004473D0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8047B0C5), ref: 0044741C
Part of subcall function 004473D0: Process32FirstW.KERNEL32(00000000,?), ref: 00447468

Part of subcall function 00445950: CredEnumerateA.ADVAPI32(00000000,00000000,?,?,8047B0C5,00000000,?), ref: 004459B2

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction ID: 21d12501465ffecb104f3396b5f4d487cf58cbb0265569f00e2db2d4d6eee1e0
Opcode Fuzzy Hash: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction Fuzzy Hash: D9114C71806548EAEB00FBF7950639DB7A0AF0431CF10C59FE90623182DF7D1A0596AF

Function 0047E4C8 Relevance: 3.0, APIs: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction ID: d8074609c4b6b56a118d8c4864159468ec2ce210cc92c7876c64f9fcb1cee0d4
Opcode Fuzzy Hash: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction Fuzzy Hash: CD017171806518DAE710FBE2D50679DB7A0AF0931CF50869FE90623282DF791A0187AE

Function 0049C0BD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction ID: 589170845ab709ad3b3b60fb6adb52998bb4654d1de7eee66c817f55301082a8
Opcode Fuzzy Hash: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction Fuzzy Hash: 9BE08631500614A7CF222BA1EC0D7893F58DB40355F104036F60897160DF398940CB88

Function 0048FAB0 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048FCEA

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction ID: 258a51d4530bdfdbcfb978a880514f411ab203130510da66870d02f2c2448e76
Opcode Fuzzy Hash: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction Fuzzy Hash: DB71F671A002088FCB24EF28C490B6E77A5BF15314F244A7FE865CB791D739EA49CB95

Function 0044AF90 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction ID: 5047db877c7d9ae38b531aa0dda64427d2377832e7d6361d0852b000475400c5
Opcode Fuzzy Hash: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction Fuzzy Hash: F45180B5A0060ADFDB18CF28D480999FBB4FF4A320B5082AAE819C7B51D735ED55CBD4

Function 0049E314 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction ID: 7d9f16a24b0820fe6bfe4efb506255557b861a5981f24711c09fdeca13a2084c
Opcode Fuzzy Hash: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction Fuzzy Hash: 8751C470A00104EFDF14CF5ACC85AAE7FA5AF99324F28816AE8095B352D379DE41CB95

Function 00458550 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004586AF

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction ID: 39eac46aceff4f274d7df031c3ad8bb7d561d247c585fc64f7f09dd83a036c2e
Opcode Fuzzy Hash: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction Fuzzy Hash: E941A4B1E001159FDB04DFA8C841AAEBBB5EF48315F10422EE815F7386DB34AE09CB95

Function 004520F0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0045223D

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction ID: 543f2dd5f5f38f41d79c3b3e326d175c20dbca08f8aec97f7e4552ad9d8ce088
Opcode Fuzzy Hash: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction Fuzzy Hash: E1411272E001149BCB05EF68CD806AFB7A5EF56311F1402AFFC15EB302D6789E158B99

Function 00451F90 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004520DE

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction ID: 53fc907bca80d66a09b4c03435f3e8acb878ccb904669eb33cf36a05cbe64725
Opcode Fuzzy Hash: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction Fuzzy Hash: E7414272D001049BCB15AF68CD806AEBBA5AF4A305F1002ABED15EB342D7749E158BD9

Function 0048F890 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048F9FA

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction ID: 91311e753e2fbbf9cdae31aef67f458025fa5287f257254b7d49e4ed808e7769
Opcode Fuzzy Hash: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction Fuzzy Hash: 4F41B3B2E005049FDB14EF68C985A6EBBA9EB49320F24473EE815D7385DB349D04CB95

Function 00451E50 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00451F7F

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction ID: dbfd0375bb16cbcb281b8a1501cab73851c3df864c0bb83deedb38d5f1c134ec
Opcode Fuzzy Hash: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction Fuzzy Hash: 72312572A001049BCB14DF688881B9FBBA5AB59315B24426FEC15CB303DB34DE5987D9

Function 004516D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004517DF

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction ID: 65e916faade23ef3c336758c75d3ad3b55c144e32e026a5ec30b5c92d10e86c8
Opcode Fuzzy Hash: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction Fuzzy Hash: BB316772E001105BCB18EE6D9880A6FB7E9EB88312B24427FEC15D7352DA38DD0987D9

Function 0044D7D0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044D8F9

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction ID: 6687ec20b77dec97c90771c2cbe71989815263d1b8fcacfb2e06f2ee49a1853a
Opcode Fuzzy Hash: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction Fuzzy Hash: C3310A71E002045BE714AE6DD880A7EB7A4EF55324F24477FF865C7382D67899408759

Function 0044BAD0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

Part of subcall function 00434F80: ___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction ID: f8cf7cd3dcf405c094d14d4edd2427269fc308b55f739c6c677f8adad7f52d2f
Opcode Fuzzy Hash: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction Fuzzy Hash: 902126B1E006059BE7149F25D48166AB7A4EF15324F20036FE8258BB91E739FE90C7D6

Function 004BB697 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB6D1

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction ID: 7232828ef0ab4ea1277fc9c55e8108ad49929c9e06a984f5114aae078e858d40
Opcode Fuzzy Hash: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction Fuzzy Hash: B9113671A0010AAFCB05DF58E9819CF7BF4EF88304F00405AF808AB311D770D9118BA4

Function 00482930 Relevance: 1.5, APIs: 1, Instructions: 43networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000000), ref: 00482968

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction ID: 15365ef676efcd120e403479619ae1d38f6ec3fc5171ce29fb9a7f72e5811cf6
Opcode Fuzzy Hash: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction Fuzzy Hash: 93F0B472302115AB83109A5DAD4096BF7DEDBCA7B0B2003A7FC2CC33E0E9618C0153D4

Function 0049C6A4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0043FE48,00000001,?,00499445,00000001,00000364,00000001,00000006,000000FF,?,004AD408,0043FE4A,0043FE44,?), ref: 0049C6E5

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction ID: bf89d2d5fe5833ab0f4bff440cdb33f04d1e0b68cec02520bce29c64fa949510
Opcode Fuzzy Hash: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction Fuzzy Hash: 82F0BE322852256BAF215B229D85B5B3F589B417E0F195037FC08EA290CE78EC008AEC

Function 004406AD Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction ID: a1ffe5c8ce5f1f1a4397a2b9345f76ae3c812c30bf0ac5870f9d4861cf5b4c4e
Opcode Fuzzy Hash: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction Fuzzy Hash: 95015631A0625DDFEB20DFA4D988BAEBBB4EF14314F2040DAD909A7282C7346E04DF55

Function 0049D15A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction ID: de2ad87b2feeaf860c8dfd974d012cc9eb33a1afe18dd843800594eb24cb3dbb
Opcode Fuzzy Hash: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction Fuzzy Hash: 08E0E533A0132166EF212BA6AD02B5B3E48CB513A0F190137EC18962C4CB28DC0082ED

Function 004BC233 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction ID: c65ff2ef24fd0563ec255788cd93a1d7270b85fbbbb51eec7110af243f851585
Opcode Fuzzy Hash: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction Fuzzy Hash: 05D06C3200010DBBDF028F84EC06FDA3BAAFB48714F018010BA1866020C732E821ABA4

Function 004B9AE2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00486DD6,?,?,?,8047B0C5,?,?), ref: 004B9AEC

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction ID: f88b8e15ca571a688dc5d535dfb7cb0f1e1a76fd2fb5174ce8f8aecae7ce3306
Opcode Fuzzy Hash: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction Fuzzy Hash: 0EC09B7490610E97CF00E7E5D94D88E77FCA608204F4004A1D551E3140E770FD45C795

Non-executed Functions

Function 0048A0A0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 325nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtDuplicateObject,8047B0C5,?,?), ref: 0048A0F7
GetProcAddress.KERNEL32(00000000), ref: 0048A0FE
OpenProcess.KERNEL32(00000040,00000000,00000000), ref: 0048A12A
NtQuerySystemInformation.NTDLL ref: 0048A153
NtQuerySystemInformation.NTDLL ref: 0048A178
GetCurrentProcess.KERNEL32 ref: 0048A1FD
NtQueryObject.NTDLL ref: 0048A22B
GetFinalPathNameByHandleA.KERNEL32(00000000,00000000,00000104,00000000,00000104,?,00000104,00000000), ref: 0048A315
CloseHandle.KERNEL32(00000000), ref: 0048A3E6
CloseHandle.KERNEL32(00000000), ref: 0048A441

Strings

File, xrefs: 0048A25B
NtDuplicateObject, xrefs: 0048A0E6
ntdll.dll, xrefs: 0048A0EB

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction ID: 0800680efb81c18e2f896ca5fb1c4f1751909ec1a20682d0b449f1ef79601e33
Opcode Fuzzy Hash: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction Fuzzy Hash: C3C1DE71D00218AFEF10EFA4DC45BAEBBB5FF44704F14452AE801A7281E7B9AD45CB96

Function 0048A710 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 215stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL(8047B0C5,00000000,00000000), ref: 0048A766
NtAllocateVirtualMemory.NTDLL ref: 0048A78F
lstrcpyW.KERNEL32(?), ref: 0048A7C6
lstrcatW.KERNEL32(?), ref: 0048A8CD
NtAllocateVirtualMemory.NTDLL ref: 0048A904
lstrcpyW.KERNEL32(?), ref: 0048AA0F
RtlInitUnicodeString.NTDLL(-00000037), ref: 0048AA28
RtlInitUnicodeString.NTDLL(-0000003F), ref: 0048AA37
LdrEnumerateLoadedModules.NTDLL(00000000,Function_0008A6B0,00000000), ref: 0048AA44
RtlReleasePebLock.NTDLL ref: 0048AA4A

Part of subcall function 00480F90: SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,8047B0C5,?,?), ref: 0048101E
Part of subcall function 00480F90: CoTaskMemFree.OLE32(?), ref: 004810DC

Strings

0Q8w, xrefs: 0048AA1E

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateInitLockMemoryStringUnicodeVirtuallstrcpy$AcquireEnumerateFolderFreeKnownLoadedModulesPathReleaseTasklstrcat
String ID: 0Q8w
API String ID: 573923072-1710177118
Opcode ID: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction ID: 1d72f842e61e5ce7feef92d17fc1071c4f69874d6174494518bfda03acdacd70
Opcode Fuzzy Hash: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction Fuzzy Hash: D6B190B4D05268EFDB14CFA9D885A9DBBB5FF08314F10822AE825A7361DB346946CF44

Function 00477EE0 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,8047B0C5,?,?), ref: 00477F5C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction ID: d5989f67fd172e1006781f95ff6e7d6cbd1369fc69074948a5cb2319df95c689
Opcode Fuzzy Hash: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction Fuzzy Hash: 12D1F170D04288DBDB11CFA8D848BEDBBB0FF15314F14824AE508BB291DB796AC9DB55

Function 0047D2F0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044DCC0: std::ios_base::_Addstd.LIBCPMT ref: 0044DDEF

Part of subcall function 00436640: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047D95A

Strings

.vbs, xrefs: 0047D3A5
.ps1, xrefs: 0047D365
runas, xrefs: 0047D7EA, 0047D82A, 0047D82B
.exe, xrefs: 0047D349, 0047D423
.G, xrefs: 0047D646, 0047D6BC, 0047D8DD
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0047D443
open, xrefs: 0047D7E5
.cmd, xrefs: 0047D385
0hC, xrefs: 0047D950

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$Ios_base_dtor$AddstdConcurrency::cancel_current_task
String ID: .cmd$.exe$.ps1$.vbs$.G$0hC$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$open$runas
API String ID: 2154145882-3307477358
Opcode ID: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction ID: f5ba6b163c3a98fee3f853caf05b9595179ad2eb3f8f0c36a39513699dfd7300
Opcode Fuzzy Hash: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction Fuzzy Hash: 6A122770D00268DFDB20DF64CD85BDEBBB4AF19304F1481EAE849A7282DB755A84CF95

Function 0047AE80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000,00000001,?,0047AF9D,?,?,8047B0C5), ref: 0047AE91
BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0047AEAB
BCryptGenerateSymmetricKey.BCRYPT(?,?,00000000,00000000,?,?,00000000), ref: 0047AECF

Strings

ChainingModeGCM, xrefs: 0047AE9F
AES, xrefs: 0047AE88
ChainingMode, xrefs: 0047AEA4

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 1692524283-1213888626
Opcode ID: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction ID: 8d127e15825cd86a398cba4dadb085fb92217d3de15f733cf2195ed64ba2db48
Opcode Fuzzy Hash: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction Fuzzy Hash: 1CF03031381710BBE7309E65AC4AFDB7BA8FB44F10F10492AFA41DA1D0D7A0F8559B5A

Function 0046B620 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B7DA
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B81E
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B924
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B970

Strings

., xrefs: 0046B942

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction ID: 99e23c5b304899c8ab8714ce46d423df57297e0934c6bc539a0dfe6d7ec6f1b4
Opcode Fuzzy Hash: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction Fuzzy Hash: 77C1BF75A016269FCB20DF18C8847AAB3B5FF44314F14829AD915D7390EB39AD85CFC6

Function 004A6109 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,004A641B,00000002,00000000,?,?,?,004A641B,?,00000000), ref: 004A61A2
GetLocaleInfoW.KERNEL32(?,20001004,004A641B,00000002,00000000,?,?,?,004A641B,?,00000000), ref: 004A61CB
GetACP.KERNEL32(?,?,004A641B,?,00000000), ref: 004A61E0

Strings

OCP, xrefs: 004A615D
ACP, xrefs: 004A6127

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction ID: 02a1f9ff6d074017cf30d732e6d651dacf3b6180dce544ba7b26bbdffeda2481
Opcode Fuzzy Hash: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction Fuzzy Hash: 14217731B00101A6DB348F54C901A9BBBA7EB76B54B5F8466E909D7302EB36DE41C358

Function 0043D4A0 Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 725COMMON

Download Yara Rule

Strings

Wallets, xrefs: 0043E182
content, xrefs: 0043E150
filename, xrefs: 0043E0E3

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Wallets$content$filename
API String ID: 0-3216974685
Opcode ID: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction ID: d087ffba84baf14db51f89a037efaf3a0efd4671473d6540ebf1f333b1c0f3d3
Opcode Fuzzy Hash: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction Fuzzy Hash: 5392EEB0C052AC9BDB66DF68D9857DDBBB4AF18308F1441DAE80CA7252EB741B84CF45

Function 004A62E5 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004A63ED
IsValidCodePage.KERNEL32(00000000), ref: 004A642B
IsValidLocale.KERNEL32(?,00000001), ref: 004A643E
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 004A6486
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004A64A1

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction ID: c25bf07a23f3a9ec008bfe0b344d9b34e57977eb2ee5f51d57588e3c0d66081e
Opcode Fuzzy Hash: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction Fuzzy Hash: B351C031A00205ABDF10DFA5CC41AAF77B8BF2A700F09446BF905EB2C0D778D9058B68

Function 004A5970 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetACP.KERNEL32(?,?,?,?,?,?,00499D39,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004A5A2F
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00499D39,?,?,?,00000055,?,-00000050,?,?), ref: 004A5A66
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 004A5BC9

Strings

utf8, xrefs: 004A5B38

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 04b3e337810216b61eac7fea49992564720a065615442711857ddc30d61a34d4
Instruction ID: 57bf36a595626d2e68748195e450517760c1dbe6c14d68ec56d01c4c71c4df41
Opcode Fuzzy Hash: 04b3e337810216b61eac7fea49992564720a065615442711857ddc30d61a34d4
Instruction Fuzzy Hash: F771FA71600B01ABDB24AB75CD82BAB73ACEF66714F14052FF505D7281E778E940866D

Function 00497B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 00497C25
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00497C2F
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000001), ref: 00497C3C

Strings

/LC, xrefs: 00497B2F

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: /LC
API String ID: 3906539128-2135541996
Opcode ID: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction ID: bfbf58602b6ed5b9f74246d621f9e13e9ead8f3e4535d75d7aa199c35e3273ea
Opcode Fuzzy Hash: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction Fuzzy Hash: 3231D274901229ABCB21DF65DC8878DBBB8BF18710F5041EAE40CA7250E7349F858F48

Function 00493800 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction ID: d1eb0eda3f30262f0aa428ac7e9151949e9d9ef7bd25f7153de96db8ebdefec9
Opcode Fuzzy Hash: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction Fuzzy Hash: DB023C71E002199BDF14CFA9C9806AEFBF1FF89315F24826AE519E7341D735AE018B94

Function 009ABF4B Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009AC03B

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 393662c4b31f6e868e927a2ea9c1ac4ce441615a2093b0085b786ae6c720d8d5
Instruction ID: 361cf21a114be61aae24ad28b791fd7dfc5b1c57f930a5884e0693c4a4243192
Opcode Fuzzy Hash: 393662c4b31f6e868e927a2ea9c1ac4ce441615a2093b0085b786ae6c720d8d5
Instruction Fuzzy Hash: E571D8B19091689FDF20AF28CC8DABEB7B9EF46304F1441D9E40DA7252DB354E859F90

Function 00498574 Relevance: 6.1, APIs: 4, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0049859D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 004985B1
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00498602
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00498617

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction ID: 57c86550534b148c15952eeeaf39776b02a492ab104de77fe61266457f658886
Opcode Fuzzy Hash: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction Fuzzy Hash: 91217C72E00119ABCF20DFA9DD85AEFBBB8EF45754F05017AE905E7140EA349D04C794

Function 009A5027 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 009A5033
IsDebuggerPresent.KERNEL32 ref: 009A50FF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009A5118
UnhandledExceptionFilter.KERNEL32(?), ref: 009A5122

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d6b97f7b4cd2f8b46333d7f35612c9fd8b04a717fbe73125f88c229f4a7ae2d2
Instruction ID: 322b30c106090feb4ba349b24dafb1523542fb2f956019d2a8b9c0bc2d5c8015
Opcode Fuzzy Hash: d6b97f7b4cd2f8b46333d7f35612c9fd8b04a717fbe73125f88c229f4a7ae2d2
Instruction Fuzzy Hash: 38312975D05218DBDF20EFA4D9497CDBBB8BF08300F1041AAE40CAB250EB709A84CF85

Function 004AC6BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004AC6CB
IsDebuggerPresent.KERNEL32 ref: 004AC797
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004AC7B0
UnhandledExceptionFilter.KERNEL32(?), ref: 004AC7BA

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction ID: 70dc3419eb2b6db1900c7bd06373213fcab329736da06f39ceabfcfe7a7444e5
Opcode Fuzzy Hash: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction Fuzzy Hash: E1314A75C012189BDF21DF61DC897CEBBB8BF18700F1041AAE40DAB250E7759A84CF48

Function 004B824D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,00435B2A,?,?), ref: 004B8261
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000,?,?,00435B2A,?,?), ref: 004B8288

Strings

!x-sys-default-locale, xrefs: 004B825C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction ID: 4f66f40a8a4f046c7b0032d4e1a4b833dd41128cf422eed9181fa496fdef01a0
Opcode Fuzzy Hash: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction Fuzzy Hash: 1AF030B5511108FFEF089BD5DC0EEEB77ACEB09394F10416AB501D6150E6B0AE00D778

Function 004A5D8D Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5DE1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5E2B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5EF1

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 4e5522a14392cd0b3bbc4aa0c2beba558a9818cfc0a7be593c71ffc28e535be1
Instruction ID: 962ae09c726557bba2a742099c161f9beda31160a96e42ffbc7faebc0f235ca1
Opcode Fuzzy Hash: 4e5522a14392cd0b3bbc4aa0c2beba558a9818cfc0a7be593c71ffc28e535be1
Instruction Fuzzy Hash: D86190715416079FDB28DF28CE82BABB7A8EF25305F1440BBE905C6285E738DE41CB58

Function 0047AAE0 Relevance: 3.2, APIs: 2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction ID: 33f7787d24f7b6ada88b2ec4e837cc4b10ca5ac34968b166931d9a07c874724e
Opcode Fuzzy Hash: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction Fuzzy Hash: 21B1A170D04249DFDB10CFA4C884BEEBBB5FF89304F20825AD505AB381D778A984CB96

Function 00440B60 Relevance: 3.1, APIs: 2, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,00000001,?), ref: 00440BFA
LocalFree.KERNEL32(?,00000000), ref: 00440C8E

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction ID: f58a043fe36a424058588bce6ee5e9d112fd586f94ce921f9f6943f9dc7e0036
Opcode Fuzzy Hash: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction Fuzzy Hash: 68517E70D00249DBEB00CFA9C8457DEFBB4FF14308F14821AE8547B281D7B96A48CBA5

Function 0047A950 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A9B8
LocalFree.KERNEL32(?,00000000), ref: 0047AA4F

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction ID: 6fc12887242d51354b1d4be44c56afc8010d77d5c64fcd5971483ececb25fb38
Opcode Fuzzy Hash: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction Fuzzy Hash: 7351BF70D00249EBEB00CFA5D945BDEFBB4FF54308F10821AE81077281D7B96A58CBA5

Function 004A5FE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A6034

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 56b126747d64a408f8cb97836ba55e90b6bea24853320db90e581c5e767a0a51
Instruction ID: 4410453ce78f061189afbc458556258a4ff070a6a13362461f6e96f76a4d0aba
Opcode Fuzzy Hash: 56b126747d64a408f8cb97836ba55e90b6bea24853320db90e581c5e767a0a51
Instruction Fuzzy Hash: A121B232655206ABDF28DF25DC41A7B77ACEF61314B1500BFFA01C6281EB38ED408A58

Function 004A5C67 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5D8D,00000001,00000000,?,-00000050,?,004A63C1,00000000,?,?,?,00000055,?), ref: 004A5CD9

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e42620a4cb20c2da49a4224be13f12341b998f391a46648d9ba836fd2d73139f
Instruction ID: 1406c895032231e24aa0afc96b0d01b76351fdf719fc880d52765eb770635e76
Opcode Fuzzy Hash: e42620a4cb20c2da49a4224be13f12341b998f391a46648d9ba836fd2d73139f
Instruction Fuzzy Hash: 1711E537600B015FDB18AF79C9916BABB92FF91368B18842EE94787B40E375A942C744

Function 004A620F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004A5FA9,00000000,00000000,?), ref: 004A623B

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: afed30a40adaf0fe2c2ae6d6b95a375c8a19700a8aa4b2d509547a2ce32d92aa
Instruction ID: 9487850153f17b5aff8b54b84101990ee62d9d6b8c11e223cf6e38bc87e8a6da
Opcode Fuzzy Hash: afed30a40adaf0fe2c2ae6d6b95a375c8a19700a8aa4b2d509547a2ce32d92aa
Instruction Fuzzy Hash: 3C01DB33A10112ABDF286A658D06BBB7768DB51754F1A446FEC06A3680DA38ED41C698

Function 004A5D02 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5FE0,00000001,00000005,?,-00000050,?,004A6389,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004A5D4C

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: eaaeaeafc5fac60a840ad3651ae3e1ab29e3739c136bdf2006a19ad432905435
Instruction ID: c98a1cf7b30e52ba405588815af828edc546cc3ef2e56581ce593e44f0a9addd
Opcode Fuzzy Hash: eaaeaeafc5fac60a840ad3651ae3e1ab29e3739c136bdf2006a19ad432905435
Instruction Fuzzy Hash: 2AF022362007041FCB246F799885A6A7BA5EB81368F14842EF9054B690C2759C02C658

Function 0049C70E Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049B2E1: EnterCriticalSection.KERNEL32(-0051B45F,?,004A6D40,00000000,005137C8,0000000C,004A6D08,0043FE48,?,0049C6D7,0043FE48,?,00499445,00000001,00000364,00000001), ref: 0049B2F0

EnumSystemLocalesW.KERNEL32(0049C701,00000001,00513580,0000000C,0049CB55,00000000), ref: 0049C746

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 69dda01542ccd3eab63414d956f3fcf1c5f44d3c23f22103bfe59f95768ac423
Instruction ID: a78643f9f3df08ccc8addbe33751412e33acbb4152fc9e9c363d2dc9b4240f3c
Opcode Fuzzy Hash: 69dda01542ccd3eab63414d956f3fcf1c5f44d3c23f22103bfe59f95768ac423
Instruction Fuzzy Hash: A0F04972A40205EFEB00DFA9E882B9C7BF0FB55725F10816BF415EB2A0D77959049F44

Function 0047AE10 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT(?,00000000,8047B0C5,?,?,?,004CB69D,000000FF), ref: 0047AE4A

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction ID: 7a92f9e53ad6301b38de286dc83f6de03fbb372fed7888f050c821ed69dc0e63
Opcode Fuzzy Hash: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction Fuzzy Hash: B1F06D71A44618ABD720CF58DC05B9AB7F8EB04B20F10476FE821A37C0D779A9008B94

Function 004A5C1C Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5B75,00000001,00000005,?,?,004A63E3,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004A5C53

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f5bcbf328ab98889824a8f4a2aca38cb232a0aaea5e92dc81316268b5f07e0b0
Instruction ID: 8029f739405c8b6d15305cd3561d0adeac93de3ed34cfe121213407b3ae16d1c
Opcode Fuzzy Hash: f5bcbf328ab98889824a8f4a2aca38cb232a0aaea5e92dc81316268b5f07e0b0
Instruction Fuzzy Hash: B1F05C3630030557CB049F35D84576A7F54EFD2724F06005EEA058B690C6769842C754

Function 0049CCB0 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0049A8AF,?,20001004,00000000,00000002,?,?,00499EA1), ref: 0049CCE4

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f7abdc218717ea54d8d13a8a84f23afce84eed1fa1e88fe8fac7f9052fbf838e
Instruction ID: eb41334156ced680ef33706ab3692b9e9ee117c5b5a07fe61c85a323d836a744
Opcode Fuzzy Hash: f7abdc218717ea54d8d13a8a84f23afce84eed1fa1e88fe8fac7f9052fbf838e
Instruction Fuzzy Hash: BDE04F35501228BBCF122F61DC04EAE7F16EF84761F004036FC0A66261CB368D21AAD9

Function 00477B00 Relevance: 31.7, APIs: 21, Instructions: 230processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8047B0C5,?,?), ref: 00477B54
Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Process32NextW.KERNEL32(00000000,0000022C), ref: 00477BE0
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00477BFD
OpenProcessToken.ADVAPI32(00000000,0000000E,?), ref: 00477C2A
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C4D
GetLastError.KERNEL32 ref: 00477C5B
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C9C
CloseHandle.KERNEL32(00000000), ref: 00477CA7
CloseHandle.KERNEL32(?), ref: 00477CAF
CloseHandle.KERNEL32(?), ref: 00477E29
Process32NextW.KERNEL32(?,0000022C), ref: 00477E39
CloseHandle.KERNEL32(?), ref: 00477E62
CloseHandle.KERNEL32(00000000), ref: 00477E65
CloseHandle.KERNEL32(00000000), ref: 00477E84

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$CreateErrorFirstLastSnapshotToolhelp32
String ID:
API String ID: 1236848392-0
Opcode ID: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction ID: 454ab3ae29a80d327a78c61064fadb2005c2365cc5293efb4604dbbba27fe465
Opcode Fuzzy Hash: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction Fuzzy Hash: F6A15B709052189FDF219F24DC89BAEBBB8EF44700F5441EAE90CA2250EB359E84DF59

Function 0044E020 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0044E070
std::_Lockit::_Lockit.LIBCPMT ref: 0044E092
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E0BA
std::_Facet_Register.LIBCPMT ref: 0044E1D0
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E1FA

Strings

`aC, xrefs: 0044E16A
p]C, xrefs: 0044E15D
cC, xrefs: 0044E17E

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: cC$`aC$p]C
API String ID: 459529453-2177106863
Opcode ID: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction ID: 1ff138599dd9b712ad814e44402e9ca08be03e0a2a2e3ebe43d51928b08ed38c
Opcode Fuzzy Hash: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction Fuzzy Hash: 99518BB0D00259DBEB10CF99C8457AEBBB4FB18314F24815ED811AB381DB79AA44CBA5

Function 004AAEF3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,004AA85F), ref: 004AAF0C

Strings

pow, xrefs: 004AAFAA, 004AB054, 004AB0A1
exp, xrefs: 004AAF8B, 004AAFF0
acos, xrefs: 004AB042
sqrt, xrefs: 004AB04B
log10, xrefs: 004AAF4E, 004AAF5D
asin, xrefs: 004AB039
log, xrefs: 004AAF69, 004AAF78

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction ID: 58aec3622616389bffb488f30e5ac45d5b57ecd31d6a71103e59991c775c814d
Opcode Fuzzy Hash: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction Fuzzy Hash: BE516C7090860ACFCF148F58D9481AFBFB0FB66300F558187E4A1A6355C7BD8966CB9A

Function 00452250 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0045228D
std::_Lockit::_Lockit.LIBCPMT ref: 004522AF
std::_Lockit::~_Lockit.LIBCPMT ref: 004522D7
__Getcoll.LIBCPMT ref: 0045239F
std::_Facet_Register.LIBCPMT ref: 004523EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00452415

Strings

`aC, xrefs: 00452385
p]C, xrefs: 00452378

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID: `aC$p]C
API String ID: 1184649410-1363152631
Opcode ID: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction ID: 568a7e1164ae6cef3cf0599e82aad122ccc02b6897634e5ab4797aad8f19cd87
Opcode Fuzzy Hash: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction Fuzzy Hash: 49518B70800208DFDB01DF95C9457DEBBB4FF55318F24815ED805AB282DBB9AE49CBA9

Function 00450EF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 130COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00450F2D
std::_Lockit::_Lockit.LIBCPMT ref: 00450F4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00450F77
std::_Facet_Register.LIBCPMT ref: 00451071
std::_Lockit::~_Lockit.LIBCPMT ref: 0045109B

Strings

`aC, xrefs: 0045101E
p]C, xrefs: 00451011
PbC, xrefs: 00451032

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: PbC$`aC$p]C
API String ID: 459529453-2418293346
Opcode ID: c487c9fa1e9afb87366c1b148d14351f87e6f3e89ddbdc8a1e0c3778002b8b72
Instruction ID: e392c769357d74c7cb0e8da2cb70d10442ea48cde3856dc7faeb71697ce32a0a
Opcode Fuzzy Hash: c487c9fa1e9afb87366c1b148d14351f87e6f3e89ddbdc8a1e0c3778002b8b72
Instruction Fuzzy Hash: 9A519E71900249DFDF20CF99C5417AEBBB0FB14318F24845ED805AB382D7B9AE49CB95

Function 004AFE4C Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004AFF6B
___TypeMatch.LIBVCRUNTIME ref: 004B0079
CallUnexpected.LIBVCRUNTIME ref: 004B01E6

Strings

csm, xrefs: 004AFFA2
csm, xrefs: 004AFE89
<fM, xrefs: 004AFF62
csm, xrefs: 004AFEF6

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: <fM$csm$csm$csm
API String ID: 1206542248-3599101812
Opcode ID: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction ID: 5ce913a956d0af8773c3ee17d9b542f15401108c10c26080aa375b564815456b
Opcode Fuzzy Hash: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction Fuzzy Hash: DBB19B71800209EFCF18DFA5C8809EFB7B5FF25315B10816BE8056B212D779DA15CBA9

Function 0047CF70 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0047D113
Concurrency::cancel_current_task.LIBCPMT ref: 0047D118
Concurrency::cancel_current_task.LIBCPMT ref: 0047D11D

Strings

`aC, xrefs: 0047D015
true, xrefs: 0047D0B8
false, xrefs: 0047D092
p]C, xrefs: 0047D008

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$false$p]C$true
API String ID: 118556049-4224333681
Opcode ID: 226f2742ad4bb82513da97dc0ea37b247d6440e1a842af39628b989b3fbf377a
Instruction ID: 10a02a47a4876ff195f080d04569540bf2a908c30d6efafbe52ebceab6b25fd0
Opcode Fuzzy Hash: 226f2742ad4bb82513da97dc0ea37b247d6440e1a842af39628b989b3fbf377a
Instruction Fuzzy Hash: 73510871910745DBDB20DF65C801B9EBBF4EF04718F20862FE815A7781E7BAAA04CB95

Function 0047C6C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047C6FD
std::_Lockit::_Lockit.LIBCPMT ref: 0047C71F
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C747
std::_Facet_Register.LIBCPMT ref: 0047C834
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C85E

Strings

`aC, xrefs: 0047C7EE
p]C, xrefs: 0047C7E1

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: `aC$p]C
API String ID: 459529453-1363152631
Opcode ID: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction ID: 399bbb442a0c6c40ac274560e971594f6ebfe9651e6100c107b7a0aaef0602e2
Opcode Fuzzy Hash: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction Fuzzy Hash: 2C517A71900249DFDB15CF99C580BEEBBB4EB15318F24805ED409AB381DB79AE09CF95

Function 0047D190 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(File Downloader,00000001,00000000,00000000,00000000), ref: 0047D22D
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 0047D256
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D27C
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D2B2
InternetCloseHandle.WININET(00000000), ref: 0047D2B9
InternetCloseHandle.WININET(?), ref: 0047D2C5

Strings

File Downloader, xrefs: 0047D214

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction ID: 638e9360adee8abd238f5bb9f06079602c51a7af3a4d5d450420b7b82b1eb562
Opcode Fuzzy Hash: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction Fuzzy Hash: 5B318370A01655ABD730CF55CC45BEAB7B8EF44700F1041AAF549E7290DBB8AE84DFA8

Function 009AF878 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,009AF863,?,?,?,?,?,?,?,?,?,?), ref: 009AF91E
__alloca_probe_16.LIBCMT ref: 009AF9D9
__alloca_probe_16.LIBCMT ref: 009AFA68
__freea.LIBCMT ref: 009AFAB3
__freea.LIBCMT ref: 009AFAB9
__freea.LIBCMT ref: 009AFAEF
__freea.LIBCMT ref: 009AFAF5
__freea.LIBCMT ref: 009AFB05

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 66c2045ab667004fc2a2b3dbb927fae724643db204ecb98fddca6388b50e31b3
Instruction ID: 30098e30e494c8bad2174f3113632eeb4d6fe41f97203ac291abca1d767197d7
Opcode Fuzzy Hash: 66c2045ab667004fc2a2b3dbb927fae724643db204ecb98fddca6388b50e31b3
Instruction Fuzzy Hash: B871A372A002066BDF209BD4CC71BEF77BD9F8B314F294465E959A7282E7359C0087E0

Function 004B9D99 Relevance: 12.2, APIs: 8, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 004B9E24
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9EB0
__alloca_probe_16.LIBCMT ref: 004B9EDA
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F1B
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9F37
__alloca_probe_16.LIBCMT ref: 004B9F5D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F9A
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004B9FB7

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction ID: 05f54580d30f9e3720c8b3961695daa3f0f937b9c5610d8c2bd80885558d9d7b
Opcode Fuzzy Hash: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction Fuzzy Hash: 7871AE3290021AABDF219F65CC85BFF7BB9AF05724F18405BEA04E6291D7398C40C7B9

Function 004B9AF7 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004B9B40
__alloca_probe_16.LIBCMT ref: 004B9B6C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004B9BAB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9BC8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004B9C07
__alloca_probe_16.LIBCMT ref: 004B9C24
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9C66
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004B9C89

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction ID: 0cb7a2a667138b596a59e049b57baa22d652deda395932da07ab0cb8239329c9
Opcode Fuzzy Hash: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction Fuzzy Hash: A151BF7250020AABEF219F65CC44FEB7FB9EF50740F24412AFA05A6260D7399C11CB68

Function 00489F30 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00489F4B
GetProcessId.KERNEL32(00000000), ref: 00489F52
RmStartSession.RSTRTMGR(?,00000041,?), ref: 00489F76
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000), ref: 00489F91
RmGetList.RSTRTMGR(?,?,?,00000003,?), ref: 00489FD4
RmGetList.RSTRTMGR(?,?,?,00000000,?), ref: 0048A020
RmEndSession.RSTRTMGR(?), ref: 0048A04A
RmEndSession.RSTRTMGR(?), ref: 0048A07A

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction ID: 0c548674b0cea8079c7009f79d794e669f8d4684f59b10cf2f6688a8c9d6d6ed
Opcode Fuzzy Hash: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction Fuzzy Hash: A7417971E011589BEF10AFE4DC44AEEBBBCEB45300F14412BE902EB254EB7A9C058B95

Function 00473B90 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00473D56
___std_exception_destroy.LIBVCRUNTIME ref: 00473D73

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,8047B0C5), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 00473FC0
___std_exception_destroy.LIBVCRUNTIME ref: 00473FDD

Strings

value, xrefs: 00473C96, 00473EF5
MC, xrefs: 00473D4C, 00473D68, 00473FB6, 00473FD2

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction ID: 838f8dd16b3ea7f4eeb45613560c02c2ef3b01355b1a5592379bf0a45a67ceab
Opcode Fuzzy Hash: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction Fuzzy Hash: 31F15A70C05298DEEB20DB65C954BDEFBB4AF19304F1482DAD44963282E7746B88CF96

Function 009A5C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009A5CB7
___except_validate_context_record.LIBVCRUNTIME ref: 009A5CBF
_ValidateLocalCookies.LIBCMT ref: 009A5D48
__IsNonwritableInCurrentImage.LIBCMT ref: 009A5D73
_ValidateLocalCookies.LIBCMT ref: 009A5DC8

Strings

csm, xrefs: 009A5D5D

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 84de25382fdff9bc768f5ef44ec691e27ee6db108f70e7680c5203d6dcd08c45
Instruction ID: 461fd20b615458a13ebcc93630798c4ef1ff6a66eb2ccec7fcca31495f361113
Opcode Fuzzy Hash: 84de25382fdff9bc768f5ef44ec691e27ee6db108f70e7680c5203d6dcd08c45
Instruction Fuzzy Hash: 7441B334A00619EBCF10DF68C888A9EBBB5FF86324F158155E8149B392D731AE41CBD1

Function 004AD600 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004AD637
___except_validate_context_record.LIBVCRUNTIME ref: 004AD63F
_ValidateLocalCookies.LIBCMT ref: 004AD6C8
__IsNonwritableInCurrentImage.LIBCMT ref: 004AD6F3
_ValidateLocalCookies.LIBCMT ref: 004AD748

Strings

csm, xrefs: 004AD6DD

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction ID: fca86a332ffc7d642b39a5fdc798139505592cae81a3a9a41e25a428a24f43dc
Opcode Fuzzy Hash: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction Fuzzy Hash: 2741D834E002089BCF10DF69C880A9E7BB5BF66318F14815BE81A5B752D739EA01CF95

Function 009A94CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,009A95DD,009A2442,?,00000000,?), ref: 009A958F

Strings

ext-ms-, xrefs: 009A9539
api-ms-, xrefs: 009A9525

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction ID: a85474ac283111abf3178413e80806fcab9311c6e02d78736d2aacf71f32731b
Opcode Fuzzy Hash: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction Fuzzy Hash: 1A215035E05211A7C7229B64DC41A6E77ACFB8B7B1F140610FD06A72D1DB70EE01D6D0

Function 0049C8FA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0049CA09,0043FE48,00434C2F,00000000,00000001,0043FE4A,?,0049CC33,00000022,FlsSetValue,004D294C,FlsSetValue,00000001), ref: 0049C9BB

Strings

ext-ms-, xrefs: 0049C965
api-ms-, xrefs: 0049C951

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction ID: 9ca0f964f7470424b5d3057a4191f763ac6aa624da693043a33dcdca32e519f2
Opcode Fuzzy Hash: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction Fuzzy Hash: A621E7B2A01211ABDF219B25ECC0B5F3B69AB527A4F250237E905A7390D738ED01C6DD

Function 00436640 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,8047B0C5), ref: 004AFA6C

Strings

ios_base::eofbit set, xrefs: 00436686
(>Q, xrefs: 004366D9
ios_base::badbit set, xrefs: 00436677, 004366A2
ios_base::failbit set, xrefs: 00436681
0hC, xrefs: 004366E3

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: (>Q$0hC$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-798308736
Opcode ID: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction ID: 0e9c3b5a5aba75944b05d252eccadd5948fd44e578ec9c0118fa22ff265feac2
Opcode Fuzzy Hash: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction Fuzzy Hash: 4E1122B29046487BD710DB59DC02FAA7398EB09754F04862FFD58872C1EB3DA90487AA

Function 009A489F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 009A48A5
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 009A48B3
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 009A48C4

Strings

kernel32.dll, xrefs: 009A48A0
GetTempPath2W, xrefs: 009A48B9
GetSystemTimePreciseAsFileTime, xrefs: 009A48AD

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction ID: b34c87e8097b9f3c3ee6df09a95954731a0815f6fec601da13503c03224605d2
Opcode Fuzzy Hash: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction Fuzzy Hash: 80D09E316AA620AF8350AF747F0D8DB7EA9EB496B53064216F511E2261DBB44504DB90

Function 0049D57F Relevance: 9.3, APIs: 6, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction ID: c45b587b2b6024bbc8d631f61cfde13028adc071dc65d72902c8bf59655bd6a7
Opcode Fuzzy Hash: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction Fuzzy Hash: 64B13572D00255AFDF11DF64CC81BAA7FA5EF55310F1441BBE454AB382D2789D01C7A9

Function 004A2113 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004A21FD
__freea.LIBCMT ref: 004A228D
__freea.LIBCMT ref: 004A22A9

Strings

a/p, xrefs: 004A236F
am/pm, xrefs: 004A230B

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: a9edef7a29c60dc922f9c04593671941a29bfc7d944e7fd23b6979b0c360fd65
Instruction ID: 1d0f90a389a6ddb01c6eee3cfed114d4cdbff39c5c4e16d1e763b1923b69fac5
Opcode Fuzzy Hash: a9edef7a29c60dc922f9c04593671941a29bfc7d944e7fd23b6979b0c360fd65
Instruction Fuzzy Hash: 32C1BF35904212AADB298F6CCA947BB77B0FF2B300F14405BE905AB750D3BD9D42EB59

Function 0047CCA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047CCD6
std::_Lockit::_Lockit.LIBCPMT ref: 0047CCF9
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CD21
std::_Facet_Register.LIBCPMT ref: 0047CD9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CDC4
Concurrency::cancel_current_task.LIBCPMT ref: 0047CDE7

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction ID: 5e0d328f53af4ec2248f8036dfe48c657d56e4526373956cc4eb9e978e4c29ea
Opcode Fuzzy Hash: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction Fuzzy Hash: FE419A71800219CFCB21CF98C980BEFBBB4EB15714F14856ED80A67381D738AE04CBA5

Function 009A7F49 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009A7F40,009A5A6B,009A5180), ref: 009A7F57
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009A7F65
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009A7F7E
SetLastError.KERNEL32(00000000,009A7F40,009A5A6B,009A5180), ref: 009A7FD0

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 281f552aa3e2bba910b2761de8ffc0b960c37172d35ba76c85da1259be1d8516
Instruction ID: 0347aee122adfd4ccf86276ea0daabdae4a8c1a56758d8923d5243ba4a158e74
Opcode Fuzzy Hash: 281f552aa3e2bba910b2761de8ffc0b960c37172d35ba76c85da1259be1d8516
Instruction Fuzzy Hash: D701F77251D2127EE61527F4ADCBA67BBACDB877B47200339F410450F0EF114C02A1D0

Function 004AFADE Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004AFAD5,004AF923,004AC85A), ref: 004AFAEC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004AFAFA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004AFB13
SetLastError.KERNEL32(00000000,004AFAD5,004AF923,004AC85A), ref: 004AFB65

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction ID: 5c97271c99781371f32c50c56a2d0a191a69233ae1c55058bab721689d3f3b0d
Opcode Fuzzy Hash: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction Fuzzy Hash: 9001F9321093119E9A2417F5AC559972A65EB23379B24463FF514951E0FB1A5C0CA16C

Function 00480AC0 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00480B31
EnterCriticalSection.KERNEL32(00000004,8047B0C5,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B42
EnterCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B4F
GdiplusShutdown.GDIPLUS(00000000,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B5C
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B69
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B70

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction ID: a49544f5ea7446c9cfb95f09875386710a40740b290a3353e41ff902735902d1
Opcode Fuzzy Hash: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction Fuzzy Hash: 8B117FB15002009FD3209F58D848B1A7BF8FF05728F20475EE4258B2D1C77AD806CB94

Function 009A87D9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009A88F8
CallUnexpected.LIBVCRUNTIME ref: 009A8B71

Strings

csm, xrefs: 009A8883
csm, xrefs: 009A8816
csm, xrefs: 009A892F

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 87f1fc4f14b7b672f31a012a42c7667304171c4bef2b4a6e03036138273d3faf
Instruction ID: 40b251a1df3fc350a080cf0c510fc48fb691ece20f5d9b8013d5b25cd9ef1f62
Opcode Fuzzy Hash: 87f1fc4f14b7b672f31a012a42c7667304171c4bef2b4a6e03036138273d3faf
Instruction Fuzzy Hash: F4B16B71800209EFCF18DFA4C881AAFBBB9FF86310F55455AE8116B212DB35DA51CBE1

Function 0048A490 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(8047B0C5), ref: 0048A4E4
FreeEnvironmentStringsW.KERNEL32(?), ref: 0048A685
RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Strings

0Q8w, xrefs: 0048A6D9, 0048A6E4

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID: 0Q8w
API String ID: 2488768755-1710177118
Opcode ID: 087de5e6dd1055750bf7132ea8417913862878fff25edd8fa91e2b0393d86743
Instruction ID: 1a99e4392def1b605416f46e3147960cb17592dd8275db88d5f878599104deaf
Opcode Fuzzy Hash: 087de5e6dd1055750bf7132ea8417913862878fff25edd8fa91e2b0393d86743
Instruction Fuzzy Hash: 6471AAB1C10219EBDB00DF98C884B9EFBF8FF18304F14461BE815A3250E7B8A995CB95

Function 009A6A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,009B1B77,000000FF,?,009A6B21,?,?,009A6BBD,00000000), ref: 009A6A95
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009A6AA7
FreeLibrary.KERNEL32(00000000,?,00000000,009B1B77,000000FF,?,009A6B21,?,?,009A6BBD,00000000), ref: 009A6AC9

Strings

CorExitProcess, xrefs: 009A6A9F
mscoree.dll, xrefs: 009A6A8E

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction ID: c90c5b911599311d384dfbf4fb694a9f234e078919072ae645309173d3991b86
Opcode Fuzzy Hash: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction Fuzzy Hash: B3018431958519EBCB119F80CD05FBEB7BCFB48B64F084625A811A2290DB749804CA84

Function 004A2923 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8047B0C5,00000001,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A2958
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004A296A
FreeLibrary.KERNEL32(00000000,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A298C

Strings

CorExitProcess, xrefs: 004A2962
mscoree.dll, xrefs: 004A2951

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction ID: 4a39d6f0df0723e62e133a2fe4a12dc63d6bfdc81165c834358a2709fa0273f6
Opcode Fuzzy Hash: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction Fuzzy Hash: DA01A271A10625AFCB118F54DC05FAFBBBCFB04B10F044627E812A2790DBB89900DA98

Function 004B82A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,8047B0C5,?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3), ref: 004B82C9
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004B82D5
GetTempPathW.KERNEL32(?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3,?,00000105,?), ref: 004B82F5

Strings

kernel32.dll, xrefs: 004B82C4
GetTempPath2W, xrefs: 004B82CF

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressHandleModulePathProcTemp
String ID: GetTempPath2W$kernel32.dll
API String ID: 775647363-1846531799
Opcode ID: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction ID: 490c9918516094a75be01d3e1b1e27de5ce3fa518d230e70400d3a931493a6c9
Opcode Fuzzy Hash: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction Fuzzy Hash: C2F03A36A44654EFCB159F54EC05F9A7BA8FB09B60F008127EC16937A0DB79A800CB98

Function 009AD525 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009AD5AA
__alloca_probe_16.LIBCMT ref: 009AD673
__freea.LIBCMT ref: 009AD6DA

Part of subcall function 009AB3B5: HeapAlloc.KERNEL32(00000000,?,00000000,?,009A3C34,?,?,009A2442,00001000,?,009A23AA), ref: 009AB3E7

__freea.LIBCMT ref: 009AD6ED
__freea.LIBCMT ref: 009AD6FA

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: fb6ccc1f44cfa263671bc2f080c10c131e6f44dde1aa271b8fccc8823994c60b
Instruction ID: 274e42a4a04f457c7af23c7a05c44a0231417b70685d8ef8d5a8b197426a4369
Opcode Fuzzy Hash: fb6ccc1f44cfa263671bc2f080c10c131e6f44dde1aa271b8fccc8823994c60b
Instruction Fuzzy Hash: 0951C372602246AFEF205F64CC81EBB37ADEF8A714B190529FD0AD6551EB75CC10C6E0

Function 0049AEB4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0049AF39
__alloca_probe_16.LIBCMT ref: 0049B002
__freea.LIBCMT ref: 0049B069

Part of subcall function 0049D15A: RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

__freea.LIBCMT ref: 0049B07C
__freea.LIBCMT ref: 0049B089

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 1cf292f1027faf516ea3b58fb1ffeacfcc17b82ad5c767b33ec64858519d3555
Instruction ID: c461f83b43c969d084823d86eb7d78e4c690f12dee5ba4d22df99f96e1ee22eb
Opcode Fuzzy Hash: 1cf292f1027faf516ea3b58fb1ffeacfcc17b82ad5c767b33ec64858519d3555
Instruction Fuzzy Hash: 4C510072600206AFEF209F65AD81EBB7EA9EF84314F15013EFC54D6241EB39DC5086E8

Function 009A1930 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 009A1A01
CloseHandle.KERNEL32 ref: 009A1A1E

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction ID: 01dbf0d9918108c55e6b4145a7798ef981f9bb530ca0a367eb947cb308af8286
Opcode Fuzzy Hash: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction Fuzzy Hash: F481F0B4D0A258DFCB00DFA8D584BAEBBF0BF4A314F104929E455A7381D7789948CF96

Function 009A46F6 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009A470A
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4729
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4757
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47B2
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47C9

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 53051a53eabd8cee83fbd22a4ece7b05ce4620da44ef1abb01ea11faf3ccf3a5
Instruction ID: 3ca6a88fedcde88c12fcad319cb7f3d8516d2de825da09f77564b99f192a8789
Opcode Fuzzy Hash: 53051a53eabd8cee83fbd22a4ece7b05ce4620da44ef1abb01ea11faf3ccf3a5
Instruction Fuzzy Hash: 51414A30910686DFCB20DF69D984AAAB3F9FF87310B504A2AD45697A40D7B4F944CFD1

Function 004B9258 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B925F
std::_Lockit::_Lockit.LIBCPMT ref: 004B926A
std::_Lockit::~_Lockit.LIBCPMT ref: 004B92D8

Part of subcall function 004B93BB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004B93D3

std::locale::_Setgloballocale.LIBCPMT ref: 004B9285
_Yarn.LIBCPMT ref: 004B929B

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction ID: d57bef6452a6d9f87b7c1f6c81a415e25ff1084f0ba862d3ffc406506ccaed08
Opcode Fuzzy Hash: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction Fuzzy Hash: 2101BC75A002149BDB09EF21E881ABE3BA5BF95714B18400EE90157381CF78AE42DBE9

Function 009AD200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748), ref: 009AD20D
GetLastError.KERNEL32(?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748,00000000,?,009A8E2C), ref: 009AD217
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009AD23F

Strings

api-ms-, xrefs: 009AD224

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction ID: d79eb59beefabec8c9a5e5fc1b309fdebffbf904ceb2f1ce7c05f0f86d008f97
Opcode Fuzzy Hash: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction Fuzzy Hash: 75E0D870298204B7DF112F50DC06FA93F6C9B85BA0F140020FD0DE44E1DB71E995D5C0

Function 004B0B2E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC), ref: 004B0B3B
GetLastError.KERNEL32(?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC,00000000,?,004B0A39), ref: 004B0B45
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004B0B6D

Strings

api-ms-, xrefs: 004B0B52

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction ID: d85af749d3a2776d246a861fdd0c76bc3b777c55ee5f54f02c25fa514b149693
Opcode Fuzzy Hash: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction Fuzzy Hash: 25E04F30284305B7EF221BA1EC0AF5E3B55AB11B49F144032F90CA91E1EBA6A910859C

Function 0047F2C0 Relevance: 6.5, APIs: 4, Instructions: 457registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0051C570,00000000,00020019,00000000,?,?,?,8047B0C5,?,0051C2A0), ref: 0047F4D0
RegQueryValueExA.ADVAPI32(00000000,0051C2A0,00000000,000F003F,?,00000400,?,?,?,8047B0C5,?,0051C2A0), ref: 0047F506
RegCloseKey.ADVAPI32(00000000,?,?,?,8047B0C5,?,0051C2A0), ref: 0047F5A4
SysFreeString.OLEAUT32 ref: 0047FA14

Part of subcall function 0047A610: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
Part of subcall function 0047A610: LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8047B0C5,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeOpenQueryValue$CloseCryptDataLocalStringUnprotect
String ID:
API String ID: 2380017125-0
Opcode ID: a521d0abf644b9380dcd8d70f5715900671aedad0facd1908bb1e921974b8b3c
Instruction ID: 56cbdaf4eb2024de0fd4bd59dbcd72090a4e5b75bdf23aa4f75e7a392944198d
Opcode Fuzzy Hash: a521d0abf644b9380dcd8d70f5715900671aedad0facd1908bb1e921974b8b3c
Instruction Fuzzy Hash: 24122BF0E002689BDB24DF24CC5479DB7B5AF44318F1086EAD64DA7282DB346E88CF59

Function 009ADCA8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 009ADD0B

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009ADF5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009ADFA3
GetLastError.KERNEL32 ref: 009AE046

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 73e470fc6ae406cb9819989194ef813d03dc4a33c27d07c03cdd2bae79a8cd94
Instruction ID: ab360b0bec38862491303f8b94eb5905db546f83b05f4926d5eec648f4170ce5
Opcode Fuzzy Hash: 73e470fc6ae406cb9819989194ef813d03dc4a33c27d07c03cdd2bae79a8cd94
Instruction Fuzzy Hash: 20D1AF75D042589FCF14CFA8C9809EDBBB9FF4A314F28452AE416EB751D730A942CB90

Function 0049B476 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8047B0C5,00000000,00000000,00000000), ref: 0049B4D9

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0049B72B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0049B771
GetLastError.KERNEL32 ref: 0049B814

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction ID: 17746d06032e39ca1db24970b21defb679d9c3d722e4804f7fdb3bafa319cb4d
Opcode Fuzzy Hash: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction Fuzzy Hash: 15D17A75D002489FCF05CFE9E980AEDBBB5EF49314F18816AE425EB351D734A906CB94

Function 00478300 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00477B00: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8047B0C5,?,?), ref: 00477B54
Part of subcall function 00477B00: Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Part of subcall function 00477B00: CloseHandle.KERNEL32(00000000), ref: 00477E84

ImpersonateLoggedOnUser.ADVAPI32(00000000,8047B0C5,?,00000000), ref: 00478391

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleImpersonateLoggedProcess32SnapshotToolhelp32User
String ID:
API String ID: 1507787261-0
Opcode ID: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction ID: e502c6a69380433c55fd31efa36561dbf437e01bd72b95285a5588c942f2c0dc
Opcode Fuzzy Hash: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction Fuzzy Hash: F5F17070C0428DDEEB15DBA4C8587DDBBB0AF15308F24819ED04977292DB785F88DBA6

Function 009A8500 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009A85C7
___AdjustPointer.LIBCMT ref: 009A85EA
___AdjustPointer.LIBCMT ref: 009A8686

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0608e06d263ec731d7ffd192b23052bf33a42abc4f5907356db316f8c3da7dec
Instruction ID: 64eb0d958b18bc1c6ef1e9a5ab8750c24b95537435cdfc67330fac35c1d6284f
Opcode Fuzzy Hash: 0608e06d263ec731d7ffd192b23052bf33a42abc4f5907356db316f8c3da7dec
Instruction Fuzzy Hash: AB51E272A05606AFEB298F54D941BBB77A8FF46310F15456DEC02972A1EB31EC50CBD0

Function 004AFBF5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004AFCBC
___AdjustPointer.LIBCMT ref: 004AFCDF
___AdjustPointer.LIBCMT ref: 004AFD7B

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction ID: 33b3d652e50ecda4e79a0ecf225597f03c3ffd3297545ef1ce997a4b46d38663
Opcode Fuzzy Hash: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction Fuzzy Hash: AF51D0B150020A9FEB269FD1D881BAA77A4FF62718F10003EEC434B291D739E849C798

Function 004A077A Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction ID: 6bad779769d7c9384c33fcc5b288381071ef860472916b423066c301ca7f7ee1
Opcode Fuzzy Hash: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction Fuzzy Hash: D141E675A00704AFDB24AF39CC41B6BBBA9EB99714F20452FF101DB781D77DA9418B88

Function 009ABD28 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,009AC0CE,?,?,?,00000000), ref: 009ABD8C
__dosmaperr.LIBCMT ref: 009ABD93
GetLastError.KERNEL32(00000000,009AC0CE,?,?,00000000,?,?,?,00000000,00000000,?,009AC0CE,?,?,?,00000000), ref: 009ABDCD
__dosmaperr.LIBCMT ref: 009ABDD4

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 5fda42d8140670587ea3416d774c610875c0cdd6baed5a2579ed69048ad89bad
Instruction ID: eccb56bab440cbaf77b51c30396320524af657333288217487c52a5cea59894d
Opcode Fuzzy Hash: 5fda42d8140670587ea3416d774c610875c0cdd6baed5a2579ed69048ad89bad
Instruction Fuzzy Hash: AF21A4B1600206BFDB20AF66C881E6BB7ADFF463687118919F81997192D734EC40DBD1

Function 004BA942 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

GetLastError.KERNEL32 ref: 004BA9A6
__dosmaperr.LIBCMT ref: 004BA9AD
GetLastError.KERNEL32(?,?,?,?), ref: 004BA9E7
__dosmaperr.LIBCMT ref: 004BA9EE

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction ID: cdbbd9429668cd5750c88df838a7d8834fbfbf28e86e5927cf8d45539b4e27df
Opcode Fuzzy Hash: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction Fuzzy Hash: 7A21C871600605AF8F21AF66CC809ABBBADFF44368711492FF91597210D739EC60D7BA

Function 009AC2C4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b36e937bdd9776a463f892bead2d884e1ea2d5982c9dc011e0f8e74fc37fdd2
Instruction ID: 05507d55ab378ad77012b7e0a0c70fbd9d7593f76e689c04475c192514aa4026
Opcode Fuzzy Hash: 1b36e937bdd9776a463f892bead2d884e1ea2d5982c9dc011e0f8e74fc37fdd2
Instruction Fuzzy Hash: 8C216DB1604205AFDF20AFB5C881A6B77ADAF463687108A15F929EB151DB35EC40CBE1

Function 004989A8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction ID: 5e5224636d54f024fd63f309ffc809bb58d9736df3a284f1f4315f29edb86acb
Opcode Fuzzy Hash: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction Fuzzy Hash: F321A171600205AFCF21EF6ADC4496B7FA9AF42368720453FF91597251EF38ED008799

Function 009AC99D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009AC9A5

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9FD

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 8098251112c1c5f0566b1b0367e24e7eebd626d49e3c06392a087f3dff8de54c
Instruction ID: 349e1d20f2aeed0942e84ce737000675205ba597ec21927584cdadd0c8e2ab8b
Opcode Fuzzy Hash: 8098251112c1c5f0566b1b0367e24e7eebd626d49e3c06392a087f3dff8de54c
Instruction Fuzzy Hash: F31104F5915219BF6611A7B59C8DCBF695CDEDB3A43110124F401E9200EA28CD0291F1

Function 004AB379 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004AB381

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3B9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3D9

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 69a85f7ed18cd74047bb984129651c996d53830a83c410699db2c70aab7f3113
Instruction ID: 352b9fd8ff6adfd48aa864b65f723ba5a946c2f7c3dd1541d1c3166fed4ac287
Opcode Fuzzy Hash: 69a85f7ed18cd74047bb984129651c996d53830a83c410699db2c70aab7f3113
Instruction Fuzzy Hash: B21156B19015157E7A1167B65C8AD6F6A5CDE5A398B10403BF801D1203EB7D9D0245BA

Function 009A1E00 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009A1E2D
GetCurrentThreadId.KERNEL32 ref: 009A1E3B
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E54
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E93

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: cc8fa3324f5e6e9cf97eafe75bd973bf7bfbd8721fdcb9206dbbfcb1e8563e0c
Instruction ID: e28c2aeaaf5c3a040c85ecc6c965378effdf32fa309211f74cfd85a1637c5f8b
Opcode Fuzzy Hash: cc8fa3324f5e6e9cf97eafe75bd973bf7bfbd8721fdcb9206dbbfcb1e8563e0c
Instruction Fuzzy Hash: 3121E4B0E042098FCB04EFA8C5857AEBBF5EF89300F11845DE849AB351D7389A41CF91

Function 004B8430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000400,8047B0C5,00000000,00000000,00000000,00000000,00000000,00000001,?,?,0044E5F3,?,?,00000000,00000000), ref: 004B844D
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,8047B0C5,00000001), ref: 004B8459
WideCharToMultiByte.KERNEL32(00000001,00000000,8047B0C5,00000000,00000000,00000000,00000000,00000000,?,?,0044E5F3,?,?,00000000,00000000,00000000), ref: 004B847F
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,8047B0C5,00000001), ref: 004B848B

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction ID: 6b90caf3a67b14ffb57c64759c70b961d31bb881305e702148557666a2de5e43
Opcode Fuzzy Hash: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction Fuzzy Hash: FB01BF36601156BFCF224F95DC08E9F3F7AEBD9791F118029FA0556220DA31C922EBA5

Function 009AFD00 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000), ref: 009AFD17
GetLastError.KERNEL32(?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?,?,009AD9E0,00000000), ref: 009AFD23

Part of subcall function 009AFD74: CloseHandle.KERNEL32(FFFFFFFE,009AFD33,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?), ref: 009AFD84

___initconout.LIBCMT ref: 009AFD33

Part of subcall function 009AFD55: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009AFCF1,009AF48E,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD68

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD48

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction ID: d5653beaa3dc4be1b3262693e083b589b4e8550667f4f386525d479a7ba7cda1
Opcode Fuzzy Hash: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction Fuzzy Hash: C0F01C36414116BBCF232FD1DD08A8A3F6AFB493B1B004220FA0985570DB32C860EBD1

Function 004A95E5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000), ref: 004A95FC
GetLastError.KERNEL32(?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000,?,0049BE42,?), ref: 004A9608

Part of subcall function 004A95CE: CloseHandle.KERNEL32(FFFFFFFE,004A9618,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000), ref: 004A95DE

___initconout.LIBCMT ref: 004A9618

Part of subcall function 004A9590: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004A95BF,004A6707,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A95A3

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A962D

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction ID: 8abc0c58445a332f8c6052495b9482a66327941653e6e46fd38a52645a0d97bb
Opcode Fuzzy Hash: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction Fuzzy Hash: DCF01237441215BBCF521F91DC09ACE3F66EF19364F024426FA2C86120C6368D60DB94

Function 009A4F01 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009A4F13
GetCurrentThreadId.KERNEL32 ref: 009A4F22
GetCurrentProcessId.KERNEL32 ref: 009A4F2B
QueryPerformanceCounter.KERNEL32(?), ref: 009A4F38

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction ID: 249e697ac7c80175cdc73755d8fdc4735cdd91e78fe27fa41fa217d7d6f19e67
Opcode Fuzzy Hash: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction Fuzzy Hash: 9CF06774D1420DEBCB00EBB4DA49ADFB7F8FF1D254B514A95A412E7110EB30A748EB51

Function 009A8BFD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,009A8AFE,?,?,00000000,00000000,00000000,?), ref: 009A8C22

Strings

RCC, xrefs: 009A8C3C
MOC, xrefs: 009A8C34

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 80a7fc5bd5597a9261ff03ebcc6357136f0c861b9187391962db0f0d0d0e8e72
Instruction ID: 390a7c09216b659692ea9dda0a0bb16a51e3ea6b253e92099ff5ed3820b8f932
Opcode Fuzzy Hash: 80a7fc5bd5597a9261ff03ebcc6357136f0c861b9187391962db0f0d0d0e8e72
Instruction Fuzzy Hash: 8A41AB71900209AFCF15CF94CD81AEEBBBAFF49310F144168F90467291D7359A50CFA0

Function 00453E10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00453EF4

Strings

`aC, xrefs: 00453F48
p]C, xrefs: 00453F59

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$p]C
API String ID: 118556049-1363152631
Opcode ID: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction ID: 7ffd0bf130dfa3baccabcf7c02000b8885a72f27ff8372dee48aba471c76e642
Opcode Fuzzy Hash: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction Fuzzy Hash: 2B4114B1D002089BCB24DF58C841BAFBBF4EF45354F10426FEC2597382E7799A148B95

Function 004B01F1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004B0216

Strings

RCC, xrefs: 004B0230
MOC, xrefs: 004B0228

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction ID: 70788f387beb527cb8114cdc5e5f216b8ccff70d73c61da87df7ae4bd57bd2ae
Opcode Fuzzy Hash: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction Fuzzy Hash: EE415871900209AFCF16CF98CD85AEEBBB5FF48305F18809AFA0567211D3399950DB68

Function 009A8469 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009A86E0

Strings

csm, xrefs: 009A8773
csm, xrefs: 009A8702

Memory Dump Source

Source File: 00000003.00000002.3391106846.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000003.00000002.3391088551.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391127341.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391148327.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391165972.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3391183935.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9a0000_file.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction ID: e5eb7fef57c388b1591a1162c3e1c9b1a461c8bec64cc51ab6a3ef1869e36f37
Opcode Fuzzy Hash: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction Fuzzy Hash: 7831C436400219DFCF268F50CC449ABBBAAFF4A365B38455AF85449221DB36CCA1DFD1

Function 00435DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00435DCB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00435E2E

Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9375
Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9399

Strings

bad locale name, xrefs: 00435E51

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction ID: 3ec4c6a4a97d0462a05707b65000259191fcf5f6abdba4908dc577763c239046
Opcode Fuzzy Hash: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction Fuzzy Hash: 3B210570805784DFD320CF69C90478BBFF4AF15714F14868ED48597781D3B9AA04CBA5

Function 0047DD40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DDD1

Strings

.G, xrefs: 0047DD75
0hC, xrefs: 0047DDCB

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction ID: def2e33cd38b5e824c816681f9ae39c6530dfa40910c99229239c839cc9e5e1b
Opcode Fuzzy Hash: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction Fuzzy Hash: 9B21AE74940245DFD720CF1AC844B99FBF8FF05324F148A6EE85597391D775A904CB84

Function 0044BEB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0044BEF3
___std_exception_copy.LIBVCRUNTIME ref: 0044BF26

Strings

MC, xrefs: 0044BEE4, 0044BF17

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction ID: 159077f32092c3bc03b4ae882dbf743a881f4ebbd8d79b989d6de070d85d5faa
Opcode Fuzzy Hash: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction Fuzzy Hash: 4E112EB5900649EFCB11CF59C980B86FBE8FF19320F10C66BE815A7640E7B4A944CBA4

Function 004827A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0048285D

Strings

0, xrefs: 004827FE
0hC, xrefs: 00482852

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC
API String ID: 323602529-784950247
Opcode ID: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction ID: dd26a1c23eadb7639fef0861fdc2b6c05f84c76fd28c7669f454e47aafc92c53
Opcode Fuzzy Hash: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction Fuzzy Hash: FC21F074905298CFCB10CF98C6887DCBBF0AB09308F2480EAD949A7381D775AE58CF55

Function 0047D9C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DA4F

Strings

.G, xrefs: 0047D9F2
0hC, xrefs: 0047DA49

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction ID: 8e7f9f1aa37db0bf33048e17fc0a06a73726813013154025c8e8923a4ade326e
Opcode Fuzzy Hash: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction Fuzzy Hash: 121149B4940744CFDB21CF49C984A99BBF8FB09324F108A5EE89697391D775AA44CF80

Function 00438A00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438A46
___std_exception_destroy.LIBVCRUNTIME ref: 00438A5C

Strings

MC, xrefs: 00438A3C, 00438A56

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction ID: 2156576f1eef92af9ffbb3102a1cf8c86cd110feba5e05fe60ab6789c6c907d6
Opcode Fuzzy Hash: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction Fuzzy Hash: 5A01B5B1C44318EBC710DF58DD01B8ABBE8EB1A714F10466FE811E3780E779A60487A5

Function 00438CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D06
___std_exception_destroy.LIBVCRUNTIME ref: 00438D1C

Strings

MC, xrefs: 00438CFC, 00438D16

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction ID: 34d925613d03c46ca24c24dcd021453886a1a957fa2bd66f6c30760aa6902abf
Opcode Fuzzy Hash: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction Fuzzy Hash: 050192B1C443189BC711DF58DD05B89BBE8EB1A714F14466FE811A3780E7B9A60487A5

Function 00438DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438E16
___std_exception_destroy.LIBVCRUNTIME ref: 00438E2C

Strings

MC, xrefs: 00438E0C, 00438E26

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction ID: 81858840e3503bfd15470ad0d796ddf3043ff6da9bec83e018f38d9446b02dde
Opcode Fuzzy Hash: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction Fuzzy Hash: 4A01D2B1C442089FC710DF58DD01B8ABBE8EB1A714F10426FE811E3780E7B9A60487A5

Function 00438A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438AD6
___std_exception_destroy.LIBVCRUNTIME ref: 00438AEC

Strings

MC, xrefs: 00438ACC, 00438AE6

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction ID: 14708e90e5e2dd6187806a9d8007313cf644032e1f72ff90a2cf062a52645627
Opcode Fuzzy Hash: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction Fuzzy Hash: AD0131B1C54658DFC710DF98D901B8ABBF8EB09724F10466BE815E3780E779A6048BA5

Function 00438D50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D96
___std_exception_destroy.LIBVCRUNTIME ref: 00438DAC

Strings

MC, xrefs: 00438D8C, 00438DA6

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction ID: 57808b7f7ef1f41f2f9046275374ae6f4c4975ec05ee0e2f2319a2ec8c3047b8
Opcode Fuzzy Hash: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction Fuzzy Hash: BB0136B1C44658DFC710DF98D901B89BBF8EB09714F10466FE815E3780E77566048B65

Function 0048A6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Strings

0Q8w, xrefs: 0048A6D9, 0048A6E4

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: 0Q8w
API String ID: 4228678080-1710177118
Opcode ID: 7daf87f8c1ea5e59ace241312ec7f61dd946e809b9173c130261c4fe55fa0827
Instruction ID: 9965e4e76de23dc0ee0a0bab637c9cbc157b952fc1d2a329a02330ce3ace71f2
Opcode Fuzzy Hash: 7daf87f8c1ea5e59ace241312ec7f61dd946e809b9173c130261c4fe55fa0827
Instruction Fuzzy Hash: 7CF03036140649DFC701CF99E888D96B7ECBB6C3107548453E945C7620C232F8A9CB61

Function 004BA04D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004805F0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,8047B0C5,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480617
Part of subcall function 004805F0: GetLastError.KERNEL32(?,00000000,00000000,8047B0C5,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480621

IsDebuggerPresent.KERNEL32(?,?,?,00434B5D), ref: 004BA080
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00434B5D), ref: 004BA08F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004BA08A

Memory Dump Source

Source File: 00000003.00000002.3390983142.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction ID: d36ccacf6001ae6edc25a42526d65594664b7a1234a3e60676ee06f56b9b42c5
Opcode Fuzzy Hash: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction Fuzzy Hash: 64E065701007018FD330AF3AD40C3467BE0AB14304F00882FD945C7750E7B9D4088B66

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 009BA1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 009A94CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 009A1930 Relevance: 9.2, APIs: 6, Instructions: 196
fileCOMMON

Function 009AD525 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Function 009A17E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
memoryCOMMON

Function 009A67F4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 009AA0BA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 009A3C1A Relevance: 3.1, APIs: 2, Instructions: 94
COMMONLIBRARYCODE

Function 009A9EAC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 009A690C Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 009A9357 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 009AA83B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 009AA649 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Function 009A32D0 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Function 009A9599 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre