Edit tour

Windows Analysis Report
drop1.exe

Overview

General Information

Sample name:	drop1.exe
Analysis ID:	1586872
MD5:	60b0f0816c90a313de1549890708f848
SHA1:	cb8c0007e9fd7460c6cc7bb66c9dafc02b10b869
SHA256:	249658063881bcc13f2b21919906d68272dff1348251a2a1cb77abaf0eaf0c3d
Tags:	exeuser-threatinte1
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

drop1.exe (PID: 4340 cmdline: "C:\Users\user\Desktop\drop1.exe" MD5: 60B0F0816C90A313DE1549890708F848)

conhost.exe (PID: 2896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

drop1.exe (PID: 5356 cmdline: "C:\Users\user\Desktop\drop1.exe" MD5: 60B0F0816C90A313DE1549890708F848)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "2", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Process Memory Space: drop1.exe PID: 5356	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: drop1.exe PID: 5356	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.drop1.exe.107e220.1.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.drop1.exe.107e220.1.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfbcdc:$str01: emoji 0xfe4d8:$str02: %d-%m-%Y, %H:%M:%S 0xfe540:$str03: [UTC 0xfe54c:$str04: user_name 0xfe570:$str05: computer_name 0xfe594:$str06: timezone 0xfe4c4:$str07: current_path() 0xfbca8:$str08: [json.exception. 0x111c2e:$str09: GDI32.dll 0x111ea0:$str10: GdipGetImageEncoders 0x111f18:$str10: GdipGetImageEncoders 0x111548:$str11: GetGeoInfoA
0.2.drop1.exe.107e220.1.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.drop1.exe.107e220.1.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
2.2.drop1.exe.400000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
2.2.drop1.exe.400000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
2.2.drop1.exe.400000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
2.2.drop1.exe.400000.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Click to see the 3 entries

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T17:49:04.962293+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49731	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T17:49:04.962293+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49731	66.63.187.173	15666	TCP
2025-01-09T17:49:04.967644+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49731	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T17:49:04.962293+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49731	66.63.187.173	15666	TCP
2025-01-09T17:49:04.967644+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49731	66.63.187.173	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.drop1.exe.400000.0.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "2", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: drop1.exe

ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: drop1.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047A610 CryptUnprotectData,LocalFree,	2_2_0047A610
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043D4A0 BCryptDestroyKey,	2_2_0043D4A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047A950 CryptProtectData,LocalFree,	2_2_0047A950
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047AAE0 BCryptDecrypt,BCryptDecrypt,	2_2_0047AAE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00440B60 CryptUnprotectData,LocalFree,	2_2_00440B60
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047AE10 BCryptCloseAlgorithmProvider,	2_2_0047AE10
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047AE80 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	2_2_0047AE80

Source: drop1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: drop1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009ABE9A FindFirstFileExW,	0_2_009ABE9A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009ABF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009ABF4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004402D0 FindFirstFileW,FindNextFileW,	2_2_004402D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	2_2_004B84C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_004B8545
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84E0 FindFirstFileExW,	2_2_004B84E0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00487550 GetLogicalDriveStringsW,

2_2_00487550

Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49731 -> 66.63.187.173:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49731 -> 66.63.187.173:15666

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 66.63.187.173:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49731 -> 66.63.187.173:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00485350 recv,recv,recv,recv,recv,recv,closesocket,WSACleanup,

2_2_00485350

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: drop1.exe, 00000002.00000003.1892703610.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1892852444.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/1
Source: drop1.exe, 00000002.00000003.1892703610.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1892852444.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/S
Source: drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/)
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/U
Source: drop1.exe, 00000002.00000003.1701650624.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: drop1.exe, 00000002.00000003.1701650624.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: drop1.exe, 00000002.00000003.1681737362.0000000004AEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683113723.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: drop1.exe, 00000002.00000003.1681737362.0000000004AEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683113723.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: drop1.exe, 00000002.00000003.1681737362.0000000004AEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683113723.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1701650624.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: drop1.exe, 00000002.00000003.1697741837.00000000046B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.moz
Source: drop1.exe, 00000002.00000003.1697512481.00000000045E0000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F1E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F26000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697350515.0000000004007000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004AFD000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: drop1.exe, 00000002.00000003.1683113723.0000000004B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: drop1.exe, 00000002.00000003.1682722943.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B06000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682939418.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682811422.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683301990.0000000004B56000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: drop1.exe, 00000002.00000003.1683113723.0000000004B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: drop1.exe, 00000002.00000003.1682722943.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B06000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682939418.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682811422.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683301990.0000000004B56000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1701650624.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: drop1.exe, 00000002.00000003.1697512481.00000000045E0000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F1E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696599580.0000000004B98000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F26000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697350515.0000000004007000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004AFD000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: drop1.exe, 00000002.00000003.1697741837.00000000046B6000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004B0D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: drop1.exe, 00000002.00000003.1697741837.00000000046B6000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004B0D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00485F00 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_00485F00

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.drop1.exe.107e220.1.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.drop1.exe.107e220.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0048A0A0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,		2_2_0048A0A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,		2_2_0048A710

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A1000	0_2_009A1000
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A5235	0_2_009A5235
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009B1542	0_2_009B1542
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004422D0	2_2_004422D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043A2B0	2_2_0043A2B0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00446400	2_2_00446400
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00488400	2_2_00488400
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043E4F0	2_2_0043E4F0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004395D0	2_2_004395D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00487780	2_2_00487780
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00485840	2_2_00485840
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043C970	2_2_0043C970
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004479C0	2_2_004479C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00459A06	2_2_00459A06
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0046EB70	2_2_0046EB70
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0046BCE0	2_2_0046BCE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00439D60	2_2_00439D60
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00470EF0	2_2_00470EF0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043BF70	2_2_0043BF70
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00462080	2_2_00462080
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004320A0	2_2_004320A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004A70A7	2_2_004A70A7
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0042D150	2_2_0042D150
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00479130	2_2_00479130
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00474190	2_2_00474190
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00461250	2_2_00461250
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00408270	2_2_00408270
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B6380	2_2_004B6380
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00407470	2_2_00407470
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00462410	2_2_00462410
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045C4C0	2_2_0045C4C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043D4A0	2_2_0043D4A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047E580	2_2_0047E580
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0046B620	2_2_0046B620
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00468750	2_2_00468750
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00419770	2_2_00419770
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045C700	2_2_0045C700
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004917CA	2_2_004917CA
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045D7A0	2_2_0045D7A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004627A0	2_2_004627A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0049687E	2_2_0049687E
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B6870	2_2_004B6870
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043A800	2_2_0043A800
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00493800	2_2_00493800
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0049F8A2	2_2_0049F8A2
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00461940	2_2_00461940
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00445950	2_2_00445950
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00478990	2_2_00478990
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004ACA4B	2_2_004ACA4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00406AE0	2_2_00406AE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B3AE0	2_2_004B3AE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00430AF0	2_2_00430AF0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0048AA80	2_2_0048AA80
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00414AA0	2_2_00414AA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045EAA0	2_2_0045EAA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00476AB6	2_2_00476AB6
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00462B50	2_2_00462B50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00482C4B	2_2_00482C4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004BCC40	2_2_004BCC40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B6C40	2_2_004B6C40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00461CC0	2_2_00461CC0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00478D40	2_2_00478D40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B6D30	2_2_004B6D30
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B1D30	2_2_004B1D30
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00440DE0	2_2_00440DE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043AE50	2_2_0043AE50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0042EEA0	2_2_0042EEA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00406F40	2_2_00406F40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00444F50	2_2_00444F50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00443F00	2_2_00443F00
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00456F00	2_2_00456F00
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00412FA0	2_2_00412FA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A1000	2_2_009A1000
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A5235	2_2_009A5235
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009B1542	2_2_009B1542

Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 004AC500 appears 58 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 009A51F0 appears 64 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 004517F0 appears 53 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 009A970F appears 36 times

Source: drop1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.drop1.exe.107e220.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.drop1.exe.107e220.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: drop1.exe

Static PE information: Section: .bss ZLIB complexity 1.0003138195647467

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/2

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0048CB50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

2_2_0048CB50

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_004473D0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_004473D0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00477EE0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

2_2_00477EE0

Source: C:\Users\user\Desktop\drop1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69636FEA4217
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2896:120:WilError_03

Source: drop1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: drop1.exe, 00000002.00000003.1683665006.00000000013C6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: drop1.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\drop1.exe

File read: C:\Users\user\Desktop\drop1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: drop1.exe

Static file information: File size 1293312 > 1048576

Source: drop1.exe

Static PE information: Raw size of .bss is bigger than: 0x100000 < 0x120a00

Source: drop1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_00446400

Source: drop1.exe

Static PE information: section name: .OO

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A46A3 push ecx; ret	0_2_009A46B6
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004ACE0C push ecx; ret	2_2_004ACE1F
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A46A3 push ecx; ret	2_2_009A46B6

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0047E240 GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,ExitProcess,ReleaseMutex,CloseHandle,

2_2_0047E240

Source: C:\Users\user\Desktop\drop1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-57172

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009ABE9A FindFirstFileExW,	0_2_009ABE9A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009ABF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009ABF4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004402D0 FindFirstFileW,FindNextFileW,	2_2_004402D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	2_2_004B84C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_004B8545
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84E0 FindFirstFileExW,	2_2_004B84E0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00487550 GetLogicalDriveStringsW,

2_2_00487550

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00498574 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

2_2_00498574

Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: drop1.exe, 00000002.00000003.1682172079.0000000001365000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682911061.0000000001366000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000002.1893429161.0000000001365000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: drop1.exe, 00000002.00000003.1682172079.0000000001365000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682911061.0000000001366000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000002.1893429161.0000000001365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWUi7

Source: C:\Users\user\Desktop\drop1.exe

API call chain: ExitProcess graph end node

graph_2-57192

Source: C:\Users\user\Desktop\drop1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,

2_2_0048A710

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_009A78CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009A78CC

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00498574 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

2_2_00498574

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_00446400

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009BA1A9 mov edi, dword ptr fs:[00000030h]	0_2_009BA1A9
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A1770 mov edi, dword ptr fs:[00000030h]	0_2_009A1770
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A1770 mov edi, dword ptr fs:[00000030h]	2_2_009A1770

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_009A9726 GetProcessHeap,

0_2_009A9726

Source: C:\Users\user\Desktop\drop1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A78CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009A78CC
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A501B SetUnhandledExceptionFilter,	0_2_009A501B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A5027 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009A5027
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_009A45B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009A45B7
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004AC6BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004AC6BF
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004AC80A SetUnhandledExceptionFilter,	2_2_004AC80A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00497B2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00497B2D
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004ABFD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004ABFD4
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A501B SetUnhandledExceptionFilter,	2_2_009A501B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A5027 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_009A5027
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A45B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_009A45B7
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_009A78CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_009A78CC

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_009BA1A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_009BA1A9

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\drop1.exe

Memory written: C:\Users\user\Desktop\drop1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0047D2F0 ShellExecuteW,OpenProcessToken,GetCurrentProcess,GetTokenInformation,std::ios_base::_Ios_base_dtor,

2_2_0047D2F0

Source: C:\Users\user\Desktop\drop1.exe

Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00486C50 cpuid

2_2_00486C50

Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004A6109
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_004B824D
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_004A620F
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004A62E5
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_0049C70E
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C67
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C1A
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C1C
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_0049CCB0
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5D02
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_004A5D8D
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_004A5FE0

Source: C:\Users\user\Desktop\drop1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_009A48D3 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_009A48D3

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_004863F0 GetUserNameW,

2_2_004863F0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_004A1074 GetTimeZoneInformation,

2_2_004A1074

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: drop1.exe PID: 5356, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.drop1.exe.107e220.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.drop1.exe.107e220.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: drop1.exe PID: 5356, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: drop1.exe, 00000002.00000003.1890733096.0000000001380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\config
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ptrty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: drop1.exe PID: 5356, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.drop1.exe.107e220.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.drop1.exe.107e220.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: drop1.exe PID: 5356, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 Software Packing	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
drop1.exe	87%	ReversingLabs	Win32.Trojan.LummaStealer
drop1.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ns.exif/1	0%	Avira URL Cloud	safe
https://support.moz	0%	Avira URL Cloud	safe
http://ns.microsofo/1.2/S	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	drop1.exe, 00000002.00000003.1681737362.0000000004AEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683113723.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	drop1.exe, 00000002.00000003.1681737362.0000000004AEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683113723.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	drop1.exe, 00000002.00000003.1701650624.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	drop1.exe, 00000002.00000003.1701650624.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	drop1.exe, 00000002.00000003.1681737362.0000000004AEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683113723.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsofo/1.2/S	drop1.exe, 00000002.00000003.1892703610.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1892852444.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	drop1.exe, 00000002.00000003.1683113723.0000000004B7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	drop1.exe, 00000002.00000003.1683113723.0000000004B7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/)	drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	drop1.exe, 00000002.00000003.1697350515.000000000400E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.exif/1	drop1.exe, 00000002.00000003.1892703610.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1892852444.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.moz	drop1.exe, 00000002.00000003.1697741837.00000000046B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1701650624.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	drop1.exe, 00000002.00000003.1682722943.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B06000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682939418.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682811422.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683301990.0000000004B56000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/U	drop1.exe, 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	drop1.exe, 00000002.00000003.1697512481.00000000045E0000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F1E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697196531.0000000003F26000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1697350515.0000000004007000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004AFD000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1696286055.0000000004B05000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	drop1.exe, 00000002.00000003.1682722943.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B06000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682939418.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682811422.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1683301990.0000000004B56000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682460238.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	drop1.exe, 00000002.00000003.1681737362.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1682124101.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	drop1.exe, 00000002.00000003.1701881030.000000000137F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.63.187.173	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586872
Start date and time:	2025-01-09 17:48:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	drop1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 83 Number of non-executed functions: 127
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: drop1.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.173	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	https://vq6btbhdpo.nutignaera.shop/?email=YWxlamFuZHJvLmdhcnJpZG9Ac2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205
	EZZGTmJj4O.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	mail (4).eml	Get hash	malicious	Unknown	Browse	172.67.74.152
	random.exe	Get hash	malicious	CStealer	Browse	104.26.12.205
	random.exe	Get hash	malicious	CStealer	Browse	172.67.74.152
	http://sammobile.digidip.net/visit?url=https://massageclinic.com.au/wadblacks2&currurl=https://www.sammobile.com/2018/06/06/june-2018-security-patch-information-published-by-samsung/	Get hash	malicious	Gabagool	Browse	104.26.13.205
	Ref#66001032.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	66.63.187.122
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	104.223.10.34
	1.elf	Get hash	malicious	Unknown	Browse	72.11.146.74
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	193.111.248.108
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
CLOUDFLARENETUS	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	1.3.115.13
	https://sora-ai-download.com/	Get hash	malicious	Unknown	Browse	104.22.20.144
	ReIayMSG__polarisrx.com_#7107380109.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	104.26.5.30
	ReIayMSG__polarisrx.com_#6577807268.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	104.21.32.1
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	8.44.60.40
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	104.21.13.141
	https://enterprisefocus.benchurl.com/c/l?u=11FC0F0E&e=193CF6A&c=173A1E&&t=0&l=11D51F9C4&email=s8sR2EUS6pcTEMAyWZX%2BTfGL0c%2FIo%2Bud&seq=2	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	DyM4yXX.exe	Get hash	malicious	Vidar	Browse	172.67.74.152
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.74.152
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse	172.67.74.152
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	2362476847-83854387.07.exe	Get hash	malicious	Nitol	Browse	172.67.74.152
	2362476847-83854387.07.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	2o63254452-763487230.06.exe	Get hash	malicious	Nitol	Browse	172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.959249842887653
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	drop1.exe
File size:	1'293'312 bytes
MD5:	60b0f0816c90a313de1549890708f848
SHA1:	cb8c0007e9fd7460c6cc7bb66c9dafc02b10b869
SHA256:	249658063881bcc13f2b21919906d68272dff1348251a2a1cb77abaf0eaf0c3d
SHA512:	ef93de31ecfb6e779fe5013165c508b202a95067c88aa8dddbffaaf74996eb7ebfd455fc7de60a90930bde808704beb7472400356e44f9c4caa47863227d77ff
SSDEEP:	24576:Bdl/BxIgevnHodySw5KPwlXkV8sWGzv6VD0iNKlsTEc8qF71X:/l/85vnIdyd5QwlXkBmLNfky7F
TLSH:	F455235131C0C4B1CBA3583645B0BB56592DFD314FB0A9FF278D59A15E22AD08A3CAFB
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...bI\g..........".................\L............@.......................................@.................................D~..(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x404c5c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x675C4962 [Fri Dec 13 14:49:06 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2716f32d1d63b3fc977d6064633b778d

Entrypoint Preview

Instruction
call 00007F268CC7E5DAh
jmp 00007F268CC7E1F9h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F268CC7E38Fh
neg eax
pop ecx
sbb eax, eax
neg eax
dec eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0041B4F0h], FFFFFFFFh
push dword ptr [ebp+08h]
jne 00007F268CC7E389h
call 00007F268CC809A1h
jmp 00007F268CC7E38Dh
push 0041B4F0h
call 00007F268CC80924h
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
cmove ecx, dword ptr [ebp+08h]
mov eax, ecx
pop ebp
ret
push 00000008h
push 00418D38h
call 00007F268CC7E8C0h
and dword ptr [ebp-04h], 00000000h
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
jne 00007F268CC7E3DFh
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F268CC7E3CEh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F268CC7E3C0h
mov eax, dword ptr [ebp+08h]
mov ecx, 00400000h
sub eax, ecx
push eax
push ecx
call 00007F268CC7E502h
pop ecx
pop ecx
test eax, eax
je 00007F268CC7E3A9h
cmp dword ptr [eax+24h], 00000000h
jl 00007F268CC7E3A3h
mov dword ptr [ebp-04h], FFFFFFFEh
mov al, 01h
jmp 00007F268CC7E3A1h
mov eax, dword ptr [ebp-14h]
mov eax, dword ptr [eax]
xor ecx, ecx
cmp dword ptr [eax], C0000005h
sete cl
mov eax, ecx
ret
mov esp, dword ptr [ebp-18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17e44	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e000	0x12fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x12808	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17fac	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10c15	0x10e00	05d7420100633613bdbd5a889171c5f7	False	0.5704427083333333	data	6.50620173764596	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x7294	0x7400	4965eb04eb8b1b66b8d84a097bc01bc3	False	0.3977976831896552	data	4.65662016842751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x1c10	0x1200	6a2a147d595c2e66ddd7fdd872225955	False	0.4281684027777778	data	4.604642940636322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.OO	0x1c000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1d000	0xe8	0x200	0713d2c4e51a805f2ce8d9843bcbad43	False	0.306640625	data	2.337865625306241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e000	0x12fc	0x1400	c56221e7af6185e7585b1796050bcf12	False	0.778515625	data	6.424268394395036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x20000	0x120a00	0x120a00	7bebd6b0070e8bca1955d94098e27d8a	False	1.0003138195647467	data	7.999822682751923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1d060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T17:49:04.962293+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49731	66.63.187.173	15666	TCP
2025-01-09T17:49:04.962293+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49731	66.63.187.173	15666	TCP
2025-01-09T17:49:04.962293+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49731	66.63.187.173	15666	TCP
2025-01-09T17:49:04.967644+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49731	66.63.187.173	15666	TCP
2025-01-09T17:49:04.967644+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49731	66.63.187.173	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 17:48:59.485619068 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:48:59.490554094 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:48:59.490632057 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:48:59.584553003 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:48:59.584640026 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:48:59.584887028 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:48:59.603393078 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:48:59.603415012 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.092696905 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.092776060 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.144259930 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.144279003 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.145215034 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.145272970 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.149105072 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.191337109 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.258047104 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.258111000 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.258120060 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.258162975 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.258189917 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:00.258240938 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.262697935 CET	49732	443	192.168.2.4	172.67.74.152
Jan 9, 2025 17:49:00.262711048 CET	443	49732	172.67.74.152	192.168.2.4
Jan 9, 2025 17:49:04.962292910 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.967567921 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.967582941 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.967616081 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.967629910 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.967642069 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.967643976 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.967654943 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.967660904 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.967696905 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.971806049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.971820116 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.971884012 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.972040892 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.972054958 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.972089052 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.972104073 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.974030972 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974044085 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974071980 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974080086 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.974086046 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974092007 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.974101067 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974111080 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.974116087 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974124908 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.974136114 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.974159956 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.974245071 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974260092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.974302053 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.976623058 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.976671934 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.976728916 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.976742983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.976782084 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.976802111 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.976953030 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.977003098 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.977251053 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.977309942 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.979293108 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.979340076 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.979351044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.979387045 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.979388952 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.979432106 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.979454994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.979490995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.979505062 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.979537964 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.981225967 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.981275082 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.981786966 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.981838942 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.981884003 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.981899023 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.981926918 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.981937885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.981939077 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.981988907 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982022047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982024908 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982038975 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982042074 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982072115 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982073069 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982080936 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982088089 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982105017 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982119083 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982120991 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982137918 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982156992 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982158899 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982172012 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.982196093 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.982215881 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983273983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983295918 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983323097 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983345985 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983352900 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983376026 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983392000 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983398914 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983417988 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983421087 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983439922 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983462095 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983463049 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983484030 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983484983 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983499050 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983510017 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.983525038 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.983549118 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984137058 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984196901 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984301090 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984323025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984342098 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984348059 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984358072 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984370947 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984394073 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984416962 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984491110 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984513044 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984536886 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984551907 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984561920 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984574080 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984596014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984612942 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984627008 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984635115 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984658003 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984682083 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984688997 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984708071 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984729052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984729052 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984752893 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984762907 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984770060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984791994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984812021 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984818935 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984831095 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984837055 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984854937 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984858990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984879971 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.984883070 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984899998 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.984921932 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.986119986 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.986144066 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.986166000 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.986166000 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.986192942 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.986205101 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.986264944 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.986310959 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.986650944 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.986697912 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.986830950 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.986852884 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.986881971 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.986896992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987061024 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987082958 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987104893 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987128973 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987133980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987150908 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987174034 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987178087 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987185001 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987221003 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987236977 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987279892 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987344980 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987366915 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987389088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987390995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987413883 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987418890 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987431049 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987454891 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987457037 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987478018 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987498045 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987502098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987525940 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987543106 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987543106 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987565994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987586021 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987586975 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987610102 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987622023 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987629890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987652063 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987673044 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987673998 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987696886 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987709045 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987715960 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987737894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987759113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987765074 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987776041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987780094 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987801075 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987804890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.987823009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.987848043 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988287926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988341093 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988384008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988425016 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988432884 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988471985 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988501072 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988528013 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988548994 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988569975 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988596916 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988619089 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988641024 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988661051 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988665104 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988682985 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988706112 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988708019 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988734007 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988749981 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988749981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988773108 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988795042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988799095 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988818884 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988841057 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988842010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988864899 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988886118 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988889933 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988902092 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988907099 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988908052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988926888 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988933086 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.988951921 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988964081 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.988995075 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989039898 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989092112 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989140034 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989161015 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989186049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989207983 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989228010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989231110 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989249945 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989272118 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989274025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989295959 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989310980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989646912 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989686966 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989697933 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989708900 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989729881 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989754915 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989847898 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989870071 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989893913 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989909887 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.989916086 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.989953995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990269899 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990293026 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990318060 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990339994 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990372896 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990395069 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990417957 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990446091 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990453005 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990474939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990495920 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990514994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990520000 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990536928 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990559101 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990576029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990581036 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990597010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990619898 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990638018 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990643024 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990660906 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990684032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990701914 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990710974 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990725040 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990744114 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990752935 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990766048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990787983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990809917 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990825891 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990835905 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990849018 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990869999 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990871906 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990890026 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990891933 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990900040 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990910053 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990932941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.990938902 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990962029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990983009 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.990987062 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991003990 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991004944 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991027117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991039038 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991045952 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991066933 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991087914 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991089106 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991110086 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991111040 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991120100 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991147995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991149902 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991173029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991193056 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991198063 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991209984 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991235971 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991395950 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991417885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991440058 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991458893 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991461992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991481066 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991513014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991522074 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991784096 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991806030 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991827011 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991846085 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991851091 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991868019 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991892099 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991914034 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.991930962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991952896 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.991976976 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992033958 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992042065 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992085934 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992153883 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992181063 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992203951 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992208004 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992228031 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992242098 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992723942 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992750883 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992801905 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992876053 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992891073 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992907047 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.992916107 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992927074 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.992953062 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993000984 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993045092 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993068933 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993096113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993113995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993136883 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993218899 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993232965 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993257046 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993271112 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993288040 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993302107 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993324995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993335009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993339062 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993364096 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993372917 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993375063 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993386984 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993411064 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993422031 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993457079 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993469954 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993489981 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993503094 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993514061 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993527889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993537903 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993551970 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993554115 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993582964 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993585110 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993601084 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993633986 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993647099 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993654013 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993670940 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993671894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993685007 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993689060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993711948 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993720055 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993725061 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993747950 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993767977 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993788958 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993834972 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993866920 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993880987 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993906021 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993913889 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993927956 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993951082 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993957043 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993963957 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.993968964 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.993993044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994000912 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994057894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994071960 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994106054 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994108915 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994122982 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994148970 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994173050 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994179964 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994203091 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994225025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994231939 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994236946 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994294882 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994309902 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994333982 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994340897 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994348049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994362116 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994371891 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994379997 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994466066 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994481087 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994505882 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994509935 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994519949 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994520903 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994540930 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994561911 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994597912 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994611979 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994637012 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994637966 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994652987 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994654894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994673967 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994699001 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994704962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994719028 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994746923 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994757891 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994820118 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994832993 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994852066 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994859934 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994867086 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.994869947 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994883060 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.994904041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995012999 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995026112 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995038986 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995052099 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995064974 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995064974 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995075941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995079041 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995085955 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995102882 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995105982 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995117903 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995120049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995137930 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995146036 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995158911 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995174885 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995174885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995213985 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995215893 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995227098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995248079 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995251894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995258093 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995270014 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995290041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995296955 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995301962 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995347977 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995373964 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995393038 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995415926 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995498896 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995512962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995526075 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995538950 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995542049 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995559931 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995565891 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995568037 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995579958 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995594978 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995605946 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995608091 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995615005 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995631933 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995640993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995682001 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995697021 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995721102 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995721102 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995738029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995743036 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995762110 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995775938 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995862961 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995877028 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995902061 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995902061 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995915890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995923042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995938063 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995963097 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.995965004 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.995982885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996004105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996012926 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996093988 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996108055 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996134043 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996143103 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996146917 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996161938 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996185064 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996186018 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996201038 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996205091 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996217012 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996238947 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996294975 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996309042 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996337891 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996352911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996401072 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996407986 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996453047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996495962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996510029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996526003 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996536970 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996548891 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996561050 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996571064 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996613026 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996614933 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996645927 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996665955 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996673107 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996686935 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996694088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996706009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996712923 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996726990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996727943 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996752024 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996766090 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996778965 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996794939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996810913 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996826887 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996829987 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996838093 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996845961 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996870041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996870041 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996884108 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996918917 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996927023 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996932030 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996953964 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.996957064 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996980906 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.996992111 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997001886 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997030020 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997037888 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997045040 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997073889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997081995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997205019 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997219086 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997241974 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997248888 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997281075 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997298956 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997324944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997333050 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997405052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997417927 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997435093 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997443914 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997448921 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997457981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997464895 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997488022 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997509003 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997523069 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997551918 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997561932 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997581959 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997596025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997622967 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997636080 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997646093 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997661114 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997684956 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997726917 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997745037 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997760057 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997767925 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997775078 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997777939 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997791052 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997812033 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997863054 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997878075 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997894049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997901917 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997920990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.997931004 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.997962952 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998008966 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998022079 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998045921 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998056889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998059034 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998081923 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998081923 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998105049 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998114109 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998162031 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998193979 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998208046 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998209953 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998238087 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998308897 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998322010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998347044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998359919 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998368025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998374939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998394966 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998399973 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998405933 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998430014 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998442888 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998480082 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998487949 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998509884 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998532057 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998553991 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998580933 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998598099 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998619080 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998630047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998660088 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998675108 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998699903 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998708963 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998718977 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998733997 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998759031 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998766899 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998823881 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998837948 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998862982 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998872995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998876095 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998898983 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998913050 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.998948097 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.998991013 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999031067 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999046087 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999058962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999077082 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999087095 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999109030 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999129057 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999142885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999167919 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999186993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999222994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999248981 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999263048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999268055 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999279022 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999303102 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999309063 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999352932 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999385118 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999398947 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999423981 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999423981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999439955 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999463081 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999511003 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999526024 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999541044 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999562025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999572039 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999631882 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999675989 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999686956 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999732018 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999732971 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999757051 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999778032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999799967 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999823093 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999836922 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999866009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999877930 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999897957 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999912024 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999944925 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999946117 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999959946 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:04.999984980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:04.999998093 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000046015 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000060081 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000082970 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000087023 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000102997 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000107050 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000133991 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000183105 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000197887 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000236988 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000308990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000323057 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000356913 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000356913 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000385046 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000402927 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000428915 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000500917 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000514984 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000543118 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000554085 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000571966 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000586033 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000611067 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000626087 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000657082 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000680923 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000701904 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000720024 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.000777006 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.000822067 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.043747902 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.045182943 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045285940 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045356989 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045427084 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045492887 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045556068 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045608997 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045670033 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045732975 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045799017 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045852900 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045918941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.045955896 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.058667898 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.058875084 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.058933020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.058986902 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.059047937 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.059077024 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.063755989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.063951015 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.064021111 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.064060926 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.111686945 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.111902952 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.159343004 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.160113096 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160222054 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160279989 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160343885 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160417080 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160475016 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160532951 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160593987 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160656929 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160715103 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.160753012 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.165334940 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.165545940 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.165621042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.165658951 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.207648039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.207837105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.225313902 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.225358009 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.225621939 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.225708961 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.225780010 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.225837946 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.225852013 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.230628014 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.230895042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.230967045 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.231009960 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.271761894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.271964073 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.492647886 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.492671013 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.492688894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.492901087 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493127108 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493202925 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493282080 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493364096 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493422985 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493474960 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493519068 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493572950 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493618965 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493659019 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493710041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493760109 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493801117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.493819952 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.497971058 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498027086 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498120070 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498167992 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498178959 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498192072 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498218060 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498285055 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498316050 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498366117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498368025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498404980 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498460054 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498461962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498492956 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498541117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498575926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498610020 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498656034 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498781919 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498842001 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498869896 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498894930 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498903036 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.498908997 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.498956919 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499027014 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499058008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499104977 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499125004 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499159098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499207020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499274969 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499304056 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499355078 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499413013 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499444008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499495029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499496937 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499522924 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499572039 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499592066 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499627113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499675989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499680042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499707937 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499757051 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499783039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499833107 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499883890 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.499905109 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499933004 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.499984980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500000954 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500035048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500085115 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500142097 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500173092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500197887 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500214100 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500230074 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500257969 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500277042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500308990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500339031 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500363111 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500380993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500395060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500422955 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500457048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500471115 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500511885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500546932 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500565052 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500590086 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500596046 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500716925 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500745058 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500766039 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500799894 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500799894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500829935 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500861883 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500880003 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500906944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.500912905 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500963926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.500992060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501013041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501041889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501050949 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501080990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501136065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501195908 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501224041 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501271009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501339912 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501368046 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501415014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501437902 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501467943 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501513958 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501559973 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501589060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501640081 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501713991 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501800060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501852036 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501856089 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501880884 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501928091 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.501931906 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501960993 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.501988888 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502010107 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502027035 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502041101 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502074003 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502089977 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502101898 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502136946 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502156973 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502196074 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502243996 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502295971 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502325058 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502357960 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502372980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502402067 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502429962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502480984 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502527952 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502547979 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502599955 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502629995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502654076 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502664089 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502722979 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502737999 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502813101 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.502819061 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502834082 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.502882004 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503042936 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503056049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503068924 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503082037 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503103018 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503109932 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503119946 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503127098 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503137112 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503150940 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503150940 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503158092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503173113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503190041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503211975 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503215075 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503256083 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503261089 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503282070 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503326893 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503331900 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503346920 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503374100 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503386974 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503391981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503405094 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503427029 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503474951 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503488064 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503524065 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503531933 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503539085 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503562927 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503576040 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503588915 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503602028 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503616095 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503617048 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503631115 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503654003 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503675938 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503695965 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503710985 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503732920 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503737926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503741980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503751993 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503778934 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503792048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503798962 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503818989 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503832102 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503844976 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503859043 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503889084 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503902912 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503916979 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.503940105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503952980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.503993988 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504009008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504041910 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504051924 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504069090 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504100084 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504112959 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504113913 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504137993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504151106 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504188061 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504203081 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504224062 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504226923 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504241943 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504265070 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504291058 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504300117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504353046 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504367113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504398108 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504399061 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504411936 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504412889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504429102 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504437923 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504451990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504452944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504467964 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504481077 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504498005 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504518032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504533052 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504553080 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504565954 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504594088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504602909 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504672050 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504687071 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504698992 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504712105 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504714966 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504725933 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504729033 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504735947 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504744053 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504746914 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504762888 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504782915 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504859924 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504873991 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504887104 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504892111 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504899025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504904032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504913092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504936934 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504940987 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504956007 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.504956961 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504971981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.504997015 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505029917 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505045891 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505067110 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505079985 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505079985 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505095005 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505117893 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505120039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505127907 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505134106 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505151987 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505155087 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505167961 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505168915 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505187035 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505208015 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505254984 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505269051 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505292892 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505302906 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505305052 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505317926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505347967 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505357981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505445957 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505460024 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505472898 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505486012 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505492926 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505502939 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505511999 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505522966 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505526066 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505539894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505548954 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505556107 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505562067 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505573988 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505583048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505597115 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505599022 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505609989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505625010 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505650043 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505660057 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505673885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505686998 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505697012 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505707026 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505719900 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505733967 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505738020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505748987 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505778074 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505778074 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505793095 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505805969 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505815983 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505820990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505829096 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505840063 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505861044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505875111 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505888939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505918980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505923033 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505934954 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505943060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505966902 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.505970955 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505985022 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.505986929 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506000042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506053925 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506076097 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506091118 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506103039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506114006 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506117105 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506125927 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506141901 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506144047 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506151915 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506160021 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506176949 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506194115 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506198883 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506212950 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506253004 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506270885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506284952 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506306887 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506330013 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506361961 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506376982 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506391048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506407022 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506417036 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506422043 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506458044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506484985 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506499052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506524086 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506536961 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506541014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506552935 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506560087 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506582975 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506598949 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506637096 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506650925 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506664991 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506701946 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506717920 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506731033 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506755114 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506767988 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506781101 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506794930 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506802082 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506803989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506836891 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506844997 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506875992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506953001 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506967068 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.506987095 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.506995916 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507002115 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507019997 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507039070 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507061005 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507076025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507090092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507112980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507122040 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507158995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507174015 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507194996 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507201910 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507208109 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507217884 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507236958 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507251024 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507287979 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507302046 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507348061 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507349968 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507363081 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507380962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507395983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507397890 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507427931 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507468939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507514954 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507531881 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507571936 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507574081 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507590055 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507611036 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507627964 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507669926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507735014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507754087 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507791042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507792950 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507828951 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507838011 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507865906 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507921934 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507936954 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507951975 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507965088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.507977009 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.507992029 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508016109 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508032084 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508069992 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508070946 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508105993 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508120060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508121014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508140087 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508157015 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508167028 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508217096 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508217096 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508255959 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508261919 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508276939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508296967 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508307934 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508378029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508392096 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508408070 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508430004 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508431911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508441925 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508475065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508487940 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508502960 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508527994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508531094 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508569002 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508593082 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508618116 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508631945 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508634090 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508660078 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508707047 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508750916 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508757114 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508794069 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508846045 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508860111 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508872032 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508883953 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508893013 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508909941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508912086 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508927107 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508930922 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508945942 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508960009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.508976936 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.508991003 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509016037 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509026051 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509052992 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509088993 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509090900 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509130955 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509187937 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509203911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509223938 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509238958 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509263992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509267092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509274960 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509304047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509347916 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509366989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509387016 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509408951 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509418964 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509433031 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509457111 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509469032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509470940 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509485960 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509506941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509521008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509524107 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509553909 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509557962 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509591103 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509649038 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509663105 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509694099 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509793997 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509808064 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509826899 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509840965 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509846926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509861946 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509879112 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509893894 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.509975910 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.509990931 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510010004 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510030031 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510067940 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510082006 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510103941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510113001 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510143995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510159969 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510185957 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510196924 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510212898 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510226011 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510247946 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510248899 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510260105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510265112 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510287046 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510298014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510307074 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510324001 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510344028 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510353088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510392904 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510406017 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510432959 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510442972 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510448933 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510463953 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510482073 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510499001 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510502100 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510515928 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510538101 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510552883 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510612965 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510627031 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510646105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510660887 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510768890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510802984 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510806084 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510847092 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510875940 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510890007 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.510912895 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.510921955 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511003971 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511018038 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511030912 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511038065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511044025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511049032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511066914 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511080980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511163950 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511178970 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511193037 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511202097 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511207104 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511214972 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511224985 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511234045 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511246920 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511255980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511267900 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511284113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511287928 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511297941 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511322975 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511332035 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511393070 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511408091 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511429071 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511440039 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511554956 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511579037 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511599064 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511612892 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511651039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511677980 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511688948 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511728048 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511811972 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511826038 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511871099 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.511898041 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511910915 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.511940956 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512001038 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512020111 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512042046 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512051105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512092113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512115002 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512132883 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512155056 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512216091 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512233019 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512249947 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512274027 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512325048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512363911 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512378931 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512414932 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512448072 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512473106 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512487888 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512515068 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512592077 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512604952 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512629032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512636900 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512685061 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512697935 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512717009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512732983 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512737989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512753010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512773037 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512784958 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512876034 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512890100 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512909889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512928009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512960911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512974977 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.512994051 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.512996912 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513011932 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513010025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513037920 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513061047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513096094 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513122082 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513138056 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513158083 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513223886 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513237953 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513253927 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513259888 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513283968 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513320923 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513334990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513350010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513374090 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513381958 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513386011 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513420105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513461113 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513474941 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513494968 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513509035 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513581038 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513618946 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513660908 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513674974 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513696909 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513715029 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513721943 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513761044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513773918 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513812065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513839006 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513854027 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513876915 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513879061 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513887882 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513916016 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.513942957 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.513979912 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514012098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514028072 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514048100 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514056921 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514218092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514231920 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514245033 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514250040 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514261961 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514272928 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514282942 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514286995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514302015 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514322996 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514336109 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514375925 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514390945 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514410973 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514415979 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514431000 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514432907 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514451981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514458895 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514554024 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514569044 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514585018 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514591932 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514600039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514602900 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514614105 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514633894 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514647007 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514679909 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514719009 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514736891 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514775038 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514853001 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514880896 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.514890909 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514921904 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.514998913 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515039921 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515045881 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515083075 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515151024 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515187025 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515188932 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515223980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515242100 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515256882 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515278101 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515285969 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515327930 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515352011 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515369892 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515388966 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515403032 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515417099 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515440941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515450001 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515506983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515523911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515543938 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515563011 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515599966 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515631914 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515639067 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515671015 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515691996 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515729904 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515733004 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515772104 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515785933 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515799999 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515826941 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515892029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515906096 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.515929937 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.515938997 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516108036 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516124010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516149044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516149998 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516159058 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516165018 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516189098 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516196966 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516263008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516278028 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516309023 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516401052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516415119 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516437054 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516455889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516484022 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516498089 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516516924 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516527891 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516572952 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516587973 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516609907 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516622066 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516696930 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516710997 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516727924 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516736031 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516742945 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516751051 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516762972 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516779900 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516833067 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516872883 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.516901016 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.516941071 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517045021 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517060041 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517083883 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517098904 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517116070 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517152071 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517153025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517193079 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517203093 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517240047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517378092 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517416000 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517474890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517497063 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517515898 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517534971 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517630100 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517642975 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517659903 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517678022 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517688990 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517704010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517724037 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517734051 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517770052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517784119 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517802000 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517812014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517822027 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517829895 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517844915 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517868042 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517893076 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517940044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.517950058 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.517987967 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518029928 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518043995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518068075 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518078089 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518213987 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518229008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518255949 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518271923 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518311024 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518325090 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518347025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518357038 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518366098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518381119 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518403053 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518412113 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518472910 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518486977 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518512964 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518528938 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518584967 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518599033 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518620014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518636942 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518752098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518765926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518789053 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518802881 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.518887043 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518902063 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.518934965 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519018888 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519032955 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519057035 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519069910 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519078970 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519114971 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519120932 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519161940 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519201994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519216061 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519233942 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519242048 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519251108 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519269943 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519270897 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519308090 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519361019 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519373894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519404888 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519501925 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519515991 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519532919 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519537926 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519547939 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519561052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519576073 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519601107 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519644022 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519658089 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519681931 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519694090 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519740105 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519778967 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519804001 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519840956 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519889116 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519903898 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.519918919 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.519933939 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520020008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520056963 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520059109 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520096064 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520230055 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520275116 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520297050 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520337105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520374060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520411015 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520459890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520495892 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520571947 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520586014 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520602942 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520617008 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520637989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520652056 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520674944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520683050 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520728111 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520745039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520764112 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520771980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520845890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520860910 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520885944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520885944 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520885944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520900011 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520916939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520920038 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520931959 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520956039 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520956039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520972013 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.520992041 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.520998001 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521013975 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521050930 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521079063 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521091938 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521115065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521126986 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521229982 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521244049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521256924 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521269083 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521270037 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521281004 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521286964 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521300077 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521300077 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521301031 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521327972 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521348000 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521356106 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521370888 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521390915 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521418095 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521420956 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521435976 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521457911 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521461010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521466970 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521476030 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521497011 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521505117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521615028 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521629095 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521651030 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521655083 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521658897 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521668911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521702051 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521707058 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521707058 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521716118 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521756887 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521773100 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521787882 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521810055 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521815062 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521819115 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521830082 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521847010 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521869898 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521877050 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521891117 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521910906 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521924973 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521939993 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521954060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.521975994 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.521984100 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522037983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522052050 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522077084 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522078037 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522078037 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522090912 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522106886 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522113085 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522121906 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522123098 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522145987 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522156000 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522223949 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522238016 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522253036 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522268057 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522272110 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522300005 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522315025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522402048 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522416115 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522428989 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522442102 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522442102 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522455931 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522469044 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522475958 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522475958 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522485971 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522507906 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522526026 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522568941 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522583008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522595882 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522608995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522608995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522620916 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522630930 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522635937 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522649050 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522654057 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522661924 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522667885 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522676945 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522694111 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522706032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522715092 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522753954 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522768021 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522799969 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522849083 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522862911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522886992 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522886992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522897005 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522902012 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522922039 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522938013 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.522955894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522969007 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.522993088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523009062 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523015976 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523035049 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523053885 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523075104 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523189068 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523202896 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523235083 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523252010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523264885 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523292065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523300886 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523348093 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523361921 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523386955 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523391008 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523400068 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523422956 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523443937 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523493052 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523507118 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523520947 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523535013 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523539066 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523540974 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523560047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523581028 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523591995 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523605108 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523624897 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523638010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523638964 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523663998 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523668051 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523675919 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523710966 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523724079 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523756027 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523767948 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523775101 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523794889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523819923 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523845911 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523859978 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523885012 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523886919 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523894072 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523900986 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523930073 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523936033 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.523938894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523952961 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.523976088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524013996 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524046898 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524060011 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524079084 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524085045 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524099112 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524099112 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524120092 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524133921 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524163008 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524171114 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524205923 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524324894 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524339914 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524353027 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524363995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524365902 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524390936 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524410963 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524415970 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524425030 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524446011 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524454117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524502039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524517059 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524530888 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524535894 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524544001 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524549961 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524569988 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524569988 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524674892 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524689913 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524703026 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524707079 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524717093 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524724960 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524734020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524744034 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524754047 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524756908 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524775028 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524794102 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524795055 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524807930 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524825096 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524842978 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524843931 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524857998 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524878979 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524882078 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524888992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524897099 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524914980 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524934053 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.524952888 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.524992943 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.525007010 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.525019884 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.525033951 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.525038004 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.525053978 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.525059938 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.525074959 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.525080919 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.525093079 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.525118113 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532160997 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532185078 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532200098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532213926 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532227039 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532237053 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532243967 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532259941 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532285929 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532298088 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532298088 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532314062 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532340050 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532347918 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532385111 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532390118 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532397985 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532411098 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532434940 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532448053 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532473087 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532476902 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532485008 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532512903 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532525063 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532526970 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532556057 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532568932 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532577038 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532583952 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532608986 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532624006 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532628059 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532640934 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532679081 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532696962 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532711983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532732010 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532737970 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532751083 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532780886 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532784939 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532809019 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532835007 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532855034 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532879114 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532891035 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532922029 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532944918 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.532944918 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532969952 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532993078 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.532999992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533035040 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533045053 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533060074 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533083916 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533092976 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533107042 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533128977 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533139944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533152103 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533164024 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533174992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533174992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533174992 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533193111 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533194065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533194065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533194065 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533200026 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533210993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533210993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533210993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533210993 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533225060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533231020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533231020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533231020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533231020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533243895 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533243895 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533246994 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533257008 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533271074 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533288002 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533294916 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533312082 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533318043 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533334970 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533354044 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533363104 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533385992 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533404112 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533411026 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533428907 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533435106 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533444881 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533461094 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533479929 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533483982 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533500910 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533508062 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533525944 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533531904 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533549070 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533555984 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533576012 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533577919 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533591032 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533617020 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533622980 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533647060 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533658981 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533669949 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533687115 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533693075 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533711910 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533718109 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533731937 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533741951 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533759117 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533770084 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533776999 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533792973 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533812046 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533818007 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533833027 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533840895 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533859015 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533879995 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533885002 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533907890 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533925056 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533931971 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533947945 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533955097 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533972025 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.533977985 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.533996105 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534001112 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534013987 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534024000 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534034014 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534048080 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534065962 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534070969 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534087896 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534094095 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534113884 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534116983 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534127951 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534141064 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534157991 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534168959 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534182072 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534199953 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.534934044 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.534957886 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.535007954 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.535031080 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.535053015 CET	15666	49731	66.63.187.173	192.168.2.4
Jan 9, 2025 17:49:05.535065889 CET	49731	15666	192.168.2.4	66.63.187.173
Jan 9, 2025 17:49:05.535096884 CET	15666	49731	66.63.187.173	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 17:48:59.571378946 CET	192.168.2.4	1.1.1.1	0xde79	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 17:48:59.578412056 CET	1.1.1.1	192.168.2.4	0xde79	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 9, 2025 17:48:59.578412056 CET	1.1.1.1	192.168.2.4	0xde79	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 9, 2025 17:48:59.578412056 CET	1.1.1.1	192.168.2.4	0xde79	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.67.74.152	443	5356	C:\Users\user\Desktop\drop1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 16:49:00 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-01-09 16:49:00 UTC	424	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 16:49:00 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ff5eb0839af7cf6-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2045&min_rtt=2000&rtt_var=782&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=738&delivery_rate=1460000&cwnd=193&unsent_bytes=0&cid=d7e100f336ee6936&ts=201&x=0"
2025-01-09 16:49:00 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	11:48:57
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\drop1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\drop1.exe"
Imagebase:	0x9a0000
File size:	1'293'312 bytes
MD5 hash:	60B0F0816C90A313DE1549890708F848
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:48:57
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:48:58
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\drop1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\drop1.exe"
Imagebase:	0x9a0000
File size:	1'293'312 bytes
MD5 hash:	60B0F0816C90A313DE1549890708F848
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000002.00000002.1893429161.0000000001308000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.9%
Total number of Nodes:	1336
Total number of Limit Nodes:	11

Executed Functions

Function 009BA1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,009BA11B,009BA10B), ref: 009BA33F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 009BA352
Wow64GetThreadContext.KERNEL32(000000A0,00000000), ref: 009BA370
ReadProcessMemory.KERNELBASE(0000009C,?,009BA15F,00000004,00000000), ref: 009BA394
VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 009BA3BF
WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 009BA417
WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 009BA462
WriteProcessMemory.KERNELBASE(0000009C,?,?,00000004,00000000), ref: 009BA4A0
Wow64SetThreadContext.KERNEL32(000000A0,005D0000), ref: 009BA4DC
ResumeThread.KERNELBASE(000000A0), ref: 009BA4EB

Strings

SetThreadContext, xrefs: 009BA2CD
CreateProcessW, xrefs: 009BA25B
Load, xrefs: 009BA1E5
aryA, xrefs: 009BA1ED
ResumeThread, xrefs: 009BA2E3
ReadProcessMemory, xrefs: 009BA294
VirtualAlloc, xrefs: 009BA26E
VirtualAllocEx, xrefs: 009BA2A7
WriteProcessMemory, xrefs: 009BA2BA
GetThreadContext, xrefs: 009BA281
TerminateProcess, xrefs: 009BA3CE
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 009BA33E
GetP, xrefs: 009BA229
ress, xrefs: 009BA231

Memory Dump Source

Source File: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: aba553202450b39f9cdcbf24903983d6fe70be683a71636a562ca45e9e6ba17e
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: F2B1087260024AAFDB60CF68CD80BDA73A5FF88724F158524EA0CAB341D774FA51CB94

Function 009A94CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,EFF5169C,?,009A95DD,?,?,00000000), ref: 009A958F

Strings

api-ms-, xrefs: 009A9525
ext-ms-, xrefs: 009A9539

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction ID: a85474ac283111abf3178413e80806fcab9311c6e02d78736d2aacf71f32731b
Opcode Fuzzy Hash: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction Fuzzy Hash: 1A215035E05211A7C7229B64DC41A6E77ACFB8B7B1F140610FD06A72D1DB70EE01D6D0

Function 009A1930 Relevance: 9.2, APIs: 6, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009A19D0
GetFileSize.KERNEL32 ref: 009A1A01
CloseHandle.KERNEL32 ref: 009A1A1E

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction ID: 01dbf0d9918108c55e6b4145a7798ef981f9bb530ca0a367eb947cb308af8286
Opcode Fuzzy Hash: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction Fuzzy Hash: F481F0B4D0A258DFCB00DFA8D584BAEBBF0BF4A314F104929E455A7381D7789948CF96

Function 009AD525 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 009AD5AA
__alloca_probe_16.LIBCMT ref: 009AD673
__freea.LIBCMT ref: 009AD6DA

Part of subcall function 009AB3B5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,009A3C34,?,?,009A2442,00001000,?,009A23AA), ref: 009AB3E7

__freea.LIBCMT ref: 009AD6ED
__freea.LIBCMT ref: 009AD6FA

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: be25caeff3c76fd51f2c8156eeb3c609f1068380a2843cfded3a49d8a625dc4b
Instruction ID: 274e42a4a04f457c7af23c7a05c44a0231417b70685d8ef8d5a8b197426a4369
Opcode Fuzzy Hash: be25caeff3c76fd51f2c8156eeb3c609f1068380a2843cfded3a49d8a625dc4b
Instruction Fuzzy Hash: 0951C372602246AFEF205F64CC81EBB37ADEF8A714B190529FD0AD6551EB75CC10C6E0

Function 009A17E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 009A1849
VirtualProtect.KERNELBASE ref: 009A18F7

Strings

@, xrefs: 009A18EB

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: 3366da4662ad41591c863ead7e174367602c92419c7a2b47eb059d441977b7ea
Instruction ID: 201863e6c95d973326811e8a48b58f6d2c527140b21287903a36903d71b8e2f5
Opcode Fuzzy Hash: 3366da4662ad41591c863ead7e174367602c92419c7a2b47eb059d441977b7ea
Instruction Fuzzy Hash: AF31B1B0904308DFDB04EFA9D59969EBBF0FF49318F118529E448AB350D7749944CF95

Function 009A67F4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(009A34C0,?,Function_0000690C,00000000,?,009A34C0), ref: 009A683D
GetLastError.KERNEL32(?,00000000,00000000,?,009A3379), ref: 009A6849
__dosmaperr.LIBCMT ref: 009A6850

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 2d876ae943e00324297c0163106d2222dca7846d94199fd4963fd919224f0f30
Instruction ID: 1e3001c5fff246c77931e4d7c7ffb2b6172fd9569bcf3ff62370483b29dcf73c
Opcode Fuzzy Hash: 2d876ae943e00324297c0163106d2222dca7846d94199fd4963fd919224f0f30
Instruction Fuzzy Hash: F2019E72904219EBDF15AFA4CC06AAF7B7DEF82364F144118F90192150DB78C950DBD1

Function 009AA0BA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009AA2BF: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 009AA2EA

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,009AA4CA,?,00000000,?,00000000,?), ref: 009AA11B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,009AA4CA,?,00000000,?,00000000,?), ref: 009AA157

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 136ce0e1a261d644a6376a654c352102283f896b05ddf7125bcf35f93af321ec
Instruction ID: e279b2d9e7e2d517ff6281f25a33d57180a20641fb3fa57d01f0db75f31883f1
Opcode Fuzzy Hash: 136ce0e1a261d644a6376a654c352102283f896b05ddf7125bcf35f93af321ec
Instruction Fuzzy Hash: 93515570A043459FDB21CF75C8857BABBF9EF82310F18846ED4A68B251E7759942CBC2

Function 009A3C1A Relevance: 3.1, APIs: 2, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009A44C7
___raise_securityfailure.LIBCMT ref: 009A45AF

Part of subcall function 009A556E: RaiseException.KERNEL32(E06D7363,00000001,00000003,009A44BB,?,?,?,?,009A44BB,00001000,009B875C,00001000), ref: 009A55CF

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 3749517692-0
Opcode ID: 18dfcbda479b07ca0accd96e8fdcd8443fb145868dbfc8ba1f6d90bc24b8a3ea
Instruction ID: 029790744d08ded9a50211cebb7e375cbbf1f2c34e3e724f6ae11b0c04f385b2
Opcode Fuzzy Hash: 18dfcbda479b07ca0accd96e8fdcd8443fb145868dbfc8ba1f6d90bc24b8a3ea
Instruction Fuzzy Hash: 68315D74528208AFD704DF59FE567497BA8FB59320F108629F9249A2F1EBF09940EB84

Function 009A9EAC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,009A9D9B,009B90B8,0000000C), ref: 009A9EF8
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,009A9D9B,009B90B8,0000000C), ref: 009A9F0A

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 130e339aa17b110fcbfaa4fb18dc644e1ce68b13666d047f75db63b5c36ec788
Instruction ID: 514ecc4adb0175f6cf523d1595d3aaaf817d7344959aecffa6ea40a9ea983d29
Opcode Fuzzy Hash: 130e339aa17b110fcbfaa4fb18dc644e1ce68b13666d047f75db63b5c36ec788
Instruction Fuzzy Hash: D311B1315187414AC7308E3E8C88623BA98BB97370B380B5EE1B6C65F6C734DD86D6C4

Function 009A690C Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(009B8D78,0000000C), ref: 009A691F
ExitThread.KERNEL32 ref: 009A6926

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 6aa2b3cdd0a07e620e0a662088f0a209ae3cb9f5773785d50f4f19aa7038996b
Instruction ID: 35c90710430566f93836189e11a4738c5a6978eefeb8fb0906e57fd9fec00b01
Opcode Fuzzy Hash: 6aa2b3cdd0a07e620e0a662088f0a209ae3cb9f5773785d50f4f19aa7038996b
Instruction Fuzzy Hash: 98F0AF74A582049FDB01AFB0C94AB6E7B78FFC6320F104649F40297292CB349900DBE0

Function 009A9357 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,009AD615,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 009A938B
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,009AD615,?,?,-00000008,?,00000000), ref: 009A93A9

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: e602d6bc9e3aa85e01c3edd9eff7d13649df84d75396ef68a098878b742d2206
Instruction ID: 4cad842d209cc93480a0fbf28ad87a823eb3fd9d37596372d2fb433db5198c4a
Opcode Fuzzy Hash: e602d6bc9e3aa85e01c3edd9eff7d13649df84d75396ef68a098878b742d2206
Instruction Fuzzy Hash: 9AF0283240511ABBCF126F90DD09ADE7E66BF897A0B058510FA1965160CA36C971AB90

Function 009AA83B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,009AB3A9,?,00000000,?,?,009AB2C5,?,00000007,?,?,009AB8DE,?,?), ref: 009AA851
GetLastError.KERNEL32(?,?,009AB3A9,?,00000000,?,?,009AB2C5,?,00000007,?,?,009AB8DE,?,?), ref: 009AA85C

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8eb9401049f7ab4e3c22a75b1d2a003b71f2246fe8d72125b3e412f7e09e552b
Instruction ID: 73eb7f728ab23abde04a720a7dbf142874140e3fecec19758da5b6b5d04242bc
Opcode Fuzzy Hash: 8eb9401049f7ab4e3c22a75b1d2a003b71f2246fe8d72125b3e412f7e09e552b
Instruction Fuzzy Hash: 05E08C32108204ABCB112FE4ED09B9A3A6CEB853A5F100021F608A6060CB78C950D7CA

Function 009AA649 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,009AA4CA,?), ref: 009AA67B

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 93f617ad8351819b41dd0c329ba238b0563d6bd2c794dbeb3ddd1f897e008b0e
Instruction ID: 7fa1ce8094873295afdbbbd327a72ef4cf61cf3914719680bd6d5486ca0f5f1f
Opcode Fuzzy Hash: 93f617ad8351819b41dd0c329ba238b0563d6bd2c794dbeb3ddd1f897e008b0e
Instruction Fuzzy Hash: 565139B1908158AFDB118F28CD84BEABBBCEB57300F1405E9E499C7182D3359E45DFA1

Function 009A32D0 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009A33B3

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 842316b09da73e2cb9295805de4fc644ef262b1b8d3d846644279b23c2e55411
Instruction ID: c1424dccda464e555cc5cdc51eea3138218b7d8e5e8d092bae5e2555550030ed
Opcode Fuzzy Hash: 842316b09da73e2cb9295805de4fc644ef262b1b8d3d846644279b23c2e55411
Instruction Fuzzy Hash: B731B2B59112089FCB04DFA8C545B9EFBF0FB4A314F10C56AE819AB351D7759A04CFA1

Function 009A9599 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba143aa04d08f6e868f59c081e54b62f987e86bce2c2834706461eecc24d0ab
Instruction ID: 426d6600f848bf76fa7e9d075905370aaf824e59c381b8834be471e2396473c4
Opcode Fuzzy Hash: 0ba143aa04d08f6e868f59c081e54b62f987e86bce2c2834706461eecc24d0ab
Instruction Fuzzy Hash: E1012833A28214AF8B128F68ED91A1A33A9FBC67303394224F901C7098DF30D800D7C5

Function 009AB3B5 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,009A3C34,?,?,009A2442,00001000,?,009A23AA), ref: 009AB3E7

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8a8e7ff4748bbb642bd1f9c3b7f57c4f071f98e388cfc032c974a3f9bb7f07c0
Instruction ID: b5f5f83da4b7381b7ba5a5dee8f068ff108fe3a4f37b81e7517247fa00add110
Opcode Fuzzy Hash: 8a8e7ff4748bbb642bd1f9c3b7f57c4f071f98e388cfc032c974a3f9bb7f07c0
Instruction Fuzzy Hash: 14E06D3120A625A7DF213B769D02BAB7A4CEF833B0F150560AE459A1D2DFA8CC0082E1

Function 009A17A0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 009A17D5

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 45137b88dff520a9ab5897397a588b9e65709846456d2a510d0fd0e4a8219326
Instruction ID: 73edb055628724b9f792a8733d133aac82557b9b173b3e54fb99d7646543a1ed
Opcode Fuzzy Hash: 45137b88dff520a9ab5897397a588b9e65709846456d2a510d0fd0e4a8219326
Instruction Fuzzy Hash: A2E0C230A18208ABD300EF79CC0479A7BE4EF4A320F418038E988CB344DA34E8408796

Non-executed Functions

Function 009ABF4B Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009AC03B

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 4c9102af5bfc20c85b56e6cca22f084281f4f2287bc2bf131e62df7cd2a5d273
Instruction ID: 361cf21a114be61aae24ad28b791fd7dfc5b1c57f930a5884e0693c4a4243192
Opcode Fuzzy Hash: 4c9102af5bfc20c85b56e6cca22f084281f4f2287bc2bf131e62df7cd2a5d273
Instruction Fuzzy Hash: E571D8B19091689FDF20AF28CC8DABEB7B9EF46304F1441D9E40DA7252DB354E859F90

Function 009A5027 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 009A5033
IsDebuggerPresent.KERNEL32 ref: 009A50FF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009A5118
UnhandledExceptionFilter.KERNEL32(?), ref: 009A5122

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 07a1f03c9ba84d87ace61368335bc5fe2bc0c396918eded940e1d64fc633ea95
Instruction ID: 322b30c106090feb4ba349b24dafb1523542fb2f956019d2a8b9c0bc2d5c8015
Opcode Fuzzy Hash: 07a1f03c9ba84d87ace61368335bc5fe2bc0c396918eded940e1d64fc633ea95
Instruction Fuzzy Hash: 38312975D05218DBDF20EFA4D9497CDBBB8BF08300F1041AAE40CAB250EB709A84CF85

Function 009A78CC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 009A79C4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 009A79CE
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 009A79DB

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bd38d527c8e62e891740035053cd47ce91f4d3930fda4331cfa7d1552e3c378e
Instruction ID: 2fa09dd8cd3c8485fb0552213996473a70a752ef7644b4b98d5fb15250a345d5
Opcode Fuzzy Hash: bd38d527c8e62e891740035053cd47ce91f4d3930fda4331cfa7d1552e3c378e
Instruction Fuzzy Hash: 9931D3749012199BCB61DF64DD89B8DBBB8BF48310F5042EAE41CA6250EB709B858F45

Function 009A48D3 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,009A4844,?,?,?,?,009A4868,000000FF,?,?,?,009A4780,00000000), ref: 009A490B
GetSystemTimeAsFileTime.KERNEL32(?,EFF5169C,?,?,009B1B3D,000000FF,?,009A4844,?,?,?,?,009A4868,000000FF,?), ref: 009A490F

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: cef6daea4f57ec4a42ea7d921f674ee55bb3c774785b98b0e37271350c15076d
Instruction ID: 1e965eebcc0eda7302fcb39feb3e4f57a7ccdded04f9d3608a0d95c3924dcd40
Opcode Fuzzy Hash: cef6daea4f57ec4a42ea7d921f674ee55bb3c774785b98b0e37271350c15076d
Instruction Fuzzy Hash: 26F0A07291C558EFCB019F44DD40B9AB7A8FB89F30F00472AE81293290DBB469009A80

Function 009B1542 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009B149D,?,?,00000008,?,?,009B106F,00000000), ref: 009B176F

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7fa87736b37089d49c70f2615b57555682a49e7427471b5295ae04bc722592fc
Instruction ID: c35a8b3a686a25476e146a2f068a68e81de44d8d759d22bbceaeec47b51a572d
Opcode Fuzzy Hash: 7fa87736b37089d49c70f2615b57555682a49e7427471b5295ae04bc722592fc
Instruction Fuzzy Hash: A5B17E31610608DFD719CF28C59ABA47BE0FF45364F69865CE89ACF2A1C735D992CB40

Function 009A5235 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009A524B

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c781cc53eab90a83bd73c58f60cbec986851fd2133e2ce4b508c2a9835cdc374
Instruction ID: df1cf6e6ba1017b9755f8f59eed6cc1daf664062aac89684631d62d322885c3f
Opcode Fuzzy Hash: c781cc53eab90a83bd73c58f60cbec986851fd2133e2ce4b508c2a9835cdc374
Instruction Fuzzy Hash: E1A1B1B1E25604CFDB19CF59EA89299BBF5FB49330F19822AD419E73A0D3749840CF91

Function 009ABE9A Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009AAF77: HeapAlloc.KERNEL32(00000008,?,?,?,009A97D4,00000001,00000364,?,00000002,000000FF,?,009A6931,009B8D78,0000000C), ref: 009AAFB8

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009AC03B
FindNextFileW.KERNEL32(00000000,?), ref: 009AC12F
FindClose.KERNEL32(00000000), ref: 009AC16E
FindClose.KERNEL32(00000000), ref: 009AC1A1

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: e1ac476da1c96a9b1f2ce3497cf0db6c2f005c2d6169bc2e8e85568ce60cfd0d
Instruction ID: 9a9bbd830bedca2ee9a3d7f61e716d1205a0e60780ea6e1785d20283409fd159
Opcode Fuzzy Hash: e1ac476da1c96a9b1f2ce3497cf0db6c2f005c2d6169bc2e8e85568ce60cfd0d
Instruction Fuzzy Hash: 52513975904118AFDF24AF289C85AFEB7ADDF87354F284199F41997202EB308D429FE0

Function 009A501B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000513C,009A4ACD), ref: 009A5020

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ddda61707dc807ae78a08d0cac42aa7c806b9a24a5f75ba729d6dffbbe3af3ec
Instruction ID: cddc9908a9bf00e25f628a35dd8185046de524e1ab33abd478eb7ead5c4e8579
Opcode Fuzzy Hash: ddda61707dc807ae78a08d0cac42aa7c806b9a24a5f75ba729d6dffbbe3af3ec
Instruction Fuzzy Hash:

Function 009A9726 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 009A9726

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 59d98c05383cdda0de75be7570194aa4639b16de44d16586c17b254b83542b06
Instruction ID: d33ca6a5e0bfe99cadc899763ecf8e49da88ffc2dd4a63d63bab38074a5619da
Opcode Fuzzy Hash: 59d98c05383cdda0de75be7570194aa4639b16de44d16586c17b254b83542b06
Instruction Fuzzy Hash: 62A0113022A2008B83008F30AF0822A3BA8AA882E03080228A008C02A0EB388088BA00

Function 009A1000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de833190065c281e4c59c4b97fc940f557d3fffbfb6dbd4246990f0bf234e24
Instruction ID: 61c23a42e0a4c70f97472f71b195e2905685b2013adfba454fd70ad84df8593e
Opcode Fuzzy Hash: 0de833190065c281e4c59c4b97fc940f557d3fffbfb6dbd4246990f0bf234e24
Instruction Fuzzy Hash: 9B519CB4D0421D9FCB40CFA8C591AEEBBF4EB49350F24845AE415FB310D734AA41CBA5

Function 009A1770 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8820505454afb2c4dbda9d98820f600b461d38d1dc6edc1ad5d484576f57d8
Instruction ID: f64957d39cd97ebaa91e780d50ee7ad9df96e537e2e63e727d1d93187ac7130a
Opcode Fuzzy Hash: ae8820505454afb2c4dbda9d98820f600b461d38d1dc6edc1ad5d484576f57d8
Instruction Fuzzy Hash: 9DD0927A655A58EFC610DF49E440D41F7B8FB8DA70B168166EA0893B20C331FC11CAE0

Function 009AF878 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00B70530,00B70530,00000000,7FFFFFFF,?,009AF863,00B70530,00B70530,00000000,00B70530,?,?,?,?,00B70530,00000000), ref: 009AF91E
__alloca_probe_16.LIBCMT ref: 009AF9D9
__alloca_probe_16.LIBCMT ref: 009AFA68
__freea.LIBCMT ref: 009AFAB3
__freea.LIBCMT ref: 009AFAB9
__freea.LIBCMT ref: 009AFAEF
__freea.LIBCMT ref: 009AFAF5
__freea.LIBCMT ref: 009AFB05

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8b247963671dc457030f398971ed3b4e6c9161701d92ba7c5fd4e74df975e9ba
Instruction ID: 30098e30e494c8bad2174f3113632eeb4d6fe41f97203ac291abca1d767197d7
Opcode Fuzzy Hash: 8b247963671dc457030f398971ed3b4e6c9161701d92ba7c5fd4e74df975e9ba
Instruction Fuzzy Hash: B871A372A002066BDF209BD4CC71BEF77BD9F8B314F294465E959A7282E7359C0087E0

Function 009A5C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009A5CB7
___except_validate_context_record.LIBVCRUNTIME ref: 009A5CBF
_ValidateLocalCookies.LIBCMT ref: 009A5D48
__IsNonwritableInCurrentImage.LIBCMT ref: 009A5D73
_ValidateLocalCookies.LIBCMT ref: 009A5DC8

Strings

csm, xrefs: 009A5D5D

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 84de25382fdff9bc768f5ef44ec691e27ee6db108f70e7680c5203d6dcd08c45
Instruction ID: 461fd20b615458a13ebcc93630798c4ef1ff6a66eb2ccec7fcca31495f361113
Opcode Fuzzy Hash: 84de25382fdff9bc768f5ef44ec691e27ee6db108f70e7680c5203d6dcd08c45
Instruction Fuzzy Hash: 7441B334A00619EBCF10DF68C888A9EBBB5FF86324F158155E8149B392D731AE41CBD1

Function 009A489F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 009A48A5
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 009A48B3
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 009A48C4

Strings

GetTempPath2W, xrefs: 009A48B9
kernel32.dll, xrefs: 009A48A0
GetSystemTimePreciseAsFileTime, xrefs: 009A48AD

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction ID: b34c87e8097b9f3c3ee6df09a95954731a0815f6fec601da13503c03224605d2
Opcode Fuzzy Hash: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction Fuzzy Hash: 80D09E316AA620AF8350AF747F0D8DB7EA9EB496B53064216F511E2261DBB44504DB90

Function 009A7F49 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009A7F40,009A5A6B,009A5180), ref: 009A7F57
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009A7F65
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009A7F7E
SetLastError.KERNEL32(00000000,009A7F40,009A5A6B,009A5180), ref: 009A7FD0

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3928c1046ab0db9c52f6bc9df5bd9df68d59ddccb5fa94073e3d2cb5f72471e7
Instruction ID: 0347aee122adfd4ccf86276ea0daabdae4a8c1a56758d8923d5243ba4a158e74
Opcode Fuzzy Hash: 3928c1046ab0db9c52f6bc9df5bd9df68d59ddccb5fa94073e3d2cb5f72471e7
Instruction Fuzzy Hash: D701F77251D2127EE61527F4ADCBA67BBACDB877B47200339F410450F0EF114C02A1D0

Function 009A87D9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009A88F8
CallUnexpected.LIBVCRUNTIME ref: 009A8B71

Strings

csm, xrefs: 009A8883
csm, xrefs: 009A892F
csm, xrefs: 009A8816

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 4a72702d4310071c175c1b7991267e06501531079fc49fc026ef44c3859a9272
Instruction ID: 40b251a1df3fc350a080cf0c510fc48fb691ece20f5d9b8013d5b25cd9ef1f62
Opcode Fuzzy Hash: 4a72702d4310071c175c1b7991267e06501531079fc49fc026ef44c3859a9272
Instruction Fuzzy Hash: F4B16B71800209EFCF18DFA4C881AAFBBB9FF86310F55455AE8116B212DB35DA51CBE1

Function 009AC2C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\drop1.exe, xrefs: 009AC2E0

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\drop1.exe
API String ID: 0-3875088153
Opcode ID: 0a05f609badd52dc5240a1e9a41d75fea421e49b3c09078c830089d5689ddea5
Instruction ID: 05507d55ab378ad77012b7e0a0c70fbd9d7593f76e689c04475c192514aa4026
Opcode Fuzzy Hash: 0a05f609badd52dc5240a1e9a41d75fea421e49b3c09078c830089d5689ddea5
Instruction Fuzzy Hash: 8C216DB1604205AFDF20AFB5C881A6B77ADAF463687108A15F929EB151DB35EC40CBE1

Function 009A6A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,EFF5169C,?,?,00000000,009B1B77,000000FF,?,009A6B21,00000002,?,009A6BBD,009A7DE9), ref: 009A6A95
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009A6AA7
FreeLibrary.KERNEL32(00000000,?,?,00000000,009B1B77,000000FF,?,009A6B21,00000002,?,009A6BBD,009A7DE9), ref: 009A6AC9

Strings

CorExitProcess, xrefs: 009A6A9F
mscoree.dll, xrefs: 009A6A8E

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction ID: c90c5b911599311d384dfbf4fb694a9f234e078919072ae645309173d3991b86
Opcode Fuzzy Hash: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction Fuzzy Hash: B3018431958519EBCB119F80CD05FBEB7BCFB48B64F084625A811A2290DB749804CA84

Function 009A46F6 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009A470A
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4729
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4757
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47B2
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47C9

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 621655cd93056934d67174f84aa8f6b1c5cf74be6eac924badd68353f50ab94e
Instruction ID: 3ca6a88fedcde88c12fcad319cb7f3d8516d2de825da09f77564b99f192a8789
Opcode Fuzzy Hash: 621655cd93056934d67174f84aa8f6b1c5cf74be6eac924badd68353f50ab94e
Instruction Fuzzy Hash: 51414A30910686DFCB20DF69D984AAAB3F9FF87310B504A2AD45697A40D7B4F944CFD1

Function 009AD200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748), ref: 009AD20D
GetLastError.KERNEL32(?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748,00000000,?,009A8E2C), ref: 009AD217
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009AD23F

Strings

api-ms-, xrefs: 009AD224

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction ID: d79eb59beefabec8c9a5e5fc1b309fdebffbf904ceb2f1ce7c05f0f86d008f97
Opcode Fuzzy Hash: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction Fuzzy Hash: 75E0D870298204B7DF112F50DC06FA93F6C9B85BA0F140020FD0DE44E1DB71E995D5C0

Function 009ADCA8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(EFF5169C,00000000,00000000,?), ref: 009ADD0B

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009ADF5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009ADFA3
GetLastError.KERNEL32 ref: 009AE046

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 71f5ac62476ce1d6fb3d90b754c54030c2f9b189a90062fcebf77ea2fda14e7d
Instruction ID: ab360b0bec38862491303f8b94eb5905db546f83b05f4926d5eec648f4170ce5
Opcode Fuzzy Hash: 71f5ac62476ce1d6fb3d90b754c54030c2f9b189a90062fcebf77ea2fda14e7d
Instruction Fuzzy Hash: 20D1AF75D042589FCF14CFA8C9809EDBBB9FF4A314F28452AE416EB751D730A942CB90

Function 009A8500 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009A85C7
___AdjustPointer.LIBCMT ref: 009A85EA
___AdjustPointer.LIBCMT ref: 009A8686

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9f4434b05531692d1851ead5088034e89c00f9ec6c880990a3e6f45d73c0a6e9
Instruction ID: 64eb0d958b18bc1c6ef1e9a5ab8750c24b95537435cdfc67330fac35c1d6284f
Opcode Fuzzy Hash: 9f4434b05531692d1851ead5088034e89c00f9ec6c880990a3e6f45d73c0a6e9
Instruction Fuzzy Hash: AB51E272A05606AFEB298F54D941BBB77A8FF46310F15456DEC02972A1EB31EC50CBD0

Function 009ABD28 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,009AC0CE,?,?,?,00000000), ref: 009ABD8C
__dosmaperr.LIBCMT ref: 009ABD93
GetLastError.KERNEL32(00000000,009AC0CE,?,?,00000000,?,?,?,00000000,00000000,?,009AC0CE,?,?,?,00000000), ref: 009ABDCD
__dosmaperr.LIBCMT ref: 009ABDD4

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f05f385384b0de71ebd2d610496399c1b4d85874f241a30bfc415241a960314e
Instruction ID: eccb56bab440cbaf77b51c30396320524af657333288217487c52a5cea59894d
Opcode Fuzzy Hash: f05f385384b0de71ebd2d610496399c1b4d85874f241a30bfc415241a960314e
Instruction Fuzzy Hash: AF21A4B1600206BFDB20AF66C881E6BB7ADFF463687118919F81997192D734EC40DBD1

Function 009AC99D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009AC9A5

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9FD

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: af4c3897fe8b515ce2c431340ef3e668c8ac88aa3d17d6eda54dc436fcfdd1e6
Instruction ID: 349e1d20f2aeed0942e84ce737000675205ba597ec21927584cdadd0c8e2ab8b
Opcode Fuzzy Hash: af4c3897fe8b515ce2c431340ef3e668c8ac88aa3d17d6eda54dc436fcfdd1e6
Instruction Fuzzy Hash: F31104F5915219BF6611A7B59C8DCBF695CDEDB3A43110124F401E9200EA28CD0291F1

Function 009A1E00 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009A1E2D
GetCurrentThreadId.KERNEL32 ref: 009A1E3B
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E54
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E93

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: d712e8c894e125d99cee007e307dbcadc6ddf9f1cbb911202c22b7d4c8661dc4
Instruction ID: e28c2aeaaf5c3a040c85ecc6c965378effdf32fa309211f74cfd85a1637c5f8b
Opcode Fuzzy Hash: d712e8c894e125d99cee007e307dbcadc6ddf9f1cbb911202c22b7d4c8661dc4
Instruction Fuzzy Hash: 3121E4B0E042098FCB04EFA8C5857AEBBF5EF89300F11845DE849AB351D7389A41CF91

Function 009AFD00 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000), ref: 009AFD17
GetLastError.KERNEL32(?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?,?,009AD9E0,00000000), ref: 009AFD23

Part of subcall function 009AFD74: CloseHandle.KERNEL32(FFFFFFFE,009AFD33,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?), ref: 009AFD84

___initconout.LIBCMT ref: 009AFD33

Part of subcall function 009AFD55: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009AFCF1,009AF48E,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD68

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD48

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction ID: d5653beaa3dc4be1b3262693e083b589b4e8550667f4f386525d479a7ba7cda1
Opcode Fuzzy Hash: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction Fuzzy Hash: C0F01C36414116BBCF232FD1DD08A8A3F6AFB493B1B004220FA0985570DB32C860EBD1

Function 009A4F01 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009A4F13
GetCurrentThreadId.KERNEL32 ref: 009A4F22
GetCurrentProcessId.KERNEL32 ref: 009A4F2B
QueryPerformanceCounter.KERNEL32(?), ref: 009A4F38

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction ID: 249e697ac7c80175cdc73755d8fdc4735cdd91e78fe27fa41fa217d7d6f19e67
Opcode Fuzzy Hash: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction Fuzzy Hash: 9CF06774D1420DEBCB00EBB4DA49ADFB7F8FF1D254B514A95A412E7110EB30A748EB51

Function 009A8BFD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,009A8AFE,?,?,00000000,00000000,00000000,?), ref: 009A8C22

Strings

RCC, xrefs: 009A8C3C
MOC, xrefs: 009A8C34

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 506913a0be1e3cf64139a302bef5eee10b0f706d4473a170e38788dee1134567
Instruction ID: 390a7c09216b659692ea9dda0a0bb16a51e3ea6b253e92099ff5ed3820b8f932
Opcode Fuzzy Hash: 506913a0be1e3cf64139a302bef5eee10b0f706d4473a170e38788dee1134567
Instruction Fuzzy Hash: 8A41AB71900209AFCF15CF94CD81AEEBBBAFF49310F144168F90467291D7359A50CFA0

Function 009A8469 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009A86E0

Strings

csm, xrefs: 009A8773
csm, xrefs: 009A8702

Memory Dump Source

Source File: 00000000.00000002.1671436384.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1671419234.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671459949.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671508297.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671571670.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671605135.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671628002.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_drop1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction ID: e5eb7fef57c388b1591a1162c3e1c9b1a461c8bec64cc51ab6a3ef1869e36f37
Opcode Fuzzy Hash: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction Fuzzy Hash: 7831C436400219DFCF268F50CC449ABBBAAFF4A365B38455AF85449221DB36CCA1DFD1

Analysis Process: drop1.exePID: 5356, Parent PID: 4340COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.6%
Total number of Nodes:	1703
Total number of Limit Nodes:	90

Executed Functions

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 00485F72
GetSystemMetrics.USER32(0000004D), ref: 00485F7C
GetSystemMetrics.USER32(0000004E), ref: 00485F86
GetSystemMetrics.USER32(0000004F), ref: 00485F90
GetDC.USER32(00000000), ref: 00485F9A
GetDeviceCaps.GDI32(00000000,00000008), ref: 00485FAF
GetDeviceCaps.GDI32(?,0000000A), ref: 00485FBB
CreateCompatibleDC.GDI32(?), ref: 00485FC5
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 00485FDA
SelectObject.GDI32(?,00000000), ref: 00485FEE
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,40CC0020), ref: 0048601D
SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 0048604F
DeleteDC.GDI32(?), ref: 0048606E
ReleaseDC.USER32(00000000,?), ref: 00486077
DeleteObject.GDI32(?), ref: 00486083
IStream_Size.SHLWAPI(?,?,?), ref: 004860F5
IStream_Reset.SHLWAPI(?), ref: 00486104
IStream_Read.SHLWAPI(?,00000000,?,?), ref: 0048611E
DeleteDC.GDI32(?), ref: 00486175
ReleaseDC.USER32(00000000,?), ref: 00486183
DeleteObject.GDI32(?), ref: 0048618F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Delete$CreateMetricsObjectStream_System$CapsCompatibleDeviceRelease$BitmapCallbackDispatcherReadResetSelectSizeStreamUser
String ID:
API String ID: 2798906502-0
Opcode ID: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction ID: 1540f068b23de5c11a4fec01122546931e44dbb37a8a944e45ab45a1281bc334
Opcode Fuzzy Hash: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction Fuzzy Hash: F4812971C01218AFDB11EB64DC49BEDBBB8EF09314F1041AAE509B7291DB742E84CF99

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000000,00000348,00000001), ref: 00486A68
Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000001), ref: 00486ABD

Part of subcall function 004868B0: RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Part of subcall function 004863F0: GetUserNameW.ADVAPI32(?,?), ref: 00486464

Part of subcall function 004864E0: GetComputerNameW.KERNEL32(?,?), ref: 00486554

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044BAD0: Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

GlobalMemoryStatusEx.KERNEL32(?,00000003), ref: 00488A6C
GetDesktopWindow.USER32 ref: 0048936A
GetWindowRect.USER32(00000000), ref: 00489371
_strftime.LIBCMT ref: 0048956B
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,system,00000006), ref: 0048979A

Strings

system, xrefs: 004884CA, 00488633, 0048879C, 00488905, 00488A9E, 00488BDF, 00488D48, 00488F88, 004891A9, 00489507, 00489681, 00489933, 00489A78, 00489C87
computer_name, xrefs: 00488CBE
ram, xrefs: 00488B55
user_name, xrefs: 004885A6
cpu, xrefs: 0048887B
time, xrefs: 004895E2
>wfw, xrefs: 0048920B
gpu, xrefs: 00488712
%d-%m-%Y, %H:%M:%S, xrefs: 00489560
timezone, xrefs: 004899BF

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Name$Concurrency::cancel_current_taskDevicesDisplayEnumWindow$ComputerDesktopFileGlobalMemoryModuleRectStatusUserValue_strftime
String ID: %d-%m-%Y, %H:%M:%S$>wfw$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 3994675093-2215247992
Opcode ID: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction ID: 1ab1bce1cb2369babe93dc2c843a9f66333b387f055d73d8335e63cf3a34051b
Opcode Fuzzy Hash: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction Fuzzy Hash: FC037970C052A99BDB26DF28C8547DDBBB1AF19308F2482DEE44867242DB751F85CF92

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,A3776857), ref: 0047E2A3
OpenProcessToken.ADVAPI32(00000000), ref: 0047E2AA
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 0047E2CE
CloseHandle.KERNEL32(00000000), ref: 0047E2F3
ExitProcess.KERNEL32 ref: 0047E32D
OpenMutexA.KERNEL32(001F0001,00000000,?), ref: 0047E411
ExitProcess.KERNEL32 ref: 0047E420
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 0047E436
ExitProcess.KERNEL32 ref: 0047E457
ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Strings

SeDebugPrivilege, xrefs: 0047E337
SeImpersonatePrivilege, xrefs: 0047E341

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process$ExitMutex$CloseHandleOpenToken$CreateCurrentInformationRelease
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 1905835197-3768118664
Opcode ID: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction ID: e600725b129d9e3f70f3f4d3925b8df88ff981f4a24a656009bcaac003b6a44b
Opcode Fuzzy Hash: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction Fuzzy Hash: 80817F70D01258EFDB00EFE6D9457DDBBB4EF08308F10815EE51AA7281DB785A05DB69

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,A3776857), ref: 004464FE
GetProcAddress.KERNEL32(00000000,?), ref: 0044664C
GetProcAddress.KERNEL32(?,?), ref: 0044678C
GetProcAddress.KERNEL32(?,?), ref: 00446831
GetProcAddress.KERNEL32(?,?), ref: 004468D6
GetProcAddress.KERNEL32(?,?), ref: 0044697B
GetProcAddress.KERNEL32(?,?), ref: 00446A27
FreeLibrary.KERNEL32(00000000), ref: 004473A1

Strings

system, xrefs: 004471E6
vault, xrefs: 00447225
!F, xrefs: 00446482

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: system$vault$!F
API String ID: 2449869053-2452413646
Opcode ID: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction ID: b3fd50756066dde9c2bcdca3b11f87412f5b17b86e41c1a20d378922be8368ac
Opcode Fuzzy Hash: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction Fuzzy Hash: 2CA2DFB4D0426D8BDB25CFA8C884BEEBBB1BF59304F1081DAD948B7251DB385A85CF54

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00485AB8
InternetOpenUrlA.WININET(00000000,?,?,00000000,84880100,00000000), ref: 00485B23
HttpQueryInfoW.WININET(00000000,00000013,?,?,00000000), ref: 00485B7C
HttpQueryInfoW.WININET(00000000,00000005,?,00000040,00000000), ref: 00485C0D
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 00485C4F
InternetReadFile.WININET(00000000,00000000,?,0B911A77), ref: 00485CE0
InternetCloseHandle.WININET(00000000), ref: 00485DEE

Strings

dk{u, xrefs: 004858C5

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Internet$Query$HttpInfoOpen$AvailableCloseDataFileHandleRead
String ID: dk{u
API String ID: 1359475806-1025949191
Opcode ID: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction ID: 61ea4010c365d261526b7633df9a1f3866779007c1279ae13805143fd257e1b9
Opcode Fuzzy Hash: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction Fuzzy Hash: 320203B0D057599BDB20CFA4C944BDDBBB5BF19304F20819AE848BB241EB746A84CF95

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000001,?,?), ref: 004B85DD
GetLastError.KERNEL32 ref: 004B85E7
FindFirstFileW.KERNEL32(000000FF,?), ref: 004B85FE
GetLastError.KERNEL32 ref: 004B8609
FindClose.KERNEL32(00000000), ref: 004B8615
___std_fs_open_handle@16.LIBCPMT ref: 004B86CE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction ID: b482ff722bd6c6e5562e69f300935f677b27db246a655513dfd80cbad8c50a56
Opcode Fuzzy Hash: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction Fuzzy Hash: 6271A174A01619AFCB60CF28DC84BEAB7B8BF15314F24466AE854E3380DF389D41CB65

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,A3776857,A3776857,00000000,00000000), ref: 0048CBC1
OpenProcessToken.ADVAPI32(00000000), ref: 0048CBC8
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0048CBDF
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0048CC10
CloseHandle.KERNEL32(00000000), ref: 0048CC2E

Strings

SeDebugPrivilege, xrefs: 0048CBD9

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction ID: c2b5bf8999928723eaabf61e86e1a0babf1022b92d12b441156265fc3f808218
Opcode Fuzzy Hash: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction Fuzzy Hash: 4631A471D01208AFDB10DFA5DD85BEEBBB8EB09710F14422BE911B7280DB745A44CBB5

Function 004473D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 301processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,A3776857), ref: 0044741C
Process32FirstW.KERNEL32(00000000,?), ref: 00447468
Process32NextW.KERNEL32(?,0000022C), ref: 004475CD
CloseHandle.KERNEL32(?), ref: 004478D2

Strings

[PID: , xrefs: 004474B1

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: cefa39f860a061b5cdc928b49f93e6ea5fa11b751c85222641e7e19468bf29e5
Instruction ID: 3632983ffbfa210010dfb9a713b5006bf5dbac80d679a8e5b8b4f374b17b9b69
Opcode Fuzzy Hash: cefa39f860a061b5cdc928b49f93e6ea5fa11b751c85222641e7e19468bf29e5
Instruction Fuzzy Hash: 0AE14770D112689BDB2ADF24CC807AEBBB9BF59304F1481D9E84867251DB346F89CF45

Function 004402D0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 004403C0
FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Strings

content, xrefs: 0044063C
filename, xrefs: 004405E4

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$filename
API String ID: 1690352074-474635906
Opcode ID: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction ID: 3fd07a7a2c97014430c74f1e6d5836f1a3ad12268408335d8deab24a75892f91
Opcode Fuzzy Hash: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction Fuzzy Hash: 2BD1D430D01249DBEB15EB64CD457EEBBB4AF21308F1440AEE505A7292DB785F48CB96

Function 00485350 Relevance: 6.3, APIs: 4, Instructions: 316networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00002000,00000000), ref: 004854A4
recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(0000025C), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction ID: ea48c0c3f42896101b1dfecbe024c21eb3956ad5c3a4809403442742827d540a
Opcode Fuzzy Hash: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction Fuzzy Hash: 4CE19C70D01298DEDB14EB64CC49BDEBBB2BF14308F1041DAE449AB292DB745E88DF95

Function 00487780 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 515timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,A3776857,00000000,000000BF), ref: 00487C87

Strings

[UTC, xrefs: 00487C45
@Zb=, xrefs: 00487A4F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: @Zb=$[UTC
API String ID: 565725191-730387550
Opcode ID: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction ID: 6d71337f0f8cf227c7c56c381cd8fae4285dcd83216f0cb77706b7edbf0b928b
Opcode Fuzzy Hash: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction Fuzzy Hash: E0520270D052688BDB25CF28CC947DDBBB1BF59304F1082DAD949AB281DB756B85CF84

Function 004A1074 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049C0BD: RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
Part of subcall function 0049C0BD: GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Summer Time, xrefs: 004A1193
Eastern Standard Time, xrefs: 004A117F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction ID: 53762b2ebd1cb462dfa51e434dc7c6f7f2cc61e8d19f93444a713380c049c16d
Opcode Fuzzy Hash: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction Fuzzy Hash: 73410871C00224ABDB10AF76DC45A9F7BB8EF6A754F10415BF510EB2A1E7349D04DB98

Function 004B84C0 Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,A3776857,00000001), ref: 004B84CC
FindFirstFileExW.KERNEL32(000000FF,00000001,A3776857,00000000,00000000,00000000,00000001,00000001,?,?,004B84EE,00000001,?,?,00437D69,?), ref: 004B84FB
GetLastError.KERNEL32(?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,A3776857,00000001), ref: 004B850D

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction ID: a5a0d7868366c0cca89b591e166bcddb9b03d08ebbd2c2fb18ba3c3c76c3338f
Opcode Fuzzy Hash: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction Fuzzy Hash: 0AF03071001109BFDB216FA4EC08AAA7B9DEB14360B10862ABD28C55A0EA359961DB79

Function 004479C0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 647COMMON

Download Yara Rule

APIs

Part of subcall function 00487290: RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,A3776857,?,0051C288), ref: 0048735B
Part of subcall function 00487290: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,A3776857,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004487A3

Part of subcall function 004870B0: RegCloseKey.ADVAPI32(00000000), ref: 00487260

Strings

0hC, xrefs: 00448799

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Open$CloseEnumIos_base_dtorQueryValuestd::ios_base::_
String ID: 0hC
API String ID: 3553622603-2581318919
Opcode ID: ade7bf363ed15e6875cf1af1c8a60079e7d2754fd8a921585c80e4634e37238f
Instruction ID: d381e0b8d15ce89c3a027b92e8a5ae116750b180a2e65f5cba22683de7249f8f
Opcode Fuzzy Hash: ade7bf363ed15e6875cf1af1c8a60079e7d2754fd8a921585c80e4634e37238f
Instruction Fuzzy Hash: EA82CEB4E152688FEB25CF18C8957DDBBB0BF5A304F5082DAD98DA7241DB305A85CF81

Function 0047A610 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction ID: 0fc5e8941a16b16f9458543aa06cdc6e77fe0ca1878954e15eaf8ff6be4b297f
Opcode Fuzzy Hash: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction Fuzzy Hash: 86518B70C00249EBEB00DFA5D845BDEFBB4FF54708F14821AE81477281D7B96A98CBA5

Function 00487550 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,A3776857), ref: 00487605

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction ID: 0be71067b94349f3b163f10fc7865c9901b3f86c171c2f757c76e38bbf7f7ec5
Opcode Fuzzy Hash: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction Fuzzy Hash: 3351BD70C05318DBDB20DF64D85979EB7B0EF18304F1082DED409A7291EBB86A88CB95

Function 004863F0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00486464

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction ID: 991b9e5c4f1dd7985d860474454b41f109cd49006b683c09ab2e27c6457cb47f
Opcode Fuzzy Hash: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction Fuzzy Hash: AF217FB0D043189BD721DF15C844B9ABBF4FB08714F0046AEE84997380DBB9A6849BE5

Function 00486C50 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

cores, xrefs: 00486E4E

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction ID: e3a9e89045bf121aadbf864e887aeb25ba0c58f762de233e8adf5c73134b1a6d
Opcode Fuzzy Hash: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction Fuzzy Hash: 2B916871D003599BDB00CFA8C9547EEFBB4FF59304F14825AE404BB292EBB56A84CB91

Function 00480C80 Relevance: 19.8, APIs: 13, Instructions: 258
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004808F0: InitializeCriticalSectionEx.KERNEL32(0051C7AC,00000000,00000000), ref: 0048096F
Part of subcall function 004808F0: GetLastError.KERNEL32 ref: 00480979

EnterCriticalSection.KERNEL32(00000004,A3776857,?,?), ref: 00480CD8
GdiplusStartup.GDIPLUS(00000000,00000001,?), ref: 00480D08
LeaveCriticalSection.KERNEL32(00000004), ref: 00480D13
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00480D42
GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00480D50
__alloca_probe_16.LIBCMT ref: 00480D7E
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00480DCE
GdipCreateBitmapFromScan0.GDIPLUS(?,?,?,0026200A,?,?), ref: 00480EB3
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 00480ED0
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F33
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F4C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream__alloca_probe_16
String ID:
API String ID: 1308617310-0
Opcode ID: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction ID: f4feccb951fe1b922ecb3dfaf5b8302156747445c0b76c240fb24b0f4f51c94e
Opcode Fuzzy Hash: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction Fuzzy Hash: D1A165B1D10208DFDB50DFA4C984BAEBBF4FF49314F24452AE905A7340D778A949CBA9

Function 00481B10 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 293
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00485E30: GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

WSAStartup.WS2_32(00000202,00516D04), ref: 00481C85
socket.WS2_32(00000002,00000001,00000000), ref: 00481C98
htons.WS2_32(00000002), ref: 00481CBF
inet_pton.WS2_32(00000002,00000000,00516E98), ref: 00481DA2
connect.WS2_32(00516E94,00000010), ref: 00481DB5
closesocket.WS2_32 ref: 00481DD5
WSACleanup.WS2_32 ref: 00481DDB

Strings

system, xrefs: 00481B74
geo, xrefs: 00481C1D
NG, xrefs: 00481B1D

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: NG$geo$system
API String ID: 213021568-968879199
Opcode ID: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction ID: a79096e42c26a1a604384fcb43a931ed9af1c00745f33276f8ffcea807cfd111
Opcode Fuzzy Hash: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction Fuzzy Hash: 1DC1AE70D01248DBDB00EFA8C8457DEBBB5FF15308F14421BE854AB391EBB86A85CB95

Function 004BC57A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BC233: CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

GetLastError.KERNEL32 ref: 004BC68E
__dosmaperr.LIBCMT ref: 004BC695
GetFileType.KERNEL32(00000000), ref: 004BC6A1
GetLastError.KERNEL32 ref: 004BC6AB
__dosmaperr.LIBCMT ref: 004BC6B4
CloseHandle.KERNEL32(00000000), ref: 004BC6D4
CloseHandle.KERNEL32(004BB653), ref: 004BC821
GetLastError.KERNEL32 ref: 004BC853
__dosmaperr.LIBCMT ref: 004BC85A

Strings

H, xrefs: 004BC7DF

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction ID: e4caf95108e2d56c13f9780512823c5111e6df0be3dd416bceb2684eca6e9c1f
Opcode Fuzzy Hash: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction Fuzzy Hash: 65A13632A041549FCF19AF68DCD1BEE3BA1AB46314F14015FF8119F391CB798906CBA9

Function 00481110 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 526
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004812EC
GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,000000B8), ref: 004812FC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00481388
ReadFile.KERNEL32(00000000,00000000,00516C10,00000000,00000000), ref: 004813A4

Strings

exists, xrefs: 0048181F
0hC, xrefs: 004812E2

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: File$Ios_base_dtorPointerReadSizestd::ios_base::_
String ID: 0hC$exists
API String ID: 418202444-4085241440
Opcode ID: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction ID: 03b619e30c80654d4b10cf1501dd509fce63877f60a48615618d7203a258c35b
Opcode Fuzzy Hash: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction Fuzzy Hash: 3E425D70D01248DFDB10DFA9C9447DDBBF4BF19308F10819AE849A7291DB746A89CF95

Function 00453280 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00453446
___std_exception_destroy.LIBVCRUNTIME ref: 00453463

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,A3776857), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 004536B0
___std_exception_destroy.LIBVCRUNTIME ref: 004536CD

Strings

value, xrefs: 00453386, 004535E5
MC, xrefs: 0045343C, 00453458, 004536A6, 004536C2

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction ID: 0b049260404a019bd3923239173dd3b15bf9369a861e2bc94eedd162a5d5976f
Opcode Fuzzy Hash: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction Fuzzy Hash: 1EF16B70C05298DEEB20DB65C954BDEFBB4AF19304F1481DED84963282E7746B88CF96

Function 0049EF0E Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfc0c2450c919e5ca8e87a3f3fa153f15bbe28b91ce2660b0eab54348b933ba
Instruction ID: af9c87e70908a1ee06dfbc346dd9d7a470d4d3b04964572cafa80a59c2292356
Opcode Fuzzy Hash: ccfc0c2450c919e5ca8e87a3f3fa153f15bbe28b91ce2660b0eab54348b933ba
Instruction Fuzzy Hash: ACB13274A04249EFEF11CF99C841BAE7FB1AF46304F14417AE5009B392C7B99D4ACB99

Function 0049865A Relevance: 9.3, APIs: 6, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 004987E2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004987FE
__allrem.LIBCMT ref: 00498815
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498833
__allrem.LIBCMT ref: 0049884A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498868

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction ID: bac2f8d64b4771d1480d5067db4f3a3676e567bfb19d99c183f063f20f68270c
Opcode Fuzzy Hash: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction Fuzzy Hash: A68107B26007069BDB20EA6DCC41B5B7BE9AF52364F24453FF111DB791EB78D9008B98

Function 004823F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

exists, xrefs: 0048291E
0hC, xrefs: 00482852
0, xrefs: 004827FE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC$exists
API String ID: 323602529-1229763112
Opcode ID: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction ID: 8ad686ceee80f5ac92384c61aa111afe13dce58c6585d204e44adfbc4e8d440e
Opcode Fuzzy Hash: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction Fuzzy Hash: 81D18070D0528CDAEB10DBA8CA45BDCBBF4AF19308F2440DDE4456B282DBB95F48DB56

Function 004865D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 230registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FD70: ___std_fs_get_current_path@8.LIBCPMT ref: 0047FE92

GetVolumeInformationW.KERNEL32(?,?,00000100,?,?,?,?,00000100,00000000,?,A3776857,?,?), ref: 00486757
RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

ProductName, xrefs: 00486900
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationValueVolume___std_fs_get_current_path@8
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2814272438-1787575317
Opcode ID: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction ID: 5513a57b40c567382305f19abecc614c7fb65df7785b10e0462d816fc7d7abf5
Opcode Fuzzy Hash: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction Fuzzy Hash: DFA18BB1C012199BDB21DF55CD59BE9B7B4FF14304F1042EAE419A7281EB786B88CF94

Function 004A0DE2 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Summer Time, xrefs: 004A1193
Eastern Standard Time, xrefs: 004A117F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: f479341c917e5b85ea8d4f872af5b2a7ed3f0ffe6aef50257419f0e8574b0954
Instruction ID: d63cae11faca7fbaaedfd5ec0c01f193a5a5e64d1a9f5e85edff99bc4745f09f
Opcode Fuzzy Hash: f479341c917e5b85ea8d4f872af5b2a7ed3f0ffe6aef50257419f0e8574b0954
Instruction Fuzzy Hash: D5C15872D00211ABDB20AB65CC02ABF7BB9EF76754F10405BF901EB291E7788E41D798

Function 00481F10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D726
Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D750

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00482387

Part of subcall function 0043E440: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0043E4CF

Strings

exists, xrefs: 004823DA
0hC, xrefs: 0048237C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtor___std_fs_convert_narrow_to_wide@20std::ios_base::_
String ID: 0hC$exists
API String ID: 1525435645-4085241440
Opcode ID: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction ID: 349907f898d0770bf1c6c6bee16b757a414fbaa0545e2b95a55e182eb82389be
Opcode Fuzzy Hash: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction Fuzzy Hash: 1ED19F70D0528CDAEB10DBA8CA45BDCBBF0AF19308F2480DDD4456B282D7B95F58DB56

Function 00438180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004381BC

Part of subcall function 004B849F: FindNextFileW.KERNELBASE(?,00000001,?,00437D97,?,00000001,?,004BDC4D,00000001,?,?,?,A3776857,00000001), ref: 004B84A8

Strings

directory_iterator::operator++, xrefs: 00438294
., xrefs: 004381CE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID: .$directory_iterator::operator++
API String ID: 3878998205-1036657373
Opcode ID: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction ID: 735a56af49808cf236c7d8626bd4983a1e4e1118483563b87a501f55d85a1d57
Opcode Fuzzy Hash: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction Fuzzy Hash: C7318D70A047188BCF30DF59C8887ABF7B4EB49310F14429EE45997391DB395E85CA84

Function 004868B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

ProductName, xrefs: 00486900
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction ID: c2d08890748770af0873008191db5a05c2fa34d27609d4939fc155a72502f57e
Opcode Fuzzy Hash: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction Fuzzy Hash: 95218EB09003599BDB20DF54C805BEABBF8FF04704F10465EE845A7681DBB86A44CB95

Function 00487290 Relevance: 4.7, APIs: 3, Instructions: 178registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,A3776857,?,0051C288), ref: 0048735B
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397
RegCloseKey.ADVAPI32(00000000), ref: 0048751D

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction ID: e90b3dd054a924dd9803ab5f17a38fc1c4cefb0d6438d00707aa441ccba3a8d8
Opcode Fuzzy Hash: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction Fuzzy Hash: E3717FF0D012189FDB20DF24CD94B9DB7B4EB54304F1082DAEA19A7281D774AE88CF99

Function 004870B0 Relevance: 4.6, APIs: 3, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,A3776857,0051C570,0051C2A0), ref: 00487182
RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6
RegCloseKey.ADVAPI32(00000000), ref: 00487260

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction ID: b9c4edd99e38da91ddb4c738108b0054469e00b62f6e0a688ac56e9026d709b2
Opcode Fuzzy Hash: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction Fuzzy Hash: 905130B0D042189BDB20DF15CD54B9AB7F8FF45708F5042DEE609A7281DB74AA88CF99

Function 004855F0 Relevance: 4.6, APIs: 3, Instructions: 99networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(0000025C), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction ID: c065b03366e761df0b34e2ad76ec595a4b6e3bb6db0e63c2aea2bbb819f94b56
Opcode Fuzzy Hash: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction Fuzzy Hash: 6C415830D11398CEEB14EB65CC59BDEBB71AF10308F1081DAE449672A2DB741E88DFA5

Function 00485E30 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction ID: dee3d2b381a88aa75edb4726eebd2668ef991be1adfc48943d59dd3409b8a73b
Opcode Fuzzy Hash: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction Fuzzy Hash: 60219D70A40305ABE730DF65DD09B5BBBF8EB44B14F104A1EF545AB6C0D7B9AA048BE4

Function 004A2897 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004A2891,00000016,0049036B,?,?,A3776857,0049036B,?), ref: 004A28A8
TerminateProcess.KERNEL32(00000000,?,004A2891,00000016,0049036B,?,?,A3776857,0049036B,?), ref: 004A28AF
ExitProcess.KERNEL32 ref: 004A28C1

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction ID: 5f52cdf8944b70cf92df4f225d6e01553ce615c3954620652ef0a1f31c52b3c3
Opcode Fuzzy Hash: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction Fuzzy Hash: ACD09E71001108BBDF423F65ED0DB8E3F2AEF55745F044026B9095A131DB799995EB98

Function 0047EE90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 0047F1C0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,A3776857), ref: 0047F211
Part of subcall function 0047F1C0: RegCloseKey.ADVAPI32(00000000), ref: 0047F221

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047F194

Strings

0hC, xrefs: 0047F18D

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseIos_base_dtorOpenstd::ios_base::_
String ID: 0hC
API String ID: 1131316584-2581318919
Opcode ID: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction ID: cfb713b882ce29762410958d43b6c09695d359a02ab63b143eff75d03a191730
Opcode Fuzzy Hash: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction Fuzzy Hash: 59911674C00298CBDB20DF68C845BDDBBB0AB19314F1086EAD45977282DB746E88CF95

Function 00486F20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 00486F86

Strings

Unknown, xrefs: 0048705A

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction ID: 4cfd0b05124d6ad0cc2ed0fe670d1554fe3cca3eb32f1e14fa8b394e0e179909
Opcode Fuzzy Hash: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction Fuzzy Hash: 74418B71D00258CBDB20DF69C8407DEFBF4EF49704F1082AAD899A7281D774AA88CF91

Function 004ABC08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Strings

MC, xrefs: 00434FDC

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction ID: 040724f085c67d798f1d490f9b73413860191a50a7d7deb79defe6124e27c29a
Opcode Fuzzy Hash: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction Fuzzy Hash: 3611EB71800308ABCB10DF58DC01B9AB7ACEB15724F10466FF81597780EB79A940CBD8

Function 00447920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0044799C

Strings

0hC, xrefs: 00447996

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0hC
API String ID: 323602529-2581318919
Opcode ID: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction ID: 8ca8b340eaa0dfe9bad33bee777e0704730a4b63aab2394a13b70ad755bbc225
Opcode Fuzzy Hash: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction Fuzzy Hash: CD11ADB0840609DFDB10DF59C840A9DFBF8FB05328F208A6EE85197390EB74AA05CB80

Function 00460310 Relevance: 3.3, APIs: 2, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004604B4

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction ID: 66707b960993136107624c9d81ef05c918eca4bbb2b21c6d520a63eb0cd0cd41
Opcode Fuzzy Hash: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction Fuzzy Hash: 04A191B1E002159FDB14DF68C981AAFBBB4EB49314F24422FE815E7385E738AD05CB95

Function 00437CB0 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00437D64
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00437D92

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction ID: c774fac7b26238caf8a18ea1cc9dfb162d547f418ec2e445b27f5ef4f4107e88
Opcode Fuzzy Hash: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction Fuzzy Hash: E841A0B1D04218DBCB34DF64C480AEEB7B4EF19324F00516BE851AB381EB789D44CB94

Function 00480F90 Relevance: 3.1, APIs: 2, Instructions: 108COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,A3776857,?,?), ref: 0048101E
CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction ID: 3e538bd659216d3e4857fbb8bc962106784e19cd0647cea7878622876b38b54a
Opcode Fuzzy Hash: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction Fuzzy Hash: 4241ACB0D01748DBDB10CFA5C9457AEFBF4EF58314F20421EE811A7280EBB86A44CB94

Function 0047F1C0 Relevance: 3.1, APIs: 2, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,A3776857), ref: 0047F211
RegCloseKey.ADVAPI32(00000000), ref: 0047F221

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction ID: 54b3090d3cf4edc9b1beeea5084ab922e7ff7cf66e968ba670c482e571a875e7
Opcode Fuzzy Hash: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction Fuzzy Hash: 1021F675E002199BDB10EF95DC81BEFB7B4EB48714F14827EE819B7382EB399D048694

Function 0049F3BE Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000), ref: 0049F3FA
GetLastError.KERNEL32(00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000,?,0049BE05,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0049F407

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction ID: e391caa542caa0dd86735aa216be2178a54a5bfb1c46ce41420e93566301b438
Opcode Fuzzy Hash: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction Fuzzy Hash: 57012232614215AFCF058F69DC49D9E3F2AEF95324F24422AF811DB290E775EE41CB94

Function 0047E47D Relevance: 3.1, APIs: 2, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004473D0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,A3776857), ref: 0044741C
Part of subcall function 004473D0: Process32FirstW.KERNEL32(00000000,?), ref: 00447468

Part of subcall function 00445950: CredEnumerateA.ADVAPI32(00000000,00000000,?,?,A3776857,00000000,?), ref: 004459B2

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction ID: 21d12501465ffecb104f3396b5f4d487cf58cbb0265569f00e2db2d4d6eee1e0
Opcode Fuzzy Hash: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction Fuzzy Hash: D9114C71806548EAEB00FBF7950639DB7A0AF0431CF10C59FE90623182DF7D1A0596AF

Function 0047E4C8 Relevance: 3.0, APIs: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction ID: d8074609c4b6b56a118d8c4864159468ec2ce210cc92c7876c64f9fcb1cee0d4
Opcode Fuzzy Hash: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction Fuzzy Hash: CD017171806518DAE710FBE2D50679DB7A0AF0931CF50869FE90623282DF791A0187AE

Function 0049C0BD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction ID: 589170845ab709ad3b3b60fb6adb52998bb4654d1de7eee66c817f55301082a8
Opcode Fuzzy Hash: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction Fuzzy Hash: 9BE08631500614A7CF222BA1EC0D7893F58DB40355F104036F60897160DF398940CB88

Function 0048FAB0 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048FCEA

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction ID: 258a51d4530bdfdbcfb978a880514f411ab203130510da66870d02f2c2448e76
Opcode Fuzzy Hash: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction Fuzzy Hash: DB71F671A002088FCB24EF28C490B6E77A5BF15314F244A7FE865CB791D739EA49CB95

Function 0044AF90 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction ID: 5047db877c7d9ae38b531aa0dda64427d2377832e7d6361d0852b000475400c5
Opcode Fuzzy Hash: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction Fuzzy Hash: F45180B5A0060ADFDB18CF28D480999FBB4FF4A320B5082AAE819C7B51D735ED55CBD4

Function 0049E314 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction ID: 7d9f16a24b0820fe6bfe4efb506255557b861a5981f24711c09fdeca13a2084c
Opcode Fuzzy Hash: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction Fuzzy Hash: 8751C470A00104EFDF14CF5ACC85AAE7FA5AF99324F28816AE8095B352D379DE41CB95

Function 00458550 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004586AF

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction ID: 39eac46aceff4f274d7df031c3ad8bb7d561d247c585fc64f7f09dd83a036c2e
Opcode Fuzzy Hash: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction Fuzzy Hash: E941A4B1E001159FDB04DFA8C841AAEBBB5EF48315F10422EE815F7386DB34AE09CB95

Function 004520F0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0045223D

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction ID: 543f2dd5f5f38f41d79c3b3e326d175c20dbca08f8aec97f7e4552ad9d8ce088
Opcode Fuzzy Hash: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction Fuzzy Hash: E1411272E001149BCB05EF68CD806AFB7A5EF56311F1402AFFC15EB302D6789E158B99

Function 00451F90 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004520DE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction ID: 53fc907bca80d66a09b4c03435f3e8acb878ccb904669eb33cf36a05cbe64725
Opcode Fuzzy Hash: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction Fuzzy Hash: E7414272D001049BCB15AF68CD806AEBBA5AF4A305F1002ABED15EB342D7749E158BD9

Function 0048F890 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048F9FA

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction ID: 91311e753e2fbbf9cdae31aef67f458025fa5287f257254b7d49e4ed808e7769
Opcode Fuzzy Hash: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction Fuzzy Hash: 4F41B3B2E005049FDB14EF68C985A6EBBA9EB49320F24473EE815D7385DB349D04CB95

Function 00451E50 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00451F7F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction ID: dbfd0375bb16cbcb281b8a1501cab73851c3df864c0bb83deedb38d5f1c134ec
Opcode Fuzzy Hash: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction Fuzzy Hash: 72312572A001049BCB14DF688881B9FBBA5AB59315B24426FEC15CB303DB34DE5987D9

Function 004516D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004517DF

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction ID: 65e916faade23ef3c336758c75d3ad3b55c144e32e026a5ec30b5c92d10e86c8
Opcode Fuzzy Hash: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction Fuzzy Hash: BB316772E001105BCB18EE6D9880A6FB7E9EB88312B24427FEC15D7352DA38DD0987D9

Function 0044D7D0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044D8F9

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction ID: 6687ec20b77dec97c90771c2cbe71989815263d1b8fcacfb2e06f2ee49a1853a
Opcode Fuzzy Hash: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction Fuzzy Hash: C3310A71E002045BE714AE6DD880A7EB7A4EF55324F24477FF865C7382D67899408759

Function 0044BAD0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

Part of subcall function 00434F80: ___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction ID: f8cf7cd3dcf405c094d14d4edd2427269fc308b55f739c6c677f8adad7f52d2f
Opcode Fuzzy Hash: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction Fuzzy Hash: 902126B1E006059BE7149F25D48166AB7A4EF15324F20036FE8258BB91E739FE90C7D6

Function 004BB697 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB6D1

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction ID: 7232828ef0ab4ea1277fc9c55e8108ad49929c9e06a984f5114aae078e858d40
Opcode Fuzzy Hash: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction Fuzzy Hash: B9113671A0010AAFCB05DF58E9819CF7BF4EF88304F00405AF808AB311D770D9118BA4

Function 00482930 Relevance: 1.5, APIs: 1, Instructions: 43networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000000), ref: 00482968

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction ID: 15365ef676efcd120e403479619ae1d38f6ec3fc5171ce29fb9a7f72e5811cf6
Opcode Fuzzy Hash: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction Fuzzy Hash: 93F0B472302115AB83109A5DAD4096BF7DEDBCA7B0B2003A7FC2CC33E0E9618C0153D4

Function 004406AD Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction ID: a1ffe5c8ce5f1f1a4397a2b9345f76ae3c812c30bf0ac5870f9d4861cf5b4c4e
Opcode Fuzzy Hash: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction Fuzzy Hash: 95015631A0625DDFEB20DFA4D988BAEBBB4EF14314F2040DAD909A7282C7346E04DF55

Function 0049D15A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction ID: de2ad87b2feeaf860c8dfd974d012cc9eb33a1afe18dd843800594eb24cb3dbb
Opcode Fuzzy Hash: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction Fuzzy Hash: 08E0E533A0132166EF212BA6AD02B5B3E48CB513A0F190137EC18962C4CB28DC0082ED

Function 004A8D62 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A8D69

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction ID: f589969de9c028132caa70972cc51c37c6bf7195d426b38a2c2fae52dece88af
Opcode Fuzzy Hash: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction Fuzzy Hash: 71E09A76C4020D9ADB40DFD5C486BEFB7BCAB14304F50406BA205E6181EB7857448BE5

Function 004BC233 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction ID: c65ff2ef24fd0563ec255788cd93a1d7270b85fbbbb51eec7110af243f851585
Opcode Fuzzy Hash: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction Fuzzy Hash: 05D06C3200010DBBDF028F84EC06FDA3BAAFB48714F018010BA1866020C732E821ABA4

Function 004B9AE2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00486DD6,?,?,?,A3776857,?,?), ref: 004B9AEC

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction ID: f88b8e15ca571a688dc5d535dfb7cb0f1e1a76fd2fb5174ce8f8aecae7ce3306
Opcode Fuzzy Hash: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction Fuzzy Hash: 0EC09B7490610E97CF00E7E5D94D88E77FCA608204F4004A1D551E3140E770FD45C795

Non-executed Functions

Function 0048A0A0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 325nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtDuplicateObject,A3776857,?,?), ref: 0048A0F7
GetProcAddress.KERNEL32(00000000), ref: 0048A0FE
OpenProcess.KERNEL32(00000040,00000000,00000000), ref: 0048A12A
NtQuerySystemInformation.NTDLL ref: 0048A153
NtQuerySystemInformation.NTDLL ref: 0048A178
GetCurrentProcess.KERNEL32 ref: 0048A1FD
NtQueryObject.NTDLL ref: 0048A22B
GetFinalPathNameByHandleA.KERNEL32(00000000,00000000,00000104,00000000,00000104,?,00000104,00000000), ref: 0048A315
CloseHandle.KERNEL32(00000000), ref: 0048A3E6
CloseHandle.KERNEL32(00000000), ref: 0048A441

Strings

ntdll.dll, xrefs: 0048A0EB
NtDuplicateObject, xrefs: 0048A0E6
File, xrefs: 0048A25B

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction ID: 0800680efb81c18e2f896ca5fb1c4f1751909ec1a20682d0b449f1ef79601e33
Opcode Fuzzy Hash: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction Fuzzy Hash: C3C1DE71D00218AFEF10EFA4DC45BAEBBB5FF44704F14452AE801A7281E7B9AD45CB96

Function 00477EE0 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,A3776857,?,?), ref: 00477F5C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction ID: d5989f67fd172e1006781f95ff6e7d6cbd1369fc69074948a5cb2319df95c689
Opcode Fuzzy Hash: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction Fuzzy Hash: 12D1F170D04288DBDB11CFA8D848BEDBBB0FF15314F14824AE508BB291DB796AC9DB55

Function 0047D2F0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044DCC0: std::ios_base::_Addstd.LIBCPMT ref: 0044DDEF

Part of subcall function 00436640: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047D95A

Strings

.G, xrefs: 0047D646, 0047D6BC, 0047D8DD
0hC, xrefs: 0047D950
.exe, xrefs: 0047D349, 0047D423
runas, xrefs: 0047D7EA, 0047D82A, 0047D82B
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0047D443
.vbs, xrefs: 0047D3A5
.ps1, xrefs: 0047D365
.cmd, xrefs: 0047D385
open, xrefs: 0047D7E5

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$Ios_base_dtor$AddstdConcurrency::cancel_current_task
String ID: .cmd$.exe$.ps1$.vbs$.G$0hC$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$open$runas
API String ID: 2154145882-3307477358
Opcode ID: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction ID: f5ba6b163c3a98fee3f853caf05b9595179ad2eb3f8f0c36a39513699dfd7300
Opcode Fuzzy Hash: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction Fuzzy Hash: 6A122770D00268DFDB20DF64CD85BDEBBB4AF19304F1481EAE849A7282DB755A84CF95

Function 0048A710 Relevance: 15.2, APIs: 10, Instructions: 215stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL(A3776857,00000000,00000000), ref: 0048A766
NtAllocateVirtualMemory.NTDLL ref: 0048A78F
lstrcpyW.KERNEL32(?), ref: 0048A7C6
lstrcatW.KERNEL32(?), ref: 0048A8CD
NtAllocateVirtualMemory.NTDLL ref: 0048A904
lstrcpyW.KERNEL32(?), ref: 0048AA0F
RtlInitUnicodeString.NTDLL(-00000037), ref: 0048AA28
RtlInitUnicodeString.NTDLL(-0000003F), ref: 0048AA37
LdrEnumerateLoadedModules.NTDLL(00000000,Function_0008A6B0,00000000), ref: 0048AA44
RtlReleasePebLock.NTDLL ref: 0048AA4A

Part of subcall function 00480F90: SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,A3776857,?,?), ref: 0048101E
Part of subcall function 00480F90: CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateInitLockMemoryStringUnicodeVirtuallstrcpy$AcquireEnumerateFolderFreeKnownLoadedModulesPathReleaseTasklstrcat
String ID:
API String ID: 573923072-0
Opcode ID: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction ID: 1d72f842e61e5ce7feef92d17fc1071c4f69874d6174494518bfda03acdacd70
Opcode Fuzzy Hash: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction Fuzzy Hash: D6B190B4D05268EFDB14CFA9D885A9DBBB5FF08314F10822AE825A7361DB346946CF44

Function 0047AE80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000,00000001,?,0047AF9D,?,?,A3776857), ref: 0047AE91
BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0047AEAB
BCryptGenerateSymmetricKey.BCRYPT(?,?,00000000,00000000,?,?,00000000), ref: 0047AECF

Strings

ChainingModeGCM, xrefs: 0047AE9F
ChainingMode, xrefs: 0047AEA4
AES, xrefs: 0047AE88

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 1692524283-1213888626
Opcode ID: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction ID: 8d127e15825cd86a398cba4dadb085fb92217d3de15f733cf2195ed64ba2db48
Opcode Fuzzy Hash: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction Fuzzy Hash: 1CF03031381710BBE7309E65AC4AFDB7BA8FB44F10F10492AFA41DA1D0D7A0F8559B5A

Function 0046B620 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B7DA
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B81E
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B924
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B970

Strings

., xrefs: 0046B942

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction ID: 99e23c5b304899c8ab8714ce46d423df57297e0934c6bc539a0dfe6d7ec6f1b4
Opcode Fuzzy Hash: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction Fuzzy Hash: 77C1BF75A016269FCB20DF18C8847AAB3B5FF44314F14829AD915D7390EB39AD85CFC6

Function 004A6109 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 004A61A2
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 004A61CB
GetACP.KERNEL32 ref: 004A61E0

Strings

OCP, xrefs: 004A615D
ACP, xrefs: 004A6127

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction ID: 02a1f9ff6d074017cf30d732e6d651dacf3b6180dce544ba7b26bbdffeda2481
Opcode Fuzzy Hash: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction Fuzzy Hash: 14217731B00101A6DB348F54C901A9BBBA7EB76B54B5F8466E909D7302EB36DE41C358

Function 004A62E5 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetUserDefaultLCID.KERNEL32 ref: 004A63ED
IsValidCodePage.KERNEL32(00000000), ref: 004A642B
IsValidLocale.KERNEL32(?,00000001), ref: 004A643E
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004A6486
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 004A64A1

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction ID: c25bf07a23f3a9ec008bfe0b344d9b34e57977eb2ee5f51d57588e3c0d66081e
Opcode Fuzzy Hash: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction Fuzzy Hash: B351C031A00205ABDF10DFA5CC41AAF77B8BF2A700F09446BF905EB2C0D778D9058B68

Function 00497B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 00497C25
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00497C2F
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000001), ref: 00497C3C

Strings

/LC, xrefs: 00497B2F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: /LC
API String ID: 3906539128-2135541996
Opcode ID: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction ID: bfbf58602b6ed5b9f74246d621f9e13e9ead8f3e4535d75d7aa199c35e3273ea
Opcode Fuzzy Hash: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction Fuzzy Hash: 3231D274901229ABCB21DF65DC8878DBBB8BF18710F5041EAE40CA7250E7349F858F48

Function 00493800 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction ID: d1eb0eda3f30262f0aa428ac7e9151949e9d9ef7bd25f7153de96db8ebdefec9
Opcode Fuzzy Hash: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction Fuzzy Hash: DB023C71E002199BDF14CFA9C9806AEFBF1FF89315F24826AE519E7341D735AE018B94

Function 00498574 Relevance: 6.1, APIs: 4, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0049859D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 004985B1
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00498602
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00498617

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction ID: 57c86550534b148c15952eeeaf39776b02a492ab104de77fe61266457f658886
Opcode Fuzzy Hash: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction Fuzzy Hash: 91217C72E00119ABCF20DFA9DD85AEFBBB8EF45754F05017AE905E7140EA349D04C794

Function 009A5027 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 009A5033
IsDebuggerPresent.KERNEL32 ref: 009A50FF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009A5118
UnhandledExceptionFilter.KERNEL32(?), ref: 009A5122

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d6b97f7b4cd2f8b46333d7f35612c9fd8b04a717fbe73125f88c229f4a7ae2d2
Instruction ID: 322b30c106090feb4ba349b24dafb1523542fb2f956019d2a8b9c0bc2d5c8015
Opcode Fuzzy Hash: d6b97f7b4cd2f8b46333d7f35612c9fd8b04a717fbe73125f88c229f4a7ae2d2
Instruction Fuzzy Hash: 38312975D05218DBDF20EFA4D9497CDBBB8BF08300F1041AAE40CAB250EB709A84CF85

Function 004AC6BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004AC6CB
IsDebuggerPresent.KERNEL32 ref: 004AC797
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004AC7B0
UnhandledExceptionFilter.KERNEL32(?), ref: 004AC7BA

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction ID: 70dc3419eb2b6db1900c7bd06373213fcab329736da06f39ceabfcfe7a7444e5
Opcode Fuzzy Hash: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction Fuzzy Hash: E1314A75C012189BDF21DF61DC897CEBBB8BF18700F1041AAE40DAB250E7759A84CF48

Function 0043D4A0 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 725COMMON

Download Yara Rule

Strings

content, xrefs: 0043E150
filename, xrefs: 0043E0E3

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID: content$filename
API String ID: 0-474635906
Opcode ID: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction ID: d087ffba84baf14db51f89a037efaf3a0efd4671473d6540ebf1f333b1c0f3d3
Opcode Fuzzy Hash: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction Fuzzy Hash: 5392EEB0C052AC9BDB66DF68D9857DDBBB4AF18308F1441DAE80CA7252EB741B84CF45

Function 004B824D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,00435B2A,?,?), ref: 004B8261
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000,?,?,00435B2A,?,?), ref: 004B8288

Strings

!x-sys-default-locale, xrefs: 004B825C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction ID: 4f66f40a8a4f046c7b0032d4e1a4b833dd41128cf422eed9181fa496fdef01a0
Opcode Fuzzy Hash: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction Fuzzy Hash: 1AF030B5511108FFEF089BD5DC0EEEB77ACEB09394F10416AB501D6150E6B0AE00D778

Function 004A5D8D Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5DE1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5E2B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5EF1

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 66ffe828941743625ba3b2f2e75b323c17a954a9466d11b4e4a0e42b75f50976
Instruction ID: 962ae09c726557bba2a742099c161f9beda31160a96e42ffbc7faebc0f235ca1
Opcode Fuzzy Hash: 66ffe828941743625ba3b2f2e75b323c17a954a9466d11b4e4a0e42b75f50976
Instruction Fuzzy Hash: D86190715416079FDB28DF28CE82BABB7A8EF25305F1440BBE905C6285E738DE41CB58

Function 0047AAE0 Relevance: 3.2, APIs: 2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction ID: 33f7787d24f7b6ada88b2ec4e837cc4b10ca5ac34968b166931d9a07c874724e
Opcode Fuzzy Hash: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction Fuzzy Hash: 21B1A170D04249DFDB10CFA4C884BEEBBB5FF89304F20825AD505AB381D778A984CB96

Function 00440B60 Relevance: 3.1, APIs: 2, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,00000001,?), ref: 00440BFA
LocalFree.KERNEL32(?,00000000), ref: 00440C8E

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction ID: f58a043fe36a424058588bce6ee5e9d112fd586f94ce921f9f6943f9dc7e0036
Opcode Fuzzy Hash: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction Fuzzy Hash: 68517E70D00249DBEB00CFA9C8457DEFBB4FF14308F14821AE8547B281D7B96A48CBA5

Function 0047A950 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A9B8
LocalFree.KERNEL32(?,00000000), ref: 0047AA4F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction ID: 6fc12887242d51354b1d4be44c56afc8010d77d5c64fcd5971483ececb25fb38
Opcode Fuzzy Hash: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction Fuzzy Hash: 7351BF70D00249EBEB00CFA5D945BDEFBB4FF54308F10821AE81077281D7B96A58CBA5

Function 004A5FE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A6034

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0cc7574bf4926a40e967ac0568a5283aef49bd869a92054f23648a73363eb538
Instruction ID: 4410453ce78f061189afbc458556258a4ff070a6a13362461f6e96f76a4d0aba
Opcode Fuzzy Hash: 0cc7574bf4926a40e967ac0568a5283aef49bd869a92054f23648a73363eb538
Instruction Fuzzy Hash: A121B232655206ABDF28DF25DC41A7B77ACEF61314B1500BFFA01C6281EB38ED408A58

Function 004A5C67 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5D8D,00000001), ref: 004A5CD9

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2975694ee7023931f0e948769ccc6b12fa9635212241985c4e92d9e5cce4a94c
Instruction ID: 1406c895032231e24aa0afc96b0d01b76351fdf719fc880d52765eb770635e76
Opcode Fuzzy Hash: 2975694ee7023931f0e948769ccc6b12fa9635212241985c4e92d9e5cce4a94c
Instruction Fuzzy Hash: 1711E537600B015FDB18AF79C9916BABB92FF91368B18842EE94787B40E375A942C744

Function 004A620F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004A5FA9,00000000,00000000,?), ref: 004A623B

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8b81b91eadfdb3b62c299d10167f1a9c9d1e1bff8d4bf303c7f3fb8fddf9b379
Instruction ID: 9487850153f17b5aff8b54b84101990ee62d9d6b8c11e223cf6e38bc87e8a6da
Opcode Fuzzy Hash: 8b81b91eadfdb3b62c299d10167f1a9c9d1e1bff8d4bf303c7f3fb8fddf9b379
Instruction Fuzzy Hash: 3C01DB33A10112ABDF286A658D06BBB7768DB51754F1A446FEC06A3680DA38ED41C698

Function 004A5D02 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5FE0,00000001), ref: 004A5D4C

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 093b6fcee7793df0be6cbe5c3ac0d1e9e692bbf20fd6f6c44b0fdc924b83ac49
Instruction ID: c98a1cf7b30e52ba405588815af828edc546cc3ef2e56581ce593e44f0a9addd
Opcode Fuzzy Hash: 093b6fcee7793df0be6cbe5c3ac0d1e9e692bbf20fd6f6c44b0fdc924b83ac49
Instruction Fuzzy Hash: 2AF022362007041FCB246F799885A6A7BA5EB81368F14842EF9054B690C2759C02C658

Function 0049C70E Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0049B2E1: EnterCriticalSection.KERNEL32(-0051B45F,?,004A6D40,00000000,005137C8,0000000C,004A6D08,0043FE48,?,0049C6D7,0043FE48,?,00499445,00000001,00000364,00000001), ref: 0049B2F0

EnumSystemLocalesW.KERNEL32(Function_0009C701,00000001,00513580,0000000C,0049CB55,?), ref: 0049C746

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 69dda01542ccd3eab63414d956f3fcf1c5f44d3c23f22103bfe59f95768ac423
Instruction ID: a78643f9f3df08ccc8addbe33751412e33acbb4152fc9e9c363d2dc9b4240f3c
Opcode Fuzzy Hash: 69dda01542ccd3eab63414d956f3fcf1c5f44d3c23f22103bfe59f95768ac423
Instruction Fuzzy Hash: A0F04972A40205EFEB00DFA9E882B9C7BF0FB55725F10816BF415EB2A0D77959049F44

Function 0047AE10 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT(?,00000000,A3776857,?,?,?,004CB69D,000000FF), ref: 0047AE4A

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction ID: 7a92f9e53ad6301b38de286dc83f6de03fbb372fed7888f050c821ed69dc0e63
Opcode Fuzzy Hash: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction Fuzzy Hash: B1F06D71A44618ABD720CF58DC05B9AB7F8EB04B20F10476FE821A37C0D779A9008B94

Function 004A5C1A Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5B75,00000001), ref: 004A5C53

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a3e75a2ec426ab75d7b21eebf5cb3b3ab74813262ff42ffe7f20d7c1e2059a89
Instruction ID: c0579aaabcbeb9c43bbdfe6f16a8b7cdcbe96988e240a135a2bfe90bd87a4c91
Opcode Fuzzy Hash: a3e75a2ec426ab75d7b21eebf5cb3b3ab74813262ff42ffe7f20d7c1e2059a89
Instruction Fuzzy Hash: A8F05C3630030557CB049F35D88576B7F54EFD2724F06005EEA058B690C6769843C794

Function 004A5C1C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5B75,00000001), ref: 004A5C53

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f5bcbf328ab98889824a8f4a2aca38cb232a0aaea5e92dc81316268b5f07e0b0
Instruction ID: 8029f739405c8b6d15305cd3561d0adeac93de3ed34cfe121213407b3ae16d1c
Opcode Fuzzy Hash: f5bcbf328ab98889824a8f4a2aca38cb232a0aaea5e92dc81316268b5f07e0b0
Instruction Fuzzy Hash: B1F05C3630030557CB049F35D84576A7F54EFD2724F06005EEA058B690C6769842C754

Function 0049CCB0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0049A8AF,?,20001004,00000000,00000002,?,?,00499EA1), ref: 0049CCE4

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f7abdc218717ea54d8d13a8a84f23afce84eed1fa1e88fe8fac7f9052fbf838e
Instruction ID: eb41334156ced680ef33706ab3692b9e9ee117c5b5a07fe61c85a323d836a744
Opcode Fuzzy Hash: f7abdc218717ea54d8d13a8a84f23afce84eed1fa1e88fe8fac7f9052fbf838e
Instruction Fuzzy Hash: BDE04F35501228BBCF122F61DC04EAE7F16EF84761F004036FC0A66261CB368D21AAD9

Function 00477B00 Relevance: 31.7, APIs: 21, Instructions: 230processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,A3776857,?,?), ref: 00477B54
Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Process32NextW.KERNEL32(00000000,0000022C), ref: 00477BE0
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00477BFD
OpenProcessToken.ADVAPI32(00000000,0000000E,?), ref: 00477C2A
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C4D
GetLastError.KERNEL32 ref: 00477C5B
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C9C
CloseHandle.KERNEL32(00000000), ref: 00477CA7
CloseHandle.KERNEL32(?), ref: 00477CAF
CloseHandle.KERNEL32(?), ref: 00477E29
Process32NextW.KERNEL32(?,0000022C), ref: 00477E39
CloseHandle.KERNEL32(?), ref: 00477E62
CloseHandle.KERNEL32(00000000), ref: 00477E65
CloseHandle.KERNEL32(00000000), ref: 00477E84

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$CreateErrorFirstLastSnapshotToolhelp32
String ID:
API String ID: 1236848392-0
Opcode ID: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction ID: 454ab3ae29a80d327a78c61064fadb2005c2365cc5293efb4604dbbba27fe465
Opcode Fuzzy Hash: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction Fuzzy Hash: F6A15B709052189FDF219F24DC89BAEBBB8EF44700F5441EAE90CA2250EB359E84DF59

Function 0044E020 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0044E070
std::_Lockit::_Lockit.LIBCPMT ref: 0044E092
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E0BA
std::_Facet_Register.LIBCPMT ref: 0044E1D0
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E1FA

Strings

p]C, xrefs: 0044E15D
`aC, xrefs: 0044E16A
cC, xrefs: 0044E17E

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: cC$`aC$p]C
API String ID: 459529453-2177106863
Opcode ID: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction ID: 1ff138599dd9b712ad814e44402e9ca08be03e0a2a2e3ebe43d51928b08ed38c
Opcode Fuzzy Hash: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction Fuzzy Hash: 99518BB0D00259DBEB10CF99C8457AEBBB4FB18314F24815ED811AB381DB79AA44CBA5

Function 004AAEF3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,004AA85F), ref: 004AAF0C

Strings

sqrt, xrefs: 004AB04B
pow, xrefs: 004AAFAA, 004AB054, 004AB0A1
acos, xrefs: 004AB042
exp, xrefs: 004AAF8B, 004AAFF0
log10, xrefs: 004AAF4E, 004AAF5D
asin, xrefs: 004AB039
log, xrefs: 004AAF69, 004AAF78

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction ID: 58aec3622616389bffb488f30e5ac45d5b57ecd31d6a71103e59991c775c814d
Opcode Fuzzy Hash: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction Fuzzy Hash: BE516C7090860ACFCF148F58D9481AFBFB0FB66300F558187E4A1A6355C7BD8966CB9A

Function 00452250 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0045228D
std::_Lockit::_Lockit.LIBCPMT ref: 004522AF
std::_Lockit::~_Lockit.LIBCPMT ref: 004522D7
__Getcoll.LIBCPMT ref: 0045239F
std::_Facet_Register.LIBCPMT ref: 004523EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00452415

Strings

p]C, xrefs: 00452378
`aC, xrefs: 00452385

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID: `aC$p]C
API String ID: 1184649410-1363152631
Opcode ID: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction ID: 568a7e1164ae6cef3cf0599e82aad122ccc02b6897634e5ab4797aad8f19cd87
Opcode Fuzzy Hash: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction Fuzzy Hash: 49518B70800208DFDB01DF95C9457DEBBB4FF55318F24815ED805AB282DBB9AE49CBA9

Function 00450EF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 130COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00450F2D
std::_Lockit::_Lockit.LIBCPMT ref: 00450F4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00450F77
std::_Facet_Register.LIBCPMT ref: 00451071
std::_Lockit::~_Lockit.LIBCPMT ref: 0045109B

Strings

PbC, xrefs: 00451032
p]C, xrefs: 00451011
`aC, xrefs: 0045101E

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: PbC$`aC$p]C
API String ID: 459529453-2418293346
Opcode ID: c487c9fa1e9afb87366c1b148d14351f87e6f3e89ddbdc8a1e0c3778002b8b72
Instruction ID: e392c769357d74c7cb0e8da2cb70d10442ea48cde3856dc7faeb71697ce32a0a
Opcode Fuzzy Hash: c487c9fa1e9afb87366c1b148d14351f87e6f3e89ddbdc8a1e0c3778002b8b72
Instruction Fuzzy Hash: 9A519E71900249DFDF20CF99C5417AEBBB0FB14318F24845ED805AB382D7B9AE49CB95

Function 004AFE4C Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004AFF6B
___TypeMatch.LIBVCRUNTIME ref: 004B0079
CallUnexpected.LIBVCRUNTIME ref: 004B01E6

Strings

csm, xrefs: 004AFFA2
csm, xrefs: 004AFEF6
csm, xrefs: 004AFE89
<fM, xrefs: 004AFF62

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: <fM$csm$csm$csm
API String ID: 1206542248-3599101812
Opcode ID: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction ID: 5ce913a956d0af8773c3ee17d9b542f15401108c10c26080aa375b564815456b
Opcode Fuzzy Hash: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction Fuzzy Hash: DBB19B71800209EFCF18DFA5C8809EFB7B5FF25315B10816BE8056B212D779DA15CBA9

Function 0047CF70 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0047D113
Concurrency::cancel_current_task.LIBCPMT ref: 0047D118
Concurrency::cancel_current_task.LIBCPMT ref: 0047D11D

Strings

`aC, xrefs: 0047D015
p]C, xrefs: 0047D008
false, xrefs: 0047D092
true, xrefs: 0047D0B8

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$false$p]C$true
API String ID: 118556049-4224333681
Opcode ID: 226f2742ad4bb82513da97dc0ea37b247d6440e1a842af39628b989b3fbf377a
Instruction ID: 10a02a47a4876ff195f080d04569540bf2a908c30d6efafbe52ebceab6b25fd0
Opcode Fuzzy Hash: 226f2742ad4bb82513da97dc0ea37b247d6440e1a842af39628b989b3fbf377a
Instruction Fuzzy Hash: 73510871910745DBDB20DF65C801B9EBBF4EF04718F20862FE815A7781E7BAAA04CB95

Function 0047C6C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047C6FD
std::_Lockit::_Lockit.LIBCPMT ref: 0047C71F
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C747
std::_Facet_Register.LIBCPMT ref: 0047C834
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C85E

Strings

p]C, xrefs: 0047C7E1
`aC, xrefs: 0047C7EE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: `aC$p]C
API String ID: 459529453-1363152631
Opcode ID: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction ID: 399bbb442a0c6c40ac274560e971594f6ebfe9651e6100c107b7a0aaef0602e2
Opcode Fuzzy Hash: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction Fuzzy Hash: 2C517A71900249DFDB15CF99C580BEEBBB4EB15318F24805ED409AB381DB79AE09CF95

Function 0047D190 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(File Downloader,00000001,00000000,00000000,00000000), ref: 0047D22D
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 0047D256
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D27C
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D2B2
InternetCloseHandle.WININET(00000000), ref: 0047D2B9
InternetCloseHandle.WININET(?), ref: 0047D2C5

Strings

File Downloader, xrefs: 0047D214

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction ID: 638e9360adee8abd238f5bb9f06079602c51a7af3a4d5d450420b7b82b1eb562
Opcode Fuzzy Hash: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction Fuzzy Hash: 5B318370A01655ABD730CF55CC45BEAB7B8EF44700F1041AAF549E7290DBB8AE84DFA8

Function 009AF878 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,009AF863,?,?,?,?,?,?,?,?,?), ref: 009AF91E
__alloca_probe_16.LIBCMT ref: 009AF9D9
__alloca_probe_16.LIBCMT ref: 009AFA68
__freea.LIBCMT ref: 009AFAB3
__freea.LIBCMT ref: 009AFAB9
__freea.LIBCMT ref: 009AFAEF
__freea.LIBCMT ref: 009AFAF5
__freea.LIBCMT ref: 009AFB05

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 66c2045ab667004fc2a2b3dbb927fae724643db204ecb98fddca6388b50e31b3
Instruction ID: 30098e30e494c8bad2174f3113632eeb4d6fe41f97203ac291abca1d767197d7
Opcode Fuzzy Hash: 66c2045ab667004fc2a2b3dbb927fae724643db204ecb98fddca6388b50e31b3
Instruction Fuzzy Hash: B871A372A002066BDF209BD4CC71BEF77BD9F8B314F294465E959A7282E7359C0087E0

Function 004B9D99 Relevance: 12.2, APIs: 8, Instructions: 225COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 004B9E24
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9EB0
__alloca_probe_16.LIBCMT ref: 004B9EDA
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F1B
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9F37
__alloca_probe_16.LIBCMT ref: 004B9F5D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F9A
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004B9FB7

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction ID: 05f54580d30f9e3720c8b3961695daa3f0f937b9c5610d8c2bd80885558d9d7b
Opcode Fuzzy Hash: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction Fuzzy Hash: 7871AE3290021AABDF219F65CC85BFF7BB9AF05724F18405BEA04E6291D7398C40C7B9

Function 004B9AF7 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004B9B40
__alloca_probe_16.LIBCMT ref: 004B9B6C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004B9BAB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9BC8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004B9C07
__alloca_probe_16.LIBCMT ref: 004B9C24
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9C66
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004B9C89

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction ID: 0cb7a2a667138b596a59e049b57baa22d652deda395932da07ab0cb8239329c9
Opcode Fuzzy Hash: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction Fuzzy Hash: A151BF7250020AABEF219F65CC44FEB7FB9EF50740F24412AFA05A6260D7399C11CB68

Function 00489F30 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00489F4B
GetProcessId.KERNEL32(00000000), ref: 00489F52
RmStartSession.RSTRTMGR(?,00000041,?), ref: 00489F76
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000), ref: 00489F91
RmGetList.RSTRTMGR(?,?,?,00000003,?), ref: 00489FD4
RmGetList.RSTRTMGR(?,?,?,00000000,?), ref: 0048A020
RmEndSession.RSTRTMGR(?), ref: 0048A04A
RmEndSession.RSTRTMGR(?), ref: 0048A07A

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction ID: 0c548674b0cea8079c7009f79d794e669f8d4684f59b10cf2f6688a8c9d6d6ed
Opcode Fuzzy Hash: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction Fuzzy Hash: A7417971E011589BEF10AFE4DC44AEEBBBCEB45300F14412BE902EB254EB7A9C058B95

Function 00473B90 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00473D56
___std_exception_destroy.LIBVCRUNTIME ref: 00473D73

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,A3776857), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 00473FC0
___std_exception_destroy.LIBVCRUNTIME ref: 00473FDD

Strings

value, xrefs: 00473C96, 00473EF5
MC, xrefs: 00473D4C, 00473D68, 00473FB6, 00473FD2

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction ID: 838f8dd16b3ea7f4eeb45613560c02c2ef3b01355b1a5592379bf0a45a67ceab
Opcode Fuzzy Hash: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction Fuzzy Hash: 31F15A70C05298DEEB20DB65C954BDEFBB4AF19304F1482DAD44963282E7746B88CF96

Function 004AD600 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004AD637
___except_validate_context_record.LIBVCRUNTIME ref: 004AD63F
_ValidateLocalCookies.LIBCMT ref: 004AD6C8
__IsNonwritableInCurrentImage.LIBCMT ref: 004AD6F3
_ValidateLocalCookies.LIBCMT ref: 004AD748

Strings

csm, xrefs: 004AD6DD

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction ID: fca86a332ffc7d642b39a5fdc798139505592cae81a3a9a41e25a428a24f43dc
Opcode Fuzzy Hash: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction Fuzzy Hash: 2741D834E002089BCF10DF69C880A9E7BB5BF66318F14815BE81A5B752D739EA01CF95

Function 009A94CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,009A95DD,009A2442,?,00000000,?), ref: 009A958F

Strings

ext-ms-, xrefs: 009A9539
api-ms-, xrefs: 009A9525

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction ID: a85474ac283111abf3178413e80806fcab9311c6e02d78736d2aacf71f32731b
Opcode Fuzzy Hash: 0e99e8badce70df9c4b67e051f210c43ced481fe4fdfe5e71ade84ba4e377cb8
Instruction Fuzzy Hash: 1A215035E05211A7C7229B64DC41A6E77ACFB8B7B1F140610FD06A72D1DB70EE01D6D0

Function 0049C8FA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0049CA09,0043FE48,00434C2F,00000000,00000001,0043FE4A,?,0049CC33,00000022,FlsSetValue,004D294C,FlsSetValue,00000001), ref: 0049C9BB

Strings

ext-ms-, xrefs: 0049C965
api-ms-, xrefs: 0049C951

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction ID: 9ca0f964f7470424b5d3057a4191f763ac6aa624da693043a33dcdca32e519f2
Opcode Fuzzy Hash: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction Fuzzy Hash: A621E7B2A01211ABDF219B25ECC0B5F3B69AB527A4F250237E905A7390D738ED01C6DD

Function 00436640 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,A3776857), ref: 004AFA6C

Strings

0hC, xrefs: 004366E3
ios_base::eofbit set, xrefs: 00436686
ios_base::badbit set, xrefs: 00436677, 004366A2
ios_base::failbit set, xrefs: 00436681
(>Q, xrefs: 004366D9

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: (>Q$0hC$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-798308736
Opcode ID: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction ID: 0e9c3b5a5aba75944b05d252eccadd5948fd44e578ec9c0118fa22ff265feac2
Opcode Fuzzy Hash: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction Fuzzy Hash: 4E1122B29046487BD710DB59DC02FAA7398EB09754F04862FFD58872C1EB3DA90487AA

Function 009A489F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 009A48A5
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 009A48B3
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 009A48C4

Strings

kernel32.dll, xrefs: 009A48A0
GetTempPath2W, xrefs: 009A48B9
GetSystemTimePreciseAsFileTime, xrefs: 009A48AD

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction ID: b34c87e8097b9f3c3ee6df09a95954731a0815f6fec601da13503c03224605d2
Opcode Fuzzy Hash: 6366e455a1c2425314bd5bf836dc33e732c56d134ae75d47ce7b7e389994a890
Instruction Fuzzy Hash: 80D09E316AA620AF8350AF747F0D8DB7EA9EB496B53064216F511E2261DBB44504DB90

Function 0049D57F Relevance: 9.3, APIs: 6, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction ID: c45b587b2b6024bbc8d631f61cfde13028adc071dc65d72902c8bf59655bd6a7
Opcode Fuzzy Hash: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction Fuzzy Hash: 64B13572D00255AFDF11DF64CC81BAA7FA5EF55310F1441BBE454AB382D2789D01C7A9

Function 004A2113 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004A21FD
__freea.LIBCMT ref: 004A228D
__freea.LIBCMT ref: 004A22A9

Strings

am/pm, xrefs: 004A230B
a/p, xrefs: 004A236F

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 35938f08404c0012c28b8581547da92bcaa7faac22c368983132e0e6ea66d68e
Instruction ID: 1d0f90a389a6ddb01c6eee3cfed114d4cdbff39c5c4e16d1e763b1923b69fac5
Opcode Fuzzy Hash: 35938f08404c0012c28b8581547da92bcaa7faac22c368983132e0e6ea66d68e
Instruction Fuzzy Hash: 32C1BF35904212AADB298F6CCA947BB77B0FF2B300F14405BE905AB750D3BD9D42EB59

Function 0047CCA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047CCD6
std::_Lockit::_Lockit.LIBCPMT ref: 0047CCF9
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CD21
std::_Facet_Register.LIBCPMT ref: 0047CD9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CDC4
Concurrency::cancel_current_task.LIBCPMT ref: 0047CDE7

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction ID: 5e0d328f53af4ec2248f8036dfe48c657d56e4526373956cc4eb9e978e4c29ea
Opcode Fuzzy Hash: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction Fuzzy Hash: FE419A71800219CFCB21CF98C980BEFBBB4EB15714F14856ED80A67381D738AE04CBA5

Function 009A7F49 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009A7F40,009A5A6B,009A5180), ref: 009A7F57
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009A7F65
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009A7F7E
SetLastError.KERNEL32(00000000,009A7F40,009A5A6B,009A5180), ref: 009A7FD0

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 281f552aa3e2bba910b2761de8ffc0b960c37172d35ba76c85da1259be1d8516
Instruction ID: 0347aee122adfd4ccf86276ea0daabdae4a8c1a56758d8923d5243ba4a158e74
Opcode Fuzzy Hash: 281f552aa3e2bba910b2761de8ffc0b960c37172d35ba76c85da1259be1d8516
Instruction Fuzzy Hash: D701F77251D2127EE61527F4ADCBA67BBACDB877B47200339F410450F0EF114C02A1D0

Function 004AFADE Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004AFAD5,004AF923,004AC85A), ref: 004AFAEC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004AFAFA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004AFB13
SetLastError.KERNEL32(00000000,004AFAD5,004AF923,004AC85A), ref: 004AFB65

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction ID: 5c97271c99781371f32c50c56a2d0a191a69233ae1c55058bab721689d3f3b0d
Opcode Fuzzy Hash: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction Fuzzy Hash: 9001F9321093119E9A2417F5AC559972A65EB23379B24463FF514951E0FB1A5C0CA16C

Function 00480AC0 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00480B31
EnterCriticalSection.KERNEL32(00000004,A3776857,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B42
EnterCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B4F
GdiplusShutdown.GDIPLUS(00000000,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B5C
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B69
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B70

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction ID: a49544f5ea7446c9cfb95f09875386710a40740b290a3353e41ff902735902d1
Opcode Fuzzy Hash: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction Fuzzy Hash: 8B117FB15002009FD3209F58D848B1A7BF8FF05728F20475EE4258B2D1C77AD806CB94

Function 009A87D9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009A88F8
CallUnexpected.LIBVCRUNTIME ref: 009A8B71

Strings

csm, xrefs: 009A8883
csm, xrefs: 009A8816
csm, xrefs: 009A892F

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 87f1fc4f14b7b672f31a012a42c7667304171c4bef2b4a6e03036138273d3faf
Instruction ID: 40b251a1df3fc350a080cf0c510fc48fb691ece20f5d9b8013d5b25cd9ef1f62
Opcode Fuzzy Hash: 87f1fc4f14b7b672f31a012a42c7667304171c4bef2b4a6e03036138273d3faf
Instruction Fuzzy Hash: F4B16B71800209EFCF18DFA4C881AAFBBB9FF86310F55455AE8116B212DB35DA51CBE1

Function 009A6A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,009B1B77,000000FF,?,009A6B21,?,?,009A6BBD,00000000), ref: 009A6A95
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009A6AA7
FreeLibrary.KERNEL32(00000000,?,00000000,009B1B77,000000FF,?,009A6B21,?,?,009A6BBD,00000000), ref: 009A6AC9

Strings

mscoree.dll, xrefs: 009A6A8E
CorExitProcess, xrefs: 009A6A9F

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction ID: c90c5b911599311d384dfbf4fb694a9f234e078919072ae645309173d3991b86
Opcode Fuzzy Hash: 7d63168e1692feb74dcc8dbb6cd0dcf457e2405ba8de0dedf1f7960ac364a64b
Instruction Fuzzy Hash: B3018431958519EBCB119F80CD05FBEB7BCFB48B64F084625A811A2290DB749804CA84

Function 004A2923 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A3776857,00000001,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A2958
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004A296A
FreeLibrary.KERNEL32(00000000,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A298C

Strings

mscoree.dll, xrefs: 004A2951
CorExitProcess, xrefs: 004A2962

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction ID: 4a39d6f0df0723e62e133a2fe4a12dc63d6bfdc81165c834358a2709fa0273f6
Opcode Fuzzy Hash: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction Fuzzy Hash: DA01A271A10625AFCB118F54DC05FAFBBBCFB04B10F044627E812A2790DBB89900DA98

Function 004B82A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,A3776857,?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3), ref: 004B82C9
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004B82D5
GetTempPathW.KERNEL32(?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3,?,00000105,?), ref: 004B82F5

Strings

GetTempPath2W, xrefs: 004B82CF
kernel32.dll, xrefs: 004B82C4

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressHandleModulePathProcTemp
String ID: GetTempPath2W$kernel32.dll
API String ID: 775647363-1846531799
Opcode ID: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction ID: 490c9918516094a75be01d3e1b1e27de5ce3fa518d230e70400d3a931493a6c9
Opcode Fuzzy Hash: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction Fuzzy Hash: C2F03A36A44654EFCB159F54EC05F9A7BA8FB09B60F008127EC16937A0DB79A800CB98

Function 009AD525 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009AD5AA
__alloca_probe_16.LIBCMT ref: 009AD673
__freea.LIBCMT ref: 009AD6DA

Part of subcall function 009AB3B5: HeapAlloc.KERNEL32(00000000,?,00000000,?,009A3C34,?,?,009A2442,00001000,?,009A23AA), ref: 009AB3E7

__freea.LIBCMT ref: 009AD6ED
__freea.LIBCMT ref: 009AD6FA

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: fb6ccc1f44cfa263671bc2f080c10c131e6f44dde1aa271b8fccc8823994c60b
Instruction ID: 274e42a4a04f457c7af23c7a05c44a0231417b70685d8ef8d5a8b197426a4369
Opcode Fuzzy Hash: fb6ccc1f44cfa263671bc2f080c10c131e6f44dde1aa271b8fccc8823994c60b
Instruction Fuzzy Hash: 0951C372602246AFEF205F64CC81EBB37ADEF8A714B190529FD0AD6551EB75CC10C6E0

Function 0049AEB4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0049AF39
__alloca_probe_16.LIBCMT ref: 0049B002
__freea.LIBCMT ref: 0049B069

Part of subcall function 0049D15A: RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

__freea.LIBCMT ref: 0049B07C
__freea.LIBCMT ref: 0049B089

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 1cf292f1027faf516ea3b58fb1ffeacfcc17b82ad5c767b33ec64858519d3555
Instruction ID: c461f83b43c969d084823d86eb7d78e4c690f12dee5ba4d22df99f96e1ee22eb
Opcode Fuzzy Hash: 1cf292f1027faf516ea3b58fb1ffeacfcc17b82ad5c767b33ec64858519d3555
Instruction Fuzzy Hash: 4C510072600206AFEF209F65AD81EBB7EA9EF84314F15013EFC54D6241EB39DC5086E8

Function 009A1930 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 009A1A01
CloseHandle.KERNEL32 ref: 009A1A1E

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction ID: 01dbf0d9918108c55e6b4145a7798ef981f9bb530ca0a367eb947cb308af8286
Opcode Fuzzy Hash: e7a0f46eda6453ebd68a833ffb67dbd4de7585f44c9e0d5de09304607996d4a6
Instruction Fuzzy Hash: F481F0B4D0A258DFCB00DFA8D584BAEBBF0BF4A314F104929E455A7381D7789948CF96

Function 009A46F6 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009A470A
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4729
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A4757
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47B2
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009B1B20,000000FF,?,009A3552), ref: 009A47C9

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 53051a53eabd8cee83fbd22a4ece7b05ce4620da44ef1abb01ea11faf3ccf3a5
Instruction ID: 3ca6a88fedcde88c12fcad319cb7f3d8516d2de825da09f77564b99f192a8789
Opcode Fuzzy Hash: 53051a53eabd8cee83fbd22a4ece7b05ce4620da44ef1abb01ea11faf3ccf3a5
Instruction Fuzzy Hash: 51414A30910686DFCB20DF69D984AAAB3F9FF87310B504A2AD45697A40D7B4F944CFD1

Function 004B9258 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B925F
std::_Lockit::_Lockit.LIBCPMT ref: 004B926A
std::_Lockit::~_Lockit.LIBCPMT ref: 004B92D8

Part of subcall function 004B93BB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004B93D3

std::locale::_Setgloballocale.LIBCPMT ref: 004B9285
_Yarn.LIBCPMT ref: 004B929B

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction ID: d57bef6452a6d9f87b7c1f6c81a415e25ff1084f0ba862d3ffc406506ccaed08
Opcode Fuzzy Hash: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction Fuzzy Hash: 2101BC75A002149BDB09EF21E881ABE3BA5BF95714B18400EE90157381CF78AE42DBE9

Function 009AD200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748), ref: 009AD20D
GetLastError.KERNEL32(?,009AD29C,00000000,?,009BB728,?,?,?,009AD1D3,00000004,InitializeCriticalSectionEx,009B3740,009B3748,00000000,?,009A8E2C), ref: 009AD217
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009AD23F

Strings

api-ms-, xrefs: 009AD224

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction ID: d79eb59beefabec8c9a5e5fc1b309fdebffbf904ceb2f1ce7c05f0f86d008f97
Opcode Fuzzy Hash: c13a7fbc7559e75b812d1a5d439fddb9235507ff01fa104e143ad029c76890b1
Instruction Fuzzy Hash: 75E0D870298204B7DF112F50DC06FA93F6C9B85BA0F140020FD0DE44E1DB71E995D5C0

Function 004B0B2E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC), ref: 004B0B3B
GetLastError.KERNEL32(?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC,00000000,?,004B0A39), ref: 004B0B45
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004B0B6D

Strings

api-ms-, xrefs: 004B0B52

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction ID: d85af749d3a2776d246a861fdd0c76bc3b777c55ee5f54f02c25fa514b149693
Opcode Fuzzy Hash: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction Fuzzy Hash: 25E04F30284305B7EF221BA1EC0AF5E3B55AB11B49F144032F90CA91E1EBA6A910859C

Function 0047F2C0 Relevance: 6.5, APIs: 4, Instructions: 457registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0051C570,00000000,00020019,00000000,?,?,?,A3776857,?,0051C2A0), ref: 0047F4D0
RegQueryValueExA.ADVAPI32(00000000,0051C2A0,00000000,000F003F,?,00000400,?,?,?,A3776857,?,0051C2A0), ref: 0047F506
RegCloseKey.ADVAPI32(00000000,?,?,?,A3776857,?,0051C2A0), ref: 0047F5A4
SysFreeString.OLEAUT32 ref: 0047FA14

Part of subcall function 0047A610: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
Part of subcall function 0047A610: LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,A3776857,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FreeOpenQueryValue$CloseCryptDataLocalStringUnprotect
String ID:
API String ID: 2380017125-0
Opcode ID: a521d0abf644b9380dcd8d70f5715900671aedad0facd1908bb1e921974b8b3c
Instruction ID: 56cbdaf4eb2024de0fd4bd59dbcd72090a4e5b75bdf23aa4f75e7a392944198d
Opcode Fuzzy Hash: a521d0abf644b9380dcd8d70f5715900671aedad0facd1908bb1e921974b8b3c
Instruction Fuzzy Hash: 24122BF0E002689BDB24DF24CC5479DB7B5AF44318F1086EAD64DA7282DB346E88CF59

Function 009ADCA8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 009ADD0B

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009ADF5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009ADFA3
GetLastError.KERNEL32 ref: 009AE046

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 73e470fc6ae406cb9819989194ef813d03dc4a33c27d07c03cdd2bae79a8cd94
Instruction ID: ab360b0bec38862491303f8b94eb5905db546f83b05f4926d5eec648f4170ce5
Opcode Fuzzy Hash: 73e470fc6ae406cb9819989194ef813d03dc4a33c27d07c03cdd2bae79a8cd94
Instruction Fuzzy Hash: 20D1AF75D042589FCF14CFA8C9809EDBBB9FF4A314F28452AE416EB751D730A942CB90

Function 0049B476 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A3776857,00000000,00000000,00000000), ref: 0049B4D9

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0049B72B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0049B771
GetLastError.KERNEL32 ref: 0049B814

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction ID: 17746d06032e39ca1db24970b21defb679d9c3d722e4804f7fdb3bafa319cb4d
Opcode Fuzzy Hash: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction Fuzzy Hash: 15D17A75D002489FCF05CFE9E980AEDBBB5EF49314F18816AE425EB351D734A906CB94

Function 00478300 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00477B00: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,A3776857,?,?), ref: 00477B54
Part of subcall function 00477B00: Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Part of subcall function 00477B00: CloseHandle.KERNEL32(00000000), ref: 00477E84

ImpersonateLoggedOnUser.ADVAPI32(00000000,A3776857,?,00000000), ref: 00478391

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleImpersonateLoggedProcess32SnapshotToolhelp32User
String ID:
API String ID: 1507787261-0
Opcode ID: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction ID: e502c6a69380433c55fd31efa36561dbf437e01bd72b95285a5588c942f2c0dc
Opcode Fuzzy Hash: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction Fuzzy Hash: F5F17070C0428DDEEB15DBA4C8587DDBBB0AF15308F24819ED04977292DB785F88DBA6

Function 0048A490 Relevance: 6.2, APIs: 4, Instructions: 195COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(A3776857), ref: 0048A4E4
FreeEnvironmentStringsW.KERNEL32(?), ref: 0048A685
RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction ID: 1a99e4392def1b605416f46e3147960cb17592dd8275db88d5f878599104deaf
Opcode Fuzzy Hash: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction Fuzzy Hash: 6471AAB1C10219EBDB00DF98C884B9EFBF8FF18304F14461BE815A3250E7B8A995CB95

Function 009A8500 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009A85C7
___AdjustPointer.LIBCMT ref: 009A85EA
___AdjustPointer.LIBCMT ref: 009A8686

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0608e06d263ec731d7ffd192b23052bf33a42abc4f5907356db316f8c3da7dec
Instruction ID: 64eb0d958b18bc1c6ef1e9a5ab8750c24b95537435cdfc67330fac35c1d6284f
Opcode Fuzzy Hash: 0608e06d263ec731d7ffd192b23052bf33a42abc4f5907356db316f8c3da7dec
Instruction Fuzzy Hash: AB51E272A05606AFEB298F54D941BBB77A8FF46310F15456DEC02972A1EB31EC50CBD0

Function 004AFBF5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004AFCBC
___AdjustPointer.LIBCMT ref: 004AFCDF
___AdjustPointer.LIBCMT ref: 004AFD7B

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction ID: 33b3d652e50ecda4e79a0ecf225597f03c3ffd3297545ef1ce997a4b46d38663
Opcode Fuzzy Hash: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction Fuzzy Hash: AF51D0B150020A9FEB269FD1D881BAA77A4FF62718F10003EEC434B291D739E849C798

Function 004A077A Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction ID: 6bad779769d7c9384c33fcc5b288381071ef860472916b423066c301ca7f7ee1
Opcode Fuzzy Hash: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction Fuzzy Hash: D141E675A00704AFDB24AF39CC41B6BBBA9EB99714F20452FF101DB781D77DA9418B88

Function 009ABD28 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

GetLastError.KERNEL32 ref: 009ABD8C
__dosmaperr.LIBCMT ref: 009ABD93
GetLastError.KERNEL32(?,?,?,?), ref: 009ABDCD
__dosmaperr.LIBCMT ref: 009ABDD4

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 5fda42d8140670587ea3416d774c610875c0cdd6baed5a2579ed69048ad89bad
Instruction ID: eccb56bab440cbaf77b51c30396320524af657333288217487c52a5cea59894d
Opcode Fuzzy Hash: 5fda42d8140670587ea3416d774c610875c0cdd6baed5a2579ed69048ad89bad
Instruction Fuzzy Hash: AF21A4B1600206BFDB20AF66C881E6BB7ADFF463687118919F81997192D734EC40DBD1

Function 004BA942 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

GetLastError.KERNEL32 ref: 004BA9A6
__dosmaperr.LIBCMT ref: 004BA9AD
GetLastError.KERNEL32(?,?,?,?), ref: 004BA9E7
__dosmaperr.LIBCMT ref: 004BA9EE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction ID: cdbbd9429668cd5750c88df838a7d8834fbfbf28e86e5927cf8d45539b4e27df
Opcode Fuzzy Hash: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction Fuzzy Hash: 7A21C871600605AF8F21AF66CC809ABBBADFF44368711492FF91597210D739EC60D7BA

Function 009AC2C4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b36e937bdd9776a463f892bead2d884e1ea2d5982c9dc011e0f8e74fc37fdd2
Instruction ID: 05507d55ab378ad77012b7e0a0c70fbd9d7593f76e689c04475c192514aa4026
Opcode Fuzzy Hash: 1b36e937bdd9776a463f892bead2d884e1ea2d5982c9dc011e0f8e74fc37fdd2
Instruction Fuzzy Hash: 8C216DB1604205AFDF20AFB5C881A6B77ADAF463687108A15F929EB151DB35EC40CBE1

Function 004989A8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction ID: 5e5224636d54f024fd63f309ffc809bb58d9736df3a284f1f4315f29edb86acb
Opcode Fuzzy Hash: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction Fuzzy Hash: F321A171600205AFCF21EF6ADC4496B7FA9AF42368720453FF91597251EF38ED008799

Function 009AC99D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009AC9A5

Part of subcall function 009AC8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009AD6D0,?,00000000,-00000008), ref: 009AC902

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009AC9FD

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 8098251112c1c5f0566b1b0367e24e7eebd626d49e3c06392a087f3dff8de54c
Instruction ID: 349e1d20f2aeed0942e84ce737000675205ba597ec21927584cdadd0c8e2ab8b
Opcode Fuzzy Hash: 8098251112c1c5f0566b1b0367e24e7eebd626d49e3c06392a087f3dff8de54c
Instruction Fuzzy Hash: F31104F5915219BF6611A7B59C8DCBF695CDEDB3A43110124F401E9200EA28CD0291F1

Function 004AB379 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004AB381

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3B9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3D9

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 69a85f7ed18cd74047bb984129651c996d53830a83c410699db2c70aab7f3113
Instruction ID: 352b9fd8ff6adfd48aa864b65f723ba5a946c2f7c3dd1541d1c3166fed4ac287
Opcode Fuzzy Hash: 69a85f7ed18cd74047bb984129651c996d53830a83c410699db2c70aab7f3113
Instruction Fuzzy Hash: B21156B19015157E7A1167B65C8AD6F6A5CDE5A398B10403BF801D1203EB7D9D0245BA

Function 009A1E00 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009A1E2D
GetCurrentThreadId.KERNEL32 ref: 009A1E3B
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E54
std::_Throw_Cpp_error.LIBCPMT ref: 009A1E93

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: cc8fa3324f5e6e9cf97eafe75bd973bf7bfbd8721fdcb9206dbbfcb1e8563e0c
Instruction ID: e28c2aeaaf5c3a040c85ecc6c965378effdf32fa309211f74cfd85a1637c5f8b
Opcode Fuzzy Hash: cc8fa3324f5e6e9cf97eafe75bd973bf7bfbd8721fdcb9206dbbfcb1e8563e0c
Instruction Fuzzy Hash: 3121E4B0E042098FCB04EFA8C5857AEBBF5EF89300F11845DE849AB351D7389A41CF91

Function 004B8430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000400,A3776857,00000000,00000000,00000000,00000000,00000000,00000001,?,?,0044E5F3,?,?,00000000,00000000), ref: 004B844D
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,A3776857,00000001), ref: 004B8459
WideCharToMultiByte.KERNEL32(00000001,00000000,A3776857,00000000,00000000,00000000,00000000,00000000,?,?,0044E5F3,?,?,00000000,00000000,00000000), ref: 004B847F
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,A3776857,00000001), ref: 004B848B

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction ID: 6b90caf3a67b14ffb57c64759c70b961d31bb881305e702148557666a2de5e43
Opcode Fuzzy Hash: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction Fuzzy Hash: FB01BF36601156BFCF224F95DC08E9F3F7AEBD9791F118029FA0556220DA31C922EBA5

Function 009AFD00 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000), ref: 009AFD17
GetLastError.KERNEL32(?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?,?,009AD9E0,00000000), ref: 009AFD23

Part of subcall function 009AFD74: CloseHandle.KERNEL32(FFFFFFFE,009AFD33,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?,?), ref: 009AFD84

___initconout.LIBCMT ref: 009AFD33

Part of subcall function 009AFD55: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009AFCF1,009AF48E,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD68

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,009AF4A1,00000000,00000001,00000000,?,?,009AE09A,?,00000000,00000000,?), ref: 009AFD48

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction ID: d5653beaa3dc4be1b3262693e083b589b4e8550667f4f386525d479a7ba7cda1
Opcode Fuzzy Hash: d6f1525b94508d24b2a45aa02a8c9516825b96381f8c342c01f81905a513bb93
Instruction Fuzzy Hash: C0F01C36414116BBCF232FD1DD08A8A3F6AFB493B1B004220FA0985570DB32C860EBD1

Function 004A95E5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000), ref: 004A95FC
GetLastError.KERNEL32(?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000,?,0049BE42,?), ref: 004A9608

Part of subcall function 004A95CE: CloseHandle.KERNEL32(FFFFFFFE,004A9618,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000), ref: 004A95DE

___initconout.LIBCMT ref: 004A9618

Part of subcall function 004A9590: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004A95BF,004A6707,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A95A3

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A962D

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction ID: 8abc0c58445a332f8c6052495b9482a66327941653e6e46fd38a52645a0d97bb
Opcode Fuzzy Hash: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction Fuzzy Hash: DCF01237441215BBCF521F91DC09ACE3F66EF19364F024426FA2C86120C6368D60DB94

Function 009A4F01 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009A4F13
GetCurrentThreadId.KERNEL32 ref: 009A4F22
GetCurrentProcessId.KERNEL32 ref: 009A4F2B
QueryPerformanceCounter.KERNEL32(?), ref: 009A4F38

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction ID: 249e697ac7c80175cdc73755d8fdc4735cdd91e78fe27fa41fa217d7d6f19e67
Opcode Fuzzy Hash: c43107a0de4d10705e95ba942a31e8dc3266f3e6c49f136c7866392ff9c7a23f
Instruction Fuzzy Hash: 9CF06774D1420DEBCB00EBB4DA49ADFB7F8FF1D254B514A95A412E7110EB30A748EB51

Function 009A8BFD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,009A8AFE,?,?,00000000,00000000,00000000,?), ref: 009A8C22

Strings

MOC, xrefs: 009A8C34
RCC, xrefs: 009A8C3C

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 80a7fc5bd5597a9261ff03ebcc6357136f0c861b9187391962db0f0d0d0e8e72
Instruction ID: 390a7c09216b659692ea9dda0a0bb16a51e3ea6b253e92099ff5ed3820b8f932
Opcode Fuzzy Hash: 80a7fc5bd5597a9261ff03ebcc6357136f0c861b9187391962db0f0d0d0e8e72
Instruction Fuzzy Hash: 8A41AB71900209AFCF15CF94CD81AEEBBBAFF49310F144168F90467291D7359A50CFA0

Function 00453E10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00453EF4

Strings

`aC, xrefs: 00453F48
p]C, xrefs: 00453F59

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$p]C
API String ID: 118556049-1363152631
Opcode ID: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction ID: 7ffd0bf130dfa3baccabcf7c02000b8885a72f27ff8372dee48aba471c76e642
Opcode Fuzzy Hash: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction Fuzzy Hash: 2B4114B1D002089BCB24DF58C841BAFBBF4EF45354F10426FEC2597382E7799A148B95

Function 004B01F1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004B0216

Strings

MOC, xrefs: 004B0228
RCC, xrefs: 004B0230

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction ID: 70788f387beb527cb8114cdc5e5f216b8ccff70d73c61da87df7ae4bd57bd2ae
Opcode Fuzzy Hash: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction Fuzzy Hash: EE415871900209AFCF16CF98CD85AEEBBB5FF48305F18809AFA0567211D3399950DB68

Function 009A8469 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009A86E0

Strings

csm, xrefs: 009A8702
csm, xrefs: 009A8773

Memory Dump Source

Source File: 00000002.00000002.1893004138.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000002.00000002.1892985604.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893024106.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893041186.00000000009BA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893092832.00000000009BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1893108883.00000000009C0000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a0000_drop1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction ID: e5eb7fef57c388b1591a1162c3e1c9b1a461c8bec64cc51ab6a3ef1869e36f37
Opcode Fuzzy Hash: 0184664f765ff3d07132a4e256fbcff4f1cf2ed483d85a8d22925c716202b8aa
Instruction Fuzzy Hash: 7831C436400219DFCF268F50CC449ABBBAAFF4A365B38455AF85449221DB36CCA1DFD1

Function 00435DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00435DCB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00435E2E

Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9375
Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9399

Strings

bad locale name, xrefs: 00435E51

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction ID: 3ec4c6a4a97d0462a05707b65000259191fcf5f6abdba4908dc577763c239046
Opcode Fuzzy Hash: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction Fuzzy Hash: 3B210570805784DFD320CF69C90478BBFF4AF15714F14868ED48597781D3B9AA04CBA5

Function 0047DD40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DDD1

Strings

.G, xrefs: 0047DD75
0hC, xrefs: 0047DDCB

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction ID: def2e33cd38b5e824c816681f9ae39c6530dfa40910c99229239c839cc9e5e1b
Opcode Fuzzy Hash: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction Fuzzy Hash: 9B21AE74940245DFD720CF1AC844B99FBF8FF05324F148A6EE85597391D775A904CB84

Function 0044BEB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0044BEF3
___std_exception_copy.LIBVCRUNTIME ref: 0044BF26

Strings

MC, xrefs: 0044BEE4, 0044BF17

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction ID: 159077f32092c3bc03b4ae882dbf743a881f4ebbd8d79b989d6de070d85d5faa
Opcode Fuzzy Hash: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction Fuzzy Hash: 4E112EB5900649EFCB11CF59C980B86FBE8FF19320F10C66BE815A7640E7B4A944CBA4

Function 004827A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0048285D

Strings

0hC, xrefs: 00482852
0, xrefs: 004827FE

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC
API String ID: 323602529-784950247
Opcode ID: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction ID: dd26a1c23eadb7639fef0861fdc2b6c05f84c76fd28c7669f454e47aafc92c53
Opcode Fuzzy Hash: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction Fuzzy Hash: FC21F074905298CFCB10CF98C6887DCBBF0AB09308F2480EAD949A7381D775AE58CF55

Function 0047D9C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DA4F

Strings

.G, xrefs: 0047D9F2
0hC, xrefs: 0047DA49

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction ID: 8e7f9f1aa37db0bf33048e17fc0a06a73726813013154025c8e8923a4ade326e
Opcode Fuzzy Hash: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction Fuzzy Hash: 121149B4940744CFDB21CF49C984A99BBF8FB09324F108A5EE89697391D775AA44CF80

Function 00438A00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438A46
___std_exception_destroy.LIBVCRUNTIME ref: 00438A5C

Strings

MC, xrefs: 00438A3C, 00438A56

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction ID: 2156576f1eef92af9ffbb3102a1cf8c86cd110feba5e05fe60ab6789c6c907d6
Opcode Fuzzy Hash: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction Fuzzy Hash: 5A01B5B1C44318EBC710DF58DD01B8ABBE8EB1A714F10466FE811E3780E779A60487A5

Function 00438CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D06
___std_exception_destroy.LIBVCRUNTIME ref: 00438D1C

Strings

MC, xrefs: 00438CFC, 00438D16

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction ID: 34d925613d03c46ca24c24dcd021453886a1a957fa2bd66f6c30760aa6902abf
Opcode Fuzzy Hash: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction Fuzzy Hash: 050192B1C443189BC711DF58DD05B89BBE8EB1A714F14466FE811A3780E7B9A60487A5

Function 00438DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438E16
___std_exception_destroy.LIBVCRUNTIME ref: 00438E2C

Strings

MC, xrefs: 00438E0C, 00438E26

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction ID: 81858840e3503bfd15470ad0d796ddf3043ff6da9bec83e018f38d9446b02dde
Opcode Fuzzy Hash: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction Fuzzy Hash: 4A01D2B1C442089FC710DF58DD01B8ABBE8EB1A714F10426FE811E3780E7B9A60487A5

Function 00438A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438AD6
___std_exception_destroy.LIBVCRUNTIME ref: 00438AEC

Strings

MC, xrefs: 00438ACC, 00438AE6

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction ID: 14708e90e5e2dd6187806a9d8007313cf644032e1f72ff90a2cf062a52645627
Opcode Fuzzy Hash: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction Fuzzy Hash: AD0131B1C54658DFC710DF98D901B8ABBF8EB09724F10466BE815E3780E779A6048BA5

Function 00438D50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D96
___std_exception_destroy.LIBVCRUNTIME ref: 00438DAC

Strings

MC, xrefs: 00438D8C, 00438DA6

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction ID: 57808b7f7ef1f41f2f9046275374ae6f4c4975ec05ee0e2f2319a2ec8c3047b8
Opcode Fuzzy Hash: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction Fuzzy Hash: BB0136B1C44658DFC710DF98D901B89BBF8EB09714F10466FE815E3780E77566048B65

Function 004BA04D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004805F0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,A3776857,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480617
Part of subcall function 004805F0: GetLastError.KERNEL32(?,00000000,00000000,A3776857,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480621

IsDebuggerPresent.KERNEL32(?,?,?,00434B5D), ref: 004BA080
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00434B5D), ref: 004BA08F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004BA08A

Memory Dump Source

Source File: 00000002.00000002.1892909441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction ID: d36ccacf6001ae6edc25a42526d65594664b7a1234a3e60676ee06f56b9b42c5
Opcode Fuzzy Hash: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction Fuzzy Hash: 64E065701007018FD330AF3AD40C3467BE0AB14304F00882FD945C7750E7B9D4088B66

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report drop1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
drop1.exe

Function 009BA1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 009A94CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 009A1930 Relevance: 9.2, APIs: 6, Instructions: 196
fileCOMMON

Function 009AD525 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Function 009A17E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
memoryCOMMON

Function 009A67F4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 009AA0BA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 009A3C1A Relevance: 3.1, APIs: 2, Instructions: 94
COMMONLIBRARYCODE

Function 009A9EAC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 009A690C Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 009A9357 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 009AA83B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 009AA649 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Function 009A32D0 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Function 009A9599 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre