Edit tour

Windows Analysis Report
gem1.exe

Overview

General Information

Sample name:	gem1.exe
Analysis ID:	1589410
MD5:	b151d347d2f47dad2db0aa029dd6c9dd
SHA1:	8e191fc786e010f93c9bcc41de3a42e1e16fa345
SHA256:	5c0ead3d71e0c901aef2a4c7a2ad29212fcb9f8dc49c5e6b524f822ec65511fd
Tags:	66-63-187-250exeuser-JAMESWT_MHT
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

gem1.exe (PID: 2432 cmdline: "C:\Users\user\Desktop\gem1.exe" MD5: B151D347D2F47DAD2DB0AA029DD6C9DD)

conhost.exe (PID: 1488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

gem1.exe (PID: 5864 cmdline: "C:\Users\user\Desktop\gem1.exe" MD5: B151D347D2F47DAD2DB0AA029DD6C9DD)

WerFault.exe (PID: 6808 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 152 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "5", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Process Memory Space: gem1.exe PID: 5864	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: gem1.exe PID: 5864	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.gem1.exe.3b01f70.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.gem1.exe.3b01f70.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfbcdc:$str01: emoji 0xfe4d8:$str02: %d-%m-%Y, %H:%M:%S 0xfe540:$str03: [UTC 0xfe54c:$str04: user_name 0xfe570:$str05: computer_name 0xfe594:$str06: timezone 0xfe4c4:$str07: current_path() 0xfbca8:$str08: [json.exception. 0x111c2e:$str09: GDI32.dll 0x111ea0:$str10: GdipGetImageEncoders 0x111f18:$str10: GdipGetImageEncoders 0x111548:$str11: GetGeoInfoA
0.2.gem1.exe.3b01f70.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.gem1.exe.3b01f70.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
3.2.gem1.exe.400000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
3.2.gem1.exe.400000.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
3.2.gem1.exe.400000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
3.2.gem1.exe.400000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
0.2.gem1.exe.39d9550.1.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.gem1.exe.39d9550.1.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x2260fc:$str01: emoji 0x2288f8:$str02: %d-%m-%Y, %H:%M:%S 0x228960:$str03: [UTC 0x22896c:$str04: user_name 0x228990:$str05: computer_name 0x2289b4:$str06: timezone 0x2288e4:$str07: current_path() 0x2260c8:$str08: [json.exception. 0x23c04e:$str09: GDI32.dll 0x23c2c0:$str10: GdipGetImageEncoders 0x23c338:$str10: GdipGetImageEncoders 0x23b968:$str11: GetGeoInfoA
Click to see the 5 entries

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T09:26:12.953630+0100	2049441	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T09:26:12.953630+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-12T09:26:12.959172+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T09:26:12.953630+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-12T09:26:12.959172+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49709	66.63.187.173	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gem1.exe

Avira: detected

Found malware configuration

Source: 3.2.gem1.exe.400000.0.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "5", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: gem1.exe	ReversingLabs: Detection: 63%
Source: gem1.exe	Virustotal: Detection: 62%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.2% probability

Machine Learning detection for sample

Source: gem1.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0047A610 CryptUnprotectData,LocalFree,	3_2_0047A610
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043D4A0 BCryptDestroyKey,	3_2_0043D4A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0047A950 CryptProtectData,LocalFree,	3_2_0047A950
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0047AAE0 BCryptDecrypt,BCryptDecrypt,	3_2_0047AAE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00440B60 CryptUnprotectData,LocalFree,	3_2_00440B60
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0047AE10 BCryptCloseAlgorithmProvider,	3_2_0047AE10
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0047AE80 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	3_2_0047AE80

Source: gem1.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: gem1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.pdb) source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: Handler.pdb source: gem1.exe, WERBB3.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WERBB3.tmp.dmp.7.dr

Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004402D0 FindFirstFileW,FindNextFileW,	3_2_004402D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	3_2_004B84C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_004B8545
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B84E0 FindFirstFileExW,	3_2_004B84E0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004BAB85 FindFirstFileExW,	3_2_004BAB85

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00487550 GetLogicalDriveStringsW,

3_2_00487550

Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.6:49709 -> 66.63.187.173:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.6:49709 -> 66.63.187.173:15666

Source: global traffic

TCP traffic: 192.168.2.6:49709 -> 66.63.187.173:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 66.63.187.173 66.63.187.173

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.6:49709 -> 66.63.187.173:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00485350 recv,recv,recv,recv,recv,recv,closesocket,WSACleanup,

3_2_00485350

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00485F00 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

3_2_00485F00

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.gem1.exe.3b01f70.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.gem1.exe.3b01f70.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 3.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 3.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.gem1.exe.39d9550.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0048A0A0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,		3_2_0048A0A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,		3_2_0048A710

Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004422D0	3_2_004422D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043A2B0	3_2_0043A2B0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00446400	3_2_00446400
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00488400	3_2_00488400
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043E4F0	3_2_0043E4F0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004395D0	3_2_004395D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00487780	3_2_00487780
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00485840	3_2_00485840
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043C970	3_2_0043C970
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004479C0	3_2_004479C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00459A06	3_2_00459A06
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0046EB70	3_2_0046EB70
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0046BCE0	3_2_0046BCE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00439D60	3_2_00439D60
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00470EF0	3_2_00470EF0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043BF70	3_2_0043BF70
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00462080	3_2_00462080
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004320A0	3_2_004320A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004A70A7	3_2_004A70A7
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0042D150	3_2_0042D150
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00479130	3_2_00479130
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00474190	3_2_00474190
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00461250	3_2_00461250
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00408270	3_2_00408270
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B6380	3_2_004B6380
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00407470	3_2_00407470
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00462410	3_2_00462410
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004A5426	3_2_004A5426
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0045C4C0	3_2_0045C4C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043D4A0	3_2_0043D4A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0047E580	3_2_0047E580
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0046B620	3_2_0046B620
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00468750	3_2_00468750
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00419770	3_2_00419770
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0045C700	3_2_0045C700
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004917CA	3_2_004917CA
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0045D7A0	3_2_0045D7A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004627A0	3_2_004627A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0049687E	3_2_0049687E
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B6870	3_2_004B6870
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043A800	3_2_0043A800
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00493800	3_2_00493800
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0049F8A2	3_2_0049F8A2
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00461940	3_2_00461940
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00445950	3_2_00445950
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00478990	3_2_00478990
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004ACA4B	3_2_004ACA4B
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00406AE0	3_2_00406AE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B3AE0	3_2_004B3AE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00430AF0	3_2_00430AF0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0048AA80	3_2_0048AA80
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00414AA0	3_2_00414AA0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0045EAA0	3_2_0045EAA0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00476AB6	3_2_00476AB6
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00462B50	3_2_00462B50
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00482C4B	3_2_00482C4B
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004BCC40	3_2_004BCC40
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B6C40	3_2_004B6C40
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00461CC0	3_2_00461CC0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00478D40	3_2_00478D40
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B6D30	3_2_004B6D30
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B1D30	3_2_004B1D30
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00440DE0	3_2_00440DE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0043AE50	3_2_0043AE50
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_0042EEA0	3_2_0042EEA0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00406F40	3_2_00406F40
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00444F50	3_2_00444F50
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00443F00	3_2_00443F00
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00456F00	3_2_00456F00
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00412FA0	3_2_00412FA0

Source: C:\Users\user\Desktop\gem1.exe	Code function: String function: 004AC500 appears 58 times
Source: C:\Users\user\Desktop\gem1.exe	Code function: String function: 004517F0 appears 53 times

Source: C:\Users\user\Desktop\gem1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 152

Source: gem1.exe, 00000000.00000000.2147643921.0000000000542000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerasdlui.exej% vs gem1.exe
Source: gem1.exe, 00000000.00000002.2201983275.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs gem1.exe
Source: gem1.exe, 00000000.00000002.2202846125.00000000039D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerasdlui.exej% vs gem1.exe
Source: gem1.exe	Binary or memory string: OriginalFilenamerasdlui.exej% vs gem1.exe

Source: gem1.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.gem1.exe.3b01f70.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.gem1.exe.3b01f70.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 3.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 3.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.gem1.exe.39d9550.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: gem1.exe

Static PE information: Section: .bss ZLIB complexity 1.0003138195647467

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/5@1/2

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_0048CB50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

3_2_0048CB50

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_004473D0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

3_2_004473D0

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00477EE0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

3_2_00477EE0

Source: C:\Users\user\Desktop\gem1.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\gem1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69636FA32EF8
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2432
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1488:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\eb4cb8fe-fc4a-4c18-a5be-8cac1d2c1bc5

Jump to behavior

Source: gem1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: gem1.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gem1.exe	ReversingLabs: Detection: 63%
Source: gem1.exe	Virustotal: Detection: 62%

Source: C:\Users\user\Desktop\gem1.exe

File read: C:\Users\user\Desktop\gem1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 152
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: gem1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gem1.exe

Static file information: File size 1214976 > 1048576

Source: gem1.exe

Static PE information: Raw size of .bss is bigger than: 0x100000 < 0x120a00

Source: gem1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: gem1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Windows.Forms.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.pdb) source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: Handler.pdb source: gem1.exe, WERBB3.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WERBB3.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WERBB3.tmp.dmp.7.dr

Source: gem1.exe

Static PE information: 0xD2E802CF [Sun Feb 15 22:33:51 2082 UTC]

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

3_2_00446400

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_004ACE0C push ecx; ret

3_2_004ACE1F

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_0047E240 GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,ExitProcess,ReleaseMutex,CloseHandle,

3_2_0047E240

Source: C:\Users\user\Desktop\gem1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Memory allocated: 27D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-49801

Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004402D0 FindFirstFileW,FindNextFileW,	3_2_004402D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	3_2_004B84C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_004B8545
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004B84E0 FindFirstFileExW,	3_2_004B84E0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004BAB85 FindFirstFileExW,	3_2_004BAB85

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00487550 GetLogicalDriveStringsW,

3_2_00487550

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00498574 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

3_2_00498574

Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh$^
Source: gem1.exe, 00000003.00000002.2344357302.00000000015C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\gem1.exe

API call chain: ExitProcess graph end node

graph_3-49821

Source: C:\Users\user\Desktop\gem1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,

3_2_0048A710

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_004BA04D IsDebuggerPresent,OutputDebugStringW,

3_2_004BA04D

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00498574 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

3_2_00498574

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

3_2_00446400

Source: C:\Users\user\Desktop\gem1.exe	Code function: 0_2_029D8089 mov edi, dword ptr fs:[00000030h]		0_2_029D8089
Source: C:\Users\user\Desktop\gem1.exe	Code function: 0_2_029D8206 mov edi, dword ptr fs:[00000030h]		0_2_029D8206

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_004A6CD3 GetProcessHeap,

3_2_004A6CD3

Source: C:\Users\user\Desktop\gem1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004AC6BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004AC6BF
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004AC80A SetUnhandledExceptionFilter,	3_2_004AC80A
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_00497B2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00497B2D
Source: C:\Users\user\Desktop\gem1.exe	Code function: 3_2_004ABFD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_004ABFD4

Source: C:\Users\user\Desktop\gem1.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\gem1.exe

Code function: 0_2_029D8089 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_029D8089

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\gem1.exe

Memory written: C:\Users\user\Desktop\gem1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_0047D2F0 ShellExecuteW,OpenProcessToken,GetCurrentProcess,GetTokenInformation,std::ios_base::_Ios_base_dtor,

3_2_0047D2F0

Source: C:\Users\user\Desktop\gem1.exe

Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00486C50 cpuid

3_2_00486C50

Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004A6109
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_004B824D
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,	3_2_004A620F
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_004A62E5
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	3_2_0049C70E
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_004A5970
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	3_2_004A5C67
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	3_2_004A5C1C
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,	3_2_0049CCB0
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	3_2_004A5D02
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_004A5D8D
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,	3_2_004A5FE0

Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\Users\user\Desktop\gem1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_00497EC8 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

3_2_00497EC8

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_004863F0 GetUserNameW,

3_2_004863F0

Source: C:\Users\user\Desktop\gem1.exe

Code function: 3_2_004A1074 GetTimeZoneInformation,

3_2_004A1074

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: gem1.exe PID: 5864, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.gem1.exe.3b01f70.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.3b01f70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.39d9550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gem1.exe PID: 5864, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\wallets
Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: gem1.exe, 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: gem1.exe PID: 5864, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.gem1.exe.3b01f70.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.3b01f70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.39d9550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gem1.exe PID: 5864, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 Software Packing	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gem1.exe	63%	ReversingLabs	Win32.Infostealer.Tinba
gem1.exe	62%	Virustotal		Browse
gem1.exe	100%	Avira	HEUR/AGEN.1359509
gem1.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
66.63.187.173	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589410
Start date and time:	2025-01-12 09:25:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gem1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/5@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 40.126.31.69, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:26:13	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	api.ipify.org/
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
66.63.187.173	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	https://pub-ce1f93897bdf44e9b1cd99ad0325c570.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://support-confirm-help.click/	Get hash	malicious	Unknown	Browse	172.67.74.152
	zmpZMfK1b4.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kAsh3nmsgs.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ZeAX5i7cGB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Wru9ycO2MJ.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	172.67.160.193
	https://accountsupporthub.es/generate/Login/	Get hash	malicious	Unknown	Browse	104.21.90.106
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	162.159.134.233
	resembleC2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.135.232
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	172.67.219.181
	http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/	Get hash	malicious	Unknown	Browse	104.21.56.69
	http://www.telegramstg.com/	Get hash	malicious	Unknown	Browse	104.21.22.141
	http://www.eovph.icu/	Get hash	malicious	Unknown	Browse	104.21.1.232
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.grhga.icu/	Get hash	malicious	Unknown	Browse	104.21.57.146
ASN-QUADRANET-GLOBALUS	egpTyFpA8v.exe	Get hash	malicious	AsyncRAT	Browse	69.174.100.131
	Nfi2yQDBda.exe	Get hash	malicious	Remcos	Browse	69.174.98.48
	rO37Xq39IF.exe	Get hash	malicious	Remcos	Browse	69.174.98.48
	frosty.sh4.elf	Get hash	malicious	Mirai	Browse	45.199.228.228
	xLDz0WPZYc.exe	Get hash	malicious	GuLoader	Browse	66.63.187.30
	xLDz0WPZYc.exe	Get hash	malicious	GuLoader	Browse	66.63.187.30
	vQyKfYxzXB.exe	Get hash	malicious	Remcos	Browse	69.174.98.48
	https://zfrmz.com/3GiGYUP4BArW2NBgkPU3	Get hash	malicious	Unknown	Browse	45.61.152.125
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	armv5l.elf	Get hash	malicious	Unknown	Browse	104.237.80.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	1387457-38765948.15.exe	Get hash	malicious	Nitol	Browse	104.26.12.205
	1387457-38765948.15.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	build.exe	Get hash	malicious	Vidar	Browse	104.26.12.205
	zmpZMfK1b4.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	ix8kxoBHDb.exe	Get hash	malicious	Remcos, GuLoader	Browse	104.26.12.205
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.26.12.205
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.12.205
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gem1.exe_daf150691981ac57c1cc14cff3d12fbabf996950_5a516dd6_d70f4b9c-129d-44b9-9413-bdafdbcd51f5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8887530178392387
Encrypted:	false
SSDEEP:	96:cpCFdTslNKursrtcBjTOAqyS3QXIDcQlc6VcEdcw3V+BHUHZ0ownOgHkEwH3dEFp:cIo4ur4A0LR3EaGGzuiF1Z24IO8B
MD5:	04304403CC482F1A152A70A04A55A8B4
SHA1:	5014D43A225FCD84EC43DFA122CD0477E2823C17
SHA-256:	856FF0B9FC30D72E046860490D501F802C1727618F3C2DF4940D0F673C8E0AE6
SHA-512:	1ADD11939FF7ED7689F1975BA1E93CED31B4EA6D94BB7A6DB65A47503406CA7C0E715BAB92231AA44BA968F990E0D728C71880EF83B3A271EBE81431492BAC46
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.1.4.3.9.6.9.5.3.2.4.6.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.1.4.3.9.7.1.1.5.7.4.8.3.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.0.f.4.b.9.c.-.1.2.9.d.-.4.4.b.9.-.9.4.1.3.-.b.d.a.f.d.b.c.d.5.1.f.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.e.4.5.d.2.b.-.0.0.c.0.-.4.1.7.9.-.8.f.0.b.-.4.b.a.b.4.f.d.7.4.1.1.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.g.e.m.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.r.a.s.d.l.u.i...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.8.0.-.0.0.0.1.-.0.0.1.5.-.8.6.4.2.-.4.4.a.1.c.b.6.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.9.c.7.0.1.5.2.1.1.1.1.7.5.9.b.d.9.b.5.0.9.9.5.7.1.c.0.3.3.d.0.0.0.0.0.9.0.4.!.0.0.0.0.8.e.1.9.1.f.c.7.8.6.e.0.1.0.f.9.3.c.9.b.c.c.4.1.d.e.3.a.4.2.e.1.e.1.6.f.a.3.4.5.!.g.e.m.1...e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1143.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4741
Entropy (8bit):	4.436055515159477
Encrypted:	false
SSDEEP:	48:cvIwWl8zsrJg77aI9FQxDrWpW8VYZvYm8M4J9dxPcf6FxOm+q8vedxPcf/0Q2cnz:uIjfFI7HQx27VVJSfwtKDf/0QLn9d
MD5:	AA271BB8FD3F2283E8225D54C9B1DFC5
SHA1:	FB3A4BCABE2277EBDCC1C592BE3B640E3F61A9E7
SHA-256:	546557A64E6DC141D7D4B7AE6C29525D32A097178893F4E943631D961214C1E5
SHA-512:	4C8DB4A3FD134E7877C6B3218658B6DF3E65A2E864B2AB39C12EECAE34E2DE38BFBF64C1AD425897D0B9BBC300E4B5A8F9BB0F60718E028FAB73FD040DB8C05F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="672448" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Jan 12 08:26:10 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	154229
Entropy (8bit):	3.7476874695117988
Encrypted:	false
SSDEEP:	1536:NTjcpN4uE2aOXeYCDDLTgtKAJ07zcPk8tTDGfRuBojR4L:hjq4uEqXeTDLTgi6WfH4
MD5:	AF44038F62D18C6EC7E8BE9A7E06CA4B
SHA1:	47CD8EC2B7CE6C5BAFA28F4E5F8B22E099FCEE5A
SHA-256:	9D7D41A302CD4B2E352A2D12486230A62C567949E9B4F4318ECF9546E3D26942
SHA-512:	6BDF7592041457918EADCB3C88BEF71CCD28B9787C22B49306207F2C4255BD60DEA7AEE0EDFE25691D2C3C6E99FD663A373F0C55E5BEB47DBEED3071FE9F0497
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........\|.g....................................$................/..........`.......8...........T...........($..M6......................................................................................................eJ......P.......GenuineIntel............T............\|.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.689416373383232
Encrypted:	false
SSDEEP:	192:R6l7wVeJgCb6IpJ6Y2DaSU9APpgmf6sVJLprm89bIFsfHYm:R6lXJx6I36YnSU92gmf6sVJpIefd
MD5:	82BDD8FCA9876EA31B8F135DA98F0033
SHA1:	F1F2CD63AC2DC906C8327BE6DB45616F52500CC2
SHA-256:	8990636BE4959E596CB42D2BBDB8637666916F2182209D507E9EDB0120AC2BD2
SHA-512:	B86C172642CF6577280D86A9549F310A090CD5DA8E2B2161A083D4A4EEFC570EF78C378FCADAC7BD651AD7805669B83BFF4E4FE96BB61E85197881A3002E2E4E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.3.2.<./.P.i.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469137233862075
Encrypted:	false
SSDEEP:	6144:nzZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNqjDH5S:zZHtYZWOKnMM6bFpAj4
MD5:	EBEDF4E0DE76EDB28F163B598477B255
SHA1:	872228C3F0B1AFA8F0FB5685C8449AC7B7473E35
SHA-256:	358980C716116EB64837EC57289E258B83B9ECFCA89AB7C8C2AF463398DAE9C5
SHA-512:	C6B03CE2A7B1916A8CEFA832D629A79C30BD0E4F84C55C41DCFB9CD85AE99DD5903937ACE71E36AA3EF07A085097500426D3B670AF4EB8D92DCAC884A1EE8EA5
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....d.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9930446065489615
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	gem1.exe
File size:	1'214'976 bytes
MD5:	b151d347d2f47dad2db0aa029dd6c9dd
SHA1:	8e191fc786e010f93c9bcc41de3a42e1e16fa345
SHA256:	5c0ead3d71e0c901aef2a4c7a2ad29212fcb9f8dc49c5e6b524f822ec65511fd
SHA512:	cb6e1d0d13a00713afc45557cff0a6d71024fda5d509356a04e09d0c999b219e221c3bdd7702043f1cb9290329c3fb9ad121168f60f5a94f5a0d50e45abdc81b
SSDEEP:	24576:RQu06mH2AfjusEQ3MWTwGxXjfAnpiYQ7eVGKtFwVrJa/tXjuD/:3LmH2AfisEQ5XEnpI74arM/tXj+/
TLSH:	0745332CFA0BDD2AC27D2D7B44940F4091A1A39B1CABED63B04C725657976BBCA11D38
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..v............... ........@.. ..............................*u....`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4094ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD2E802CF [Sun Feb 15 22:33:51 2082 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x94a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x3f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9457	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x74f4	0x7600	f32526fd179a80672c86baf3e240d82b	False	0.5432997881355932	data	6.059907975778828	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x3f0	0x400	244207ec8fc868fc32d1d919de93ef41	False	0.44921875	data	3.3528869776678194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	0b272fa35e840df20571830dcdaa7949	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0xe000	0x120a00	0x120a00	ede3f5c4c71a23ad8d4561c2ee4dc5fe	False	1.0003138195647467	data	7.99986473770345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa058	0x398	OpenPGP Secret Key	English	United States	0.45760869565217394

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-12T09:26:12.953630+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-12T09:26:12.953630+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-12T09:26:12.953630+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-12T09:26:12.959172+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49709	66.63.187.173	15666	TCP
2025-01-12T09:26:12.959172+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49709	66.63.187.173	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 09:26:09.973104000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:09.978102922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:09.978188992 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:11.101058960 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:11.101134062 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:11.101269007 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:11.146311045 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:11.146331072 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:11.612819910 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:11.612915993 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.038455009 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.038485050 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:12.039280891 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:12.039371967 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.058482885 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.103327990 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:12.164212942 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:12.164271116 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.164290905 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:12.164309025 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:12.164335012 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.164360046 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.165127993 CET	49711	443	192.168.2.6	104.26.12.205
Jan 12, 2025 09:26:12.165144920 CET	443	49711	104.26.12.205	192.168.2.6
Jan 12, 2025 09:26:12.953629971 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959028959 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959098101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959120035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959148884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959172010 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959176064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959196091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959202051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959217072 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959229946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959244967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959254980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959276915 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959283113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959294081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959310055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959331989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959362984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.959364891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.959408998 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964366913 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964452028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964466095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964514017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964521885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964562893 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964581013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964623928 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964647055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964694023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964694977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964721918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964732885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964749098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964775085 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964777946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964799881 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964802027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964827061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964844942 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964855909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964865923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964888096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.964890957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964922905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.964936972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.969780922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.969846010 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.969896078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.969949961 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970027924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970088005 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970124006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970172882 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970175028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970227957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970238924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970292091 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970292091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970355034 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970366001 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970407963 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970434904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970479965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970551014 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970577955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970609903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970619917 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970627069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970655918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970670938 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970709085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970762968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970789909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970807076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970838070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970844030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970871925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970889091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970918894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970917940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970946074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970973015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.970982075 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970993042 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.970999956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.971025944 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.971035004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.971045971 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.971075058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.971101999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.971107006 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.971116066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.971127987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.971153975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.971167088 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.971177101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.971188068 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.975987911 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976068020 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976216078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976264954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976311922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976357937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976409912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976459026 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976463079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976516962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976522923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976567984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976568937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976617098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976708889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976735115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976752996 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976768970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976778030 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976824999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976923943 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.976972103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.976988077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977035999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977077961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977103949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977128983 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977158070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977230072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977276087 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977278948 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977302074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977320910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977328062 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977349997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977360964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977370024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977385998 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977401018 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977412939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977421045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977438927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977456093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977483034 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977489948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977515936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977529049 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977541924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977555037 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977567911 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977577925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977595091 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977610111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977622032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977638960 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977648020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977658033 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977674961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977689028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977700949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977714062 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977727890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977741003 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977756023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977782965 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977786064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977798939 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977809906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977823973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977834940 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977845907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977861881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977875948 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977886915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977905989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977912903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977931023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977938890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977957010 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977965117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.977988005 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.977991104 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978009939 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978015900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978034973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978041887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978058100 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978068113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978080988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978095055 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978108883 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978125095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978149891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978163958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978163958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978190899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978203058 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978218079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978228092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978244066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978259087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978270054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978281975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978296041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978305101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978322983 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978336096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978348970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978365898 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978374004 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978390932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978400946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978409052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978425980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978437901 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978451967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978461981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978477955 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978493929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978502989 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978516102 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978528976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978540897 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978554964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978566885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978579998 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978591919 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978605032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978620052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978631973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978642941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978657961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978672028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978683949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978693008 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978709936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.978719950 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.978750944 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.983675003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.983727932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.983741045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.983768940 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.983897924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.983923912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.983951092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.983987093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984016895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984065056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984097958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984143972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984180927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984226942 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984256983 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984308004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984373093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984406948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984421968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984441996 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984464884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984513998 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984524965 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984551907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984575987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984596968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984667063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984709978 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984728098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984767914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984817982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984868050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.984903097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.984947920 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985006094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985032082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985059023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985074997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985163927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985219002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985251904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985277891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985304117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985317945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985416889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985466957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985487938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985512972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985532045 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985548973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985714912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985820055 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985909939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985935926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985955954 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985963106 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985985041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.985990047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.985996962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986015081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986035109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986042976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986054897 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986069918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986079931 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986097097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986110926 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986123085 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986143112 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986149073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986159086 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986175060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986186981 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986201048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986213923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986227036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986238956 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986253023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986269951 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986279011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986289024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986304998 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986315966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986330986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986342907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986356974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986373901 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986382961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986392021 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986408949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986418962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986433983 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986449003 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986459970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986469984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986485958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986504078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986527920 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986531973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986568928 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986571074 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986594915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986608028 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986622095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986634970 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986648083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986659050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986674070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986690044 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986717939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986742020 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986745119 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986753941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986771107 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986782074 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986797094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986810923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986823082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986835003 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986849070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986859083 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986876011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986888885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986901999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986912012 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986927986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986942053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986953020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986963987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.986979008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.986994982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987004995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987020016 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987031937 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987047911 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987057924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987083912 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987093925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987102985 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987109900 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987121105 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987135887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987162113 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987166882 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987179041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987188101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987200975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987216949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987226009 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987251043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987256050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987277031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987293959 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987303972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987308979 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987341881 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987349987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987380028 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987397909 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987406015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987421989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987432957 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987443924 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987458944 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987474918 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987484932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987493992 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987510920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987521887 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987536907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987549067 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987561941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987567902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987586975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987598896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987613916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987637043 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987641096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987652063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987667084 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987684011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987693071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987703085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987718105 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987728119 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987744093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987756968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987770081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987775087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987796068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987811089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987821102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987833977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987847090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987871885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987876892 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987888098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987901926 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987910986 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987934113 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987935066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987962008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.987979889 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.987987041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988008976 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988013029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988029957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988039017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988049984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988065004 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988082886 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988090992 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988117933 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988117933 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988132000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988146067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988157988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988172054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988183975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988197088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988204002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988224030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988239050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988249063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988261938 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988275051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988286972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988301039 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988317013 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988326073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988347054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988353014 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988364935 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988378048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988395929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988404989 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988415003 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988430977 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988446951 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988456011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988467932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988481998 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988488913 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988507986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988523960 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988533020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988544941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988560915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988564968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988595963 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988596916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988624096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988634109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988650084 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988662004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988676071 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988691092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988702059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988713026 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988728046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988739014 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988754034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988773108 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988779068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988786936 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988805056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988815069 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988831043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988842010 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988857031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988869905 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988883018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988894939 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988909006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.988925934 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.988945961 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994148016 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994193077 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994204998 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994213104 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994216919 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994229078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994240999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994249105 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994252920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994265079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994271040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994277000 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994281054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994288921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994299889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994304895 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994311094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994318008 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994327068 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994366884 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994366884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994385004 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994390965 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994395971 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994416952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994422913 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994427919 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994429111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994457006 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994471073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994483948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994496107 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994508028 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994520903 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994523048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994525909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994532108 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994543076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994570017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994592905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994601011 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994606972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994616985 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994617939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994642973 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994658947 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994672060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994704008 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994705915 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994729042 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994752884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994765043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994770050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994770050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994775057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994782925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994786978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994806051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994828939 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994836092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994842052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994848967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994852066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994870901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994877100 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994889021 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994908094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994920015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994923115 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994932890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994944096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994961023 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994962931 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994975090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.994976997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994993925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.994998932 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995008945 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995026112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995033026 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995042086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995057106 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995059013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995070934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995078087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995081902 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995099068 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995110035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995111942 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995121956 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995126009 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995136023 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995142937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995156050 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995160103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995178938 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995178938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995191097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995193958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995218992 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995219946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995233059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995239973 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995244980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995249987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995256901 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995268106 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995270967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995279074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995299101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995311022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995318890 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995335102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995356083 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995373011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995379925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995385885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995397091 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995409012 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995418072 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995419979 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995435953 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995455027 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995465994 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995476961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995517969 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995523930 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995529890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995541096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995553017 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995557070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995564938 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995577097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995578051 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995588064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995589018 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995599985 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995614052 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995639086 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995651007 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995661020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995668888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995685101 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995686054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995697975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995702982 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995707989 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995712996 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995738029 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995752096 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995755911 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995757103 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995763063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995768070 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995774031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995789051 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995820045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995882034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995887041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995901108 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995914936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995922089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995927095 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995933056 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995938063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995943069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995948076 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995951891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995956898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995961905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995966911 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995975018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.995975018 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.995996952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996009111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996033907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996053934 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996090889 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996110916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996115923 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.996117115 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996129036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996134043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996140003 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996145964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996151924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996157885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996174097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996179104 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996184111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996187925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996196985 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996205091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.996206999 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996222019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996242046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996248007 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:12.996340990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:12.996407032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.036386013 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.036659002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.036726952 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.036787987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.036838055 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.036887884 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.036938906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.036984921 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.037041903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.037085056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.037139893 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.037185907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.037245035 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.037278891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.047736883 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.047892094 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.047950029 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.047991991 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.048053026 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.048078060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.052820921 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.053009987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.053076982 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.053112984 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.096354961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.098562002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146104097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.146382093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146454096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146502018 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146555901 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146604061 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146652937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146703005 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146755934 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146806002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146851063 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146899939 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146954060 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.146996975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.147047043 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.151493073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.151674032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196399927 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.196636915 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196697950 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196742058 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196790934 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196836948 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196893930 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196942091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.196986914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.197030067 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.197081089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.197093010 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.206206083 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.206222057 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.206401110 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.206470013 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.206510067 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.206548929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.211220980 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.211543083 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.211596966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.211630106 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.252417088 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.252476931 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.283620119 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.283732891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.283837080 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.283902884 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.283946991 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.283991098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.284040928 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.284096003 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.284145117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.284200907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.284214020 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.288800001 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.288937092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.332369089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.332438946 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.345875978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.345969915 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.346102953 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346170902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346218109 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346275091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346324921 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346374989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346427917 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346481085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.346502066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.351006031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.351229906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.351279974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.351332903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.351373911 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.351424932 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.351485968 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.351504087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.392277002 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.392514944 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.406872034 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.407083988 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407160997 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407207966 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407255888 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407293081 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.407299995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407365084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407416105 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407459974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407504082 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407556057 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407607079 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407677889 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407722950 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407777071 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.407814980 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412024021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412172079 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412194014 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412271976 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412302017 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412373066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412400961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412429094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412480116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412511110 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412523031 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412549019 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412576914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412580967 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412611961 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412638903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412740946 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412772894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412900925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412929058 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.412946939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.412981987 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413069010 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413108110 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413140059 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413167953 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413199902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413208008 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413283110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413311005 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413333893 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413363934 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413422108 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413450003 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413472891 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413506031 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413520098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413553953 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413630009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413659096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413661957 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413688898 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413703918 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413738012 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413753033 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413779974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413779974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413808107 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413815975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.413887978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.413995981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414060116 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414098024 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414153099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414202929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414221048 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414239883 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414243937 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414252043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414263964 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414264917 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414275885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414285898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414304972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414307117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414315939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414328098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414345980 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414346933 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414359093 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414370060 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414376974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414385080 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414387941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414401054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414406061 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414412975 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.414431095 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.414462090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.456573009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.456816912 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.456886053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.456933975 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.456978083 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457020998 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457073927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457123995 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457179070 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457218885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457274914 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457319021 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457374096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457417965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457477093 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.457509041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.461004019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.461149931 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.461214066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.461944103 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462002993 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462021112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462086916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462116957 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462157965 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462161064 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462214947 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462239981 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462289095 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462321043 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462376118 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462395906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462430000 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462440968 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462493896 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462511063 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462553978 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462584019 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462634087 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462655067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462706089 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462709904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462768078 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462843895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462892056 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462898970 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.462949038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.462951899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463002920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463035107 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463114977 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463144064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463202000 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463232040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463264942 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463299990 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463350058 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463496923 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463545084 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463561058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463612080 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463645935 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463690996 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463743925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463772058 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463795900 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463829041 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463865995 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.463908911 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.463965893 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464009047 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464014053 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464020967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464032888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464045048 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464059114 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464071035 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464078903 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464085102 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464116096 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464123011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464143038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464143038 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464154959 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464164972 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464174986 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464181900 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464186907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464200974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464200974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464216948 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464225054 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464229107 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464240074 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464240074 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464247942 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464251041 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464262962 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464272022 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464277983 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464296103 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464299917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464315891 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464318037 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464340925 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464342117 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464360952 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464363098 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464373112 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464382887 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464384079 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464404106 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464407921 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464422941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464428902 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464436054 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464447021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464456081 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464458942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464482069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464487076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464493990 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464504957 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464515924 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464526892 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464538097 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464557886 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464569092 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464570999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464585066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464590073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464611053 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464622974 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464633942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464634895 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464659929 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464660883 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464672089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464685917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464689970 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464715004 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464715958 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464737892 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464744091 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464749098 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464764118 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464771032 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464780092 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464788914 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464793921 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464801073 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464812040 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464826107 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464827061 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464845896 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464857101 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464859009 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464868069 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464879036 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464883089 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464907885 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464910984 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464922905 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464934111 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464934111 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464946032 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464956045 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464958906 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464967966 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.464984894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464994907 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.464994907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465007067 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465017080 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465020895 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465040922 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465045929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465053082 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465064049 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465066910 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465090990 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465097904 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465118885 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465126991 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465137959 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465147018 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465158939 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465167999 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465171099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465182066 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465184927 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465193987 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465209961 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465224028 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465235949 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465246916 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465248108 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465259075 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465277910 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465282917 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465305090 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465312958 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465317011 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465323925 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465327978 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465339899 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465348959 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465362072 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465382099 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465393066 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465394020 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465405941 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465418100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465428114 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465431929 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465461969 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465473890 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465486050 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465495110 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465507030 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465518951 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465521097 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465542078 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465550900 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465565920 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465578079 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465584040 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465589046 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465600967 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465616941 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465624094 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465636015 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465647936 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465648890 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465667009 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465678930 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465681076 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465689898 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465691090 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465711117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465714931 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465723038 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465734005 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465734959 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465744972 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465758085 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465766907 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465787888 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465790033 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465814114 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465816021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465827942 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465837002 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465838909 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465851068 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465862036 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465878963 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465888977 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465890884 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465918064 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465922117 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465941906 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465967894 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465970993 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.465991974 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.465993881 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.466015100 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.466017008 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.466027021 CET	15666	49709	66.63.187.173	192.168.2.6
Jan 12, 2025 09:26:13.466037989 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.466094017 CET	49709	15666	192.168.2.6	66.63.187.173
Jan 12, 2025 09:26:13.466114998 CET	15666	49709	66.63.187.173	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 09:26:11.074896097 CET	192.168.2.6	1.1.1.1	0x992e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 09:26:11.081973076 CET	1.1.1.1	192.168.2.6	0x992e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:11.081973076 CET	1.1.1.1	192.168.2.6	0x992e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:11.081973076 CET	1.1.1.1	192.168.2.6	0x992e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.26.12.205	443	5864	C:\Users\user\Desktop\gem1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 08:26:12 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-01-12 08:26:12 UTC	424	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 08:26:12 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 900bc2a1bf6a4406-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2376&min_rtt=2335&rtt_var=905&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=738&delivery_rate=1250535&cwnd=186&unsent_bytes=0&cid=972ef64e2270f9e1&ts=565&x=0"
2025-01-12 08:26:12 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	03:26:08
Start date:	12/01/2025
Path:	C:\Users\user\Desktop\gem1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gem1.exe"
Imagebase:	0x540000
File size:	1'214'976 bytes
MD5 hash:	B151D347D2F47DAD2DB0AA029DD6C9DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:26:08
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:26:08
Start date:	12/01/2025
Path:	C:\Users\user\Desktop\gem1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gem1.exe"
Imagebase:	0xe80000
File size:	1'214'976 bytes
MD5 hash:	B151D347D2F47DAD2DB0AA029DD6C9DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000003.00000002.2344357302.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:26:09
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 152
Imagebase:	0xee0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	53.8%
Total number of Nodes:	13
Total number of Limit Nodes:	2

Executed Functions

Function 029D8089 Relevance: 40.5, APIs: 10, Strings: 13, Instructions: 294
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029D7FFB,029D7FEB), ref: 029D8221
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 029D8234
Wow64GetThreadContext.KERNEL32(00000384,00000000), ref: 029D8252
ReadProcessMemory.KERNELBASE(0000038C,?,029D803F,00000004,00000000), ref: 029D8276
VirtualAllocEx.KERNELBASE(0000038C,?,?,00003000,00000040), ref: 029D82A1
WriteProcessMemory.KERNELBASE(0000038C,00000000,?,?,00000000,?), ref: 029D82F9
WriteProcessMemory.KERNELBASE(0000038C,00400000,?,?,00000000,?,00000028), ref: 029D8344
WriteProcessMemory.KERNELBASE(0000038C,?,?,00000004,00000000), ref: 029D8382
Wow64SetThreadContext.KERNEL32(00000384,04E60000), ref: 029D83BE
ResumeThread.KERNELBASE(00000384), ref: 029D83CD

Strings

ResumeThread, xrefs: 029D81C5
CreateProcessW, xrefs: 029D813D
GetP, xrefs: 029D810B
ress, xrefs: 029D8113
WriteProcessMemory, xrefs: 029D819C
Load, xrefs: 029D80C7
TerminateProcess, xrefs: 029D82B0
VirtualAlloc, xrefs: 029D8150
ReadProcessMemory, xrefs: 029D8176
aryA, xrefs: 029D80CF
VirtualAllocEx, xrefs: 029D8189
SetThreadContext, xrefs: 029D81AF
GetThreadContext, xrefs: 029D8163

Memory Dump Source

Source File: 00000000.00000002.2202807808.00000000029D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 029D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29d7000_gem1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-232383841
Opcode ID: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction ID: 3df32ef9beffd10a59b47ea7906505796bdbdf35be7d3bb495a38d68c7906d05
Opcode Fuzzy Hash: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction Fuzzy Hash: 52B1F97660064AAFDB60CF68CC80BDA77A5FF88714F158514EA0CAB342D774FA51CB94

Function 029D8206 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029D7FFB,029D7FEB), ref: 029D8221
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 029D8234
Wow64GetThreadContext.KERNEL32(00000384,00000000), ref: 029D8252
ReadProcessMemory.KERNELBASE(0000038C,?,029D803F,00000004,00000000), ref: 029D8276
VirtualAllocEx.KERNELBASE(0000038C,?,?,00003000,00000040), ref: 029D82A1
WriteProcessMemory.KERNELBASE(0000038C,00000000,?,?,00000000,?), ref: 029D82F9
WriteProcessMemory.KERNELBASE(0000038C,00400000,?,?,00000000,?,00000028), ref: 029D8344
WriteProcessMemory.KERNELBASE(0000038C,?,?,00000004,00000000), ref: 029D8382
Wow64SetThreadContext.KERNEL32(00000384,04E60000), ref: 029D83BE
ResumeThread.KERNELBASE(00000384), ref: 029D83CD

Strings

TerminateProcess, xrefs: 029D82B0

Memory Dump Source

Source File: 00000000.00000002.2202807808.00000000029D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 029D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29d7000_gem1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: TerminateProcess
API String ID: 2687962208-2873147277
Opcode ID: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction ID: b5b2a0393d0004684c513fdc3456ef851ce436205c62a4f403b2c30fdfdbf2a2
Opcode Fuzzy Hash: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction Fuzzy Hash: CF312D72240646ABD734CF94CC91FEA7365BFC8B15F148508EB09AF281C6B4BA01CB94

Function 00E94312 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(039D358C,?,?,?), ref: 00E94391

Strings

F, xrefs: 00E9433A

Memory Dump Source

Source File: 00000000.00000002.2202536099.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_gem1.jbxd

Similarity

API ID: ProtectVirtual
String ID: F
API String ID: 544645111-1845153225
Opcode ID: f9026a344a59b133cf7c18abb6ee53cf65626a27b722dd32d49483dfa088eb22
Instruction ID: 412ef49e5b082d6fd8dac34b197b8781187b69270703d2fd14d1bd32690ff61c
Opcode Fuzzy Hash: f9026a344a59b133cf7c18abb6ee53cf65626a27b722dd32d49483dfa088eb22
Instruction Fuzzy Hash: 8321C0B5901259EFDB00CF9AD984ADEFBB4FF48314F10812AE918B7240D3B5A954CFA1

Function 00E906D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(039D358C,?,?,?), ref: 00E94391

Strings

F, xrefs: 00E9433A

Memory Dump Source

Source File: 00000000.00000002.2202536099.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_gem1.jbxd

Similarity

API ID: ProtectVirtual
String ID: F
API String ID: 544645111-1845153225
Opcode ID: e20c98ea3c851015c850e719d8bbaf43939ddfc8e0a68174f48675519443d162
Instruction ID: 14c5bd05efd6e698dd5d921dddc56ab26a66f5f9083248f7f3dadad3e0e1fe95
Opcode Fuzzy Hash: e20c98ea3c851015c850e719d8bbaf43939ddfc8e0a68174f48675519443d162
Instruction Fuzzy Hash: 5621C3B5D01659EFCB00DF99D884ADEFBB4FB48314F10812AE918B7240D3B56954CBE5

Analysis Process: gem1.exePID: 5864, Parent PID: 2432COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.3%
Total number of Nodes:	1924
Total number of Limit Nodes:	104

Executed Functions

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 00485F72
GetSystemMetrics.USER32(0000004D), ref: 00485F7C
GetSystemMetrics.USER32(0000004E), ref: 00485F86
GetSystemMetrics.USER32(0000004F), ref: 00485F90
GetDC.USER32(00000000), ref: 00485F9A
GetDeviceCaps.GDI32(00000000,00000008), ref: 00485FAF
GetDeviceCaps.GDI32(?,0000000A), ref: 00485FBB
CreateCompatibleDC.GDI32(?), ref: 00485FC5
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 00485FDA
SelectObject.GDI32(?,00000000), ref: 00485FEE
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,40CC0020), ref: 0048601D
SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 0048604F
DeleteDC.GDI32(?), ref: 0048606E
ReleaseDC.USER32(00000000,?), ref: 00486077
DeleteObject.GDI32(?), ref: 00486083
IStream_Size.SHLWAPI(?,?,?), ref: 004860F5
IStream_Reset.SHLWAPI(?), ref: 00486104
IStream_Read.SHLWAPI(?,00000000,?,?), ref: 0048611E
DeleteDC.GDI32(?), ref: 00486175
ReleaseDC.USER32(00000000,?), ref: 00486183
DeleteObject.GDI32(?), ref: 0048618F

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Delete$CreateMetricsObjectStream_System$CapsCompatibleDeviceRelease$BitmapCallbackDispatcherReadResetSelectSizeStreamUser
String ID:
API String ID: 2798906502-0
Opcode ID: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction ID: 1540f068b23de5c11a4fec01122546931e44dbb37a8a944e45ab45a1281bc334
Opcode Fuzzy Hash: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction Fuzzy Hash: F4812971C01218AFDB11EB64DC49BEDBBB8EF09314F1041AAE509B7291DB742E84CF99

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000000,00000348,00000001), ref: 00486A68
Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000001), ref: 00486ABD

Part of subcall function 004868B0: RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Part of subcall function 004863F0: GetUserNameW.ADVAPI32(?,?), ref: 00486464

Part of subcall function 004864E0: GetComputerNameW.KERNEL32(?,?), ref: 00486554

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044BAD0: Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

GlobalMemoryStatusEx.KERNEL32(?,00000003), ref: 00488A6C
GetDesktopWindow.USER32 ref: 0048936A
GetWindowRect.USER32(00000000), ref: 00489371
_strftime.LIBCMT ref: 0048956B
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,system,00000006), ref: 0048979A

Strings

computer_name, xrefs: 00488CBE
user_name, xrefs: 004885A6
timezone, xrefs: 004899BF
time, xrefs: 004895E2
cpu, xrefs: 0048887B
%d-%m-%Y, %H:%M:%S, xrefs: 00489560
system, xrefs: 004884CA, 00488633, 0048879C, 00488905, 00488A9E, 00488BDF, 00488D48, 00488F88, 004891A9, 00489507, 00489681, 00489933, 00489A78, 00489C87
gpu, xrefs: 00488712
ram, xrefs: 00488B55
>wfw, xrefs: 0048920B

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Name$Concurrency::cancel_current_taskDevicesDisplayEnumWindow$ComputerDesktopFileGlobalMemoryModuleRectStatusUserValue_strftime
String ID: %d-%m-%Y, %H:%M:%S$>wfw$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 3994675093-2215247992
Opcode ID: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction ID: 1ab1bce1cb2369babe93dc2c843a9f66333b387f055d73d8335e63cf3a34051b
Opcode Fuzzy Hash: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction Fuzzy Hash: FC037970C052A99BDB26DF28C8547DDBBB1AF19308F2482DEE44867242DB751F85CF92

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,30B73C3E), ref: 0047E2A3
OpenProcessToken.ADVAPI32(00000000), ref: 0047E2AA
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 0047E2CE
CloseHandle.KERNEL32(00000000), ref: 0047E2F3
ExitProcess.KERNEL32 ref: 0047E32D
OpenMutexA.KERNEL32(001F0001,00000000,?), ref: 0047E411
ExitProcess.KERNEL32 ref: 0047E420
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 0047E436
ExitProcess.KERNEL32 ref: 0047E457
ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Strings

SeImpersonatePrivilege, xrefs: 0047E341
SeDebugPrivilege, xrefs: 0047E337

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Process$ExitMutex$CloseHandleOpenToken$CreateCurrentInformationRelease
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 1905835197-3768118664
Opcode ID: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction ID: e600725b129d9e3f70f3f4d3925b8df88ff981f4a24a656009bcaac003b6a44b
Opcode Fuzzy Hash: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction Fuzzy Hash: 80817F70D01258EFDB00EFE6D9457DDBBB4EF08308F10815EE51AA7281DB785A05DB69

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,30B73C3E), ref: 004464FE
GetProcAddress.KERNEL32(00000000,?), ref: 0044664C
GetProcAddress.KERNEL32(?,?), ref: 0044678C
GetProcAddress.KERNEL32(?,?), ref: 00446831
GetProcAddress.KERNEL32(?,?), ref: 004468D6
GetProcAddress.KERNEL32(?,?), ref: 0044697B
GetProcAddress.KERNEL32(?,?), ref: 00446A27
FreeLibrary.KERNEL32(00000000), ref: 004473A1

Strings

vault, xrefs: 00447225
system, xrefs: 004471E6
!F, xrefs: 00446482

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: system$vault$!F
API String ID: 2449869053-2452413646
Opcode ID: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction ID: b3fd50756066dde9c2bcdca3b11f87412f5b17b86e41c1a20d378922be8368ac
Opcode Fuzzy Hash: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction Fuzzy Hash: 2CA2DFB4D0426D8BDB25CFA8C884BEEBBB1BF59304F1081DAD948B7251DB385A85CF54

Function 0046BCE0 Relevance: 19.0, Strings: 13, Instructions: 2783COMMON

Download Yara Rule

Strings

filename, xrefs: 0046C4DA, 0046CBC7, 0046D523, 0046DE37, 0046E453, 0046E83D
`V[, xrefs: 0046F380
#d5,, xrefs: 0046C1C2
status, xrefs: 0046EAE9, 0046EB07, 0046EB32, 00470B25
directory_iterator::directory_iterator, xrefs: 00470B15
recursive_directory_iterator::operator++, xrefs: 0046EB13
exists, xrefs: 0046EACA, 0046EADE, 0046EB27, 0046EB5E
QOP, xrefs: 0046D776
content, xrefs: 0046C51D, 0046CCEC, 0046D648, 0046DF50, 0046E496, 0046E87D
key, xrefs: 004706E0, 004707EA
chrome_key, xrefs: 00470925, 00470A2A
recursive_directory_iterator::recursive_directory_iterator, xrefs: 0046EAFC, 0046EB4A
3sQ, xrefs: 0046D023

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: #d5,$3sQ$QOP$`V[$chrome_key$content$directory_iterator::directory_iterator$exists$filename$key$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 0-172604419
Opcode ID: 17df5ce69d1b830cbb9f37ff71955c945b1fa03de86001ee781908370b965299
Instruction ID: 6f449b873cefd2acf2ff512572e56acebc9c82323065b3056b94c270879c015f
Opcode Fuzzy Hash: 17df5ce69d1b830cbb9f37ff71955c945b1fa03de86001ee781908370b965299
Instruction Fuzzy Hash: 0C539870D01298DBDB21DBA8C9447DDBBB0AF19314F1482DEE44967292EB381F85CF96

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00485AB8
InternetOpenUrlA.WININET(00000000,?,?,00000000,84880100,00000000), ref: 00485B23
HttpQueryInfoW.WININET(00000000,00000013,?,?,00000000), ref: 00485B7C
HttpQueryInfoW.WININET(00000000,00000005,?,00000040,00000000), ref: 00485C0D
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 00485C4F
InternetReadFile.WININET(00000000,00000000,?,0B911A77), ref: 00485CE0
InternetCloseHandle.WININET(00000000), ref: 00485DEE

Strings

dk{u, xrefs: 004858C5

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Internet$Query$HttpInfoOpen$AvailableCloseDataFileHandleRead
String ID: dk{u
API String ID: 1359475806-1025949191
Opcode ID: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction ID: 61ea4010c365d261526b7633df9a1f3866779007c1279ae13805143fd257e1b9
Opcode Fuzzy Hash: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction Fuzzy Hash: 320203B0D057599BDB20CFA4C944BDDBBB5BF19304F20819AE848BB241EB746A84CF95

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000001,?,?), ref: 004B85DD
GetLastError.KERNEL32 ref: 004B85E7
FindFirstFileW.KERNEL32(000000FF,?), ref: 004B85FE
GetLastError.KERNEL32 ref: 004B8609
FindClose.KERNEL32(00000000), ref: 004B8615
___std_fs_open_handle@16.LIBCPMT ref: 004B86CE

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction ID: b482ff722bd6c6e5562e69f300935f677b27db246a655513dfd80cbad8c50a56
Opcode Fuzzy Hash: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction Fuzzy Hash: 6271A174A01619AFCB60CF28DC84BEAB7B8BF15314F24466AE854E3380DF389D41CB65

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,30B73C3E,30B73C3E,00000000,00000000), ref: 0048CBC1
OpenProcessToken.ADVAPI32(00000000), ref: 0048CBC8
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0048CBDF
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0048CC10
CloseHandle.KERNEL32(00000000), ref: 0048CC2E

Strings

SeDebugPrivilege, xrefs: 0048CBD9

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction ID: c2b5bf8999928723eaabf61e86e1a0babf1022b92d12b441156265fc3f808218
Opcode Fuzzy Hash: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction Fuzzy Hash: 4631A471D01208AFDB10DFA5DD85BEEBBB8EB09710F14422BE911B7280DB745A44CBB5

Function 004422D0 Relevance: 10.4, Strings: 7, Instructions: 1667COMMON

Download Yara Rule

Strings

users, xrefs: 004436FB
exists, xrefs: 00443EB5, 00443EEC
content, xrefs: 00442C08, 004431CF, 00443CA9
filename, xrefs: 00442AC9, 004430A3, 00443BED
config, xrefs: 00442DB6
status, xrefs: 00443EDC
directory_iterator::directory_iterator, xrefs: 00443EA5, 00443ECC

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$___std_fs_directory_iterator_advance@8
String ID: config$content$directory_iterator::directory_iterator$exists$filename$status$users
API String ID: 1444412035-815903332
Opcode ID: 318ca2c7c1d0ec5466f5f7fa8089217a923a2ba81121507c44c59a0bacf04028
Instruction ID: 69ad5e660c85d4a4c183ac21095e054d7cf3219f32a2a219316693d81515d842
Opcode Fuzzy Hash: 318ca2c7c1d0ec5466f5f7fa8089217a923a2ba81121507c44c59a0bacf04028
Instruction Fuzzy Hash: 83036670C012A8DBEB25DF68C9447EDBBB0BF19308F1481DAE44967242DB785B89CF95

Function 004473D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 301processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,30B73C3E), ref: 0044741C
Process32FirstW.KERNEL32(00000000,?), ref: 00447468
Process32NextW.KERNEL32(?,0000022C), ref: 004475CD
CloseHandle.KERNEL32(?), ref: 004478D2

Strings

[PID: , xrefs: 004474B1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 00a4c7370ab244673b995b9020be7cd172b3c681c07cd5bca9af25658960b9f7
Instruction ID: 3632983ffbfa210010dfb9a713b5006bf5dbac80d679a8e5b8b4f374b17b9b69
Opcode Fuzzy Hash: 00a4c7370ab244673b995b9020be7cd172b3c681c07cd5bca9af25658960b9f7
Instruction Fuzzy Hash: 0AE14770D112689BDB2ADF24CC807AEBBB9BF59304F1481D9E84867251DB346F89CF45

Function 00470EF0 Relevance: 8.2, Strings: 6, Instructions: 690COMMON

Download Yara Rule

Strings

exists, xrefs: 00470ED5, 00472E56
filename, xrefs: 004719B8
prefs.js, xrefs: 00472363, 0047237A
4So, xrefs: 00472161
;r0', xrefs: 00472481
Te=J, xrefs: 004724F1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: ;r0'$Te=J$exists$filename$prefs.js$4So
API String ID: 0-741858243
Opcode ID: 11664829bde5b78b5a453b90576b65e8c9c4f4be2f2613c5aa62205ba5478c4c
Instruction ID: 8485e3fbea9921b25a1b00865498cb3d77a8dac2e86307723f5e7c2a487e452b
Opcode Fuzzy Hash: 11664829bde5b78b5a453b90576b65e8c9c4f4be2f2613c5aa62205ba5478c4c
Instruction Fuzzy Hash: F182EFB0D052689FDB65CF68C985BDDBBB0AF19304F1082EAE84CA7251EB341B85CF55

Function 0043E4F0 Relevance: 7.5, Strings: 5, Instructions: 1249COMMON

Download Yara Rule

Strings

exists, xrefs: 0043FA4C, 0043FA60, 0043FA9F
content, xrefs: 0043EE5E, 0043F460, 0043F8A2
filename, xrefs: 0043ED01, 0043F2D8, 0043F71D
status, xrefs: 0043FA76, 0043FA82
directory_iterator::directory_iterator, xrefs: 0043FA92

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_fs_convert_wide_to_narrow@20
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 2353561611-3429737954
Opcode ID: 7405bf85bba606f5aa6e5f11bda1af194d4c4d3f657d06d7efc73589d2298c94
Instruction ID: 45a97de4b3c177a88e72af5189b64a28b2304548a2ed9d28553215762f3f74ee
Opcode Fuzzy Hash: 7405bf85bba606f5aa6e5f11bda1af194d4c4d3f657d06d7efc73589d2298c94
Instruction Fuzzy Hash: DBD24770D05268DBDB22DF68C8547DDBBB0AF19304F1482DAE44867282DB785F89CF95

Function 004402D0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 004403C0
FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Strings

content, xrefs: 0044063C
filename, xrefs: 004405E4

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$filename
API String ID: 1690352074-474635906
Opcode ID: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction ID: 3fd07a7a2c97014430c74f1e6d5836f1a3ad12268408335d8deab24a75892f91
Opcode Fuzzy Hash: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction Fuzzy Hash: 2BD1D430D01249DBEB15EB64CD457EEBBB4AF21308F1440AEE505A7292DB785F48CB96

Function 0043C970 Relevance: 6.9, Strings: 5, Instructions: 699COMMON

Download Yara Rule

Strings

exists, xrefs: 0043D470
content, xrefs: 0043D260
filename, xrefs: 0043D0F6
status, xrefs: 0043D48F
directory_iterator::directory_iterator, xrefs: 0043D484

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 0-3429737954
Opcode ID: 0f0324d2262f6727271b1798928450f2e50f2587d7e5877d9cda94f309b22af2
Instruction ID: 4f0253fa2b569f3355fb29b5c5a77bd21c490a3de55638da9b673f05fe568e9e
Opcode Fuzzy Hash: 0f0324d2262f6727271b1798928450f2e50f2587d7e5877d9cda94f309b22af2
Instruction Fuzzy Hash: 137234B0D05268CBDB25CFA8C8817EEBBB1BF19304F14819AD849B7341DB785A85CF95

Function 00459A06 Relevance: 6.8, Strings: 5, Instructions: 541COMMON

Download Yara Rule

Strings

object key, xrefs: 00459E92, 0045A1C4
R, xrefs: 0045A25B
array, xrefs: 00459FC0
object separator, xrefs: 00459DE0, 0045A118
object, xrefs: 0045A06C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: R$array$object$object key$object separator
API String ID: 0-4025529536
Opcode ID: c2ea74c46638cb6805419194197d9cd192a644bc36a2140f7da50fef402dd0ab
Instruction ID: a821d995b12610201d621210502fbeceba3941e2954cbb2726e101dc0738d9ca
Opcode Fuzzy Hash: c2ea74c46638cb6805419194197d9cd192a644bc36a2140f7da50fef402dd0ab
Instruction Fuzzy Hash: C322CB70D0035CDFDB14DBA8C855BEEBBB4AF15305F10455EE806A7282EB786A4CCB95

Function 00485350 Relevance: 6.3, APIs: 4, Instructions: 316networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00002000,00000000), ref: 004854A4
recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(00000200), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction ID: ea48c0c3f42896101b1dfecbe024c21eb3956ad5c3a4809403442742827d540a
Opcode Fuzzy Hash: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction Fuzzy Hash: 4CE19C70D01298DEDB14EB64CC49BDEBBB2BF14308F1041DAE449AB292DB745E88DF95

Function 00487780 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 515timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,30B73C3E,00000000,000000BF), ref: 00487C87

Strings

[UTC, xrefs: 00487C45
@Zb=, xrefs: 00487A4F

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: @Zb=$[UTC
API String ID: 565725191-730387550
Opcode ID: ecc325c629874c76bfafec243e908c12f8c02a0cf1ea070a0f793f87ea8e073d
Instruction ID: 6d71337f0f8cf227c7c56c381cd8fae4285dcd83216f0cb77706b7edbf0b928b
Opcode Fuzzy Hash: ecc325c629874c76bfafec243e908c12f8c02a0cf1ea070a0f793f87ea8e073d
Instruction Fuzzy Hash: E0520270D052688BDB25CF28CC947DDBBB1BF59304F1082DAD949AB281DB756B85CF84

Function 0043BF70 Relevance: 5.6, Strings: 4, Instructions: 612COMMON

Download Yara Rule

Strings

exists, xrefs: 0043C948
content, xrefs: 0043C73C
filename, xrefs: 0043C5CC
directory_iterator::directory_iterator, xrefs: 0043C95F

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 118556049-1400943384
Opcode ID: f5691b255ea6dbc5edbd5c9a2dd3daa32d7e1fdddb1a19eceb15310520a34560
Instruction ID: f0d25c64484c1e08d98ca61568cc243e7f3e3728f1e912629745c9d05fd4e174
Opcode Fuzzy Hash: f5691b255ea6dbc5edbd5c9a2dd3daa32d7e1fdddb1a19eceb15310520a34560
Instruction Fuzzy Hash: F26234B0D01268CBDB25DFA8C9817EDBBB0BF19304F14829AD84977342DB785A85CF95

Function 004A1074 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049C0BD: RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
Part of subcall function 0049C0BD: GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Standard Time, xrefs: 004A117F
Eastern Summer Time, xrefs: 004A1193

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction ID: 53762b2ebd1cb462dfa51e434dc7c6f7f2cc61e8d19f93444a713380c049c16d
Opcode Fuzzy Hash: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction Fuzzy Hash: 73410871C00224ABDB10AF76DC45A9F7BB8EF6A754F10415BF510EB2A1E7349D04DB98

Function 004B84C0 Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,30B73C3E,00000001), ref: 004B84CC
FindFirstFileExW.KERNEL32(000000FF,00000001,30B73C3E,00000000,00000000,00000000,00000001,00000001,?,?,004B84EE,00000001,?,?,00437D69,?), ref: 004B84FB
GetLastError.KERNEL32(?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,30B73C3E,00000001), ref: 004B850D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction ID: a5a0d7868366c0cca89b591e166bcddb9b03d08ebbd2c2fb18ba3c3c76c3338f
Opcode Fuzzy Hash: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction Fuzzy Hash: 0AF03071001109BFDB216FA4EC08AAA7B9DEB14360B10862ABD28C55A0EA359961DB79

Function 004479C0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 647COMMON

Download Yara Rule

APIs

Part of subcall function 00487290: RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,30B73C3E,?,0051C288), ref: 0048735B
Part of subcall function 00487290: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,30B73C3E,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004487A3

Part of subcall function 004870B0: RegCloseKey.ADVAPI32(00000000), ref: 00487260

Strings

0hC, xrefs: 00448799

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Open$CloseEnumIos_base_dtorQueryValuestd::ios_base::_
String ID: 0hC
API String ID: 3553622603-2581318919
Opcode ID: d67952ad296be641604341227b5bd81adf4ff3c928ca5be23fbad6f8090b2740
Instruction ID: d381e0b8d15ce89c3a027b92e8a5ae116750b180a2e65f5cba22683de7249f8f
Opcode Fuzzy Hash: d67952ad296be641604341227b5bd81adf4ff3c928ca5be23fbad6f8090b2740
Instruction Fuzzy Hash: EA82CEB4E152688FEB25CF18C8957DDBBB0BF5A304F5082DAD98DA7241DB305A85CF81

Function 0047A610 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction ID: 0fc5e8941a16b16f9458543aa06cdc6e77fe0ca1878954e15eaf8ff6be4b297f
Opcode Fuzzy Hash: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction Fuzzy Hash: 86518B70C00249EBEB00DFA5D845BDEFBB4FF54708F14821AE81477281D7B96A98CBA5

Function 0046EB70 Relevance: 2.3, Strings: 1, Instructions: 1019COMMON

Download Yara Rule

Strings

i`[, xrefs: 0046FECB

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: i`[
API String ID: 0-627998571
Opcode ID: e3a410a9e3ca53c342af7cc7fde5a733c932cb315480ea9a7238ac1123cd91a2
Instruction ID: f409668d1dcd92952583ea64716c6161a23bbeab54c2797513d5a6ff86e8a7fe
Opcode Fuzzy Hash: e3a410a9e3ca53c342af7cc7fde5a733c932cb315480ea9a7238ac1123cd91a2
Instruction Fuzzy Hash: 68D29DB4D0436C8ADB25CF99D8957DCFBB2BF49304F00819AD959AB345EB341A8ACF44

Function 00487550 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,30B73C3E), ref: 00487605

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction ID: 0be71067b94349f3b163f10fc7865c9901b3f86c171c2f757c76e38bbf7f7ec5
Opcode Fuzzy Hash: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction Fuzzy Hash: 3351BD70C05318DBDB20DF64D85979EB7B0EF18304F1082DED409A7291EBB86A88CB95

Function 004863F0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00486464

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction ID: 991b9e5c4f1dd7985d860474454b41f109cd49006b683c09ab2e27c6457cb47f
Opcode Fuzzy Hash: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction Fuzzy Hash: AF217FB0D043189BD721DF15C844B9ABBF4FB08714F0046AEE84997380DBB9A6849BE5

Function 00486C50 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

cores, xrefs: 00486E4E

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction ID: e3a9e89045bf121aadbf864e887aeb25ba0c58f762de233e8adf5c73134b1a6d
Opcode Fuzzy Hash: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction Fuzzy Hash: 2B916871D003599BDB00CFA8C9547EEFBB4FF59304F14825AE404BB292EBB56A84CB91

Function 0043A2B0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a584f50cec7d117239a346da7015494028620e642b4639fe7f05473c013932
Instruction ID: a79bf28788cd7fece911b6e1e66e8534556c7722a2d9226744d1a7d19b7185e3
Opcode Fuzzy Hash: 02a584f50cec7d117239a346da7015494028620e642b4639fe7f05473c013932
Instruction Fuzzy Hash: 89F197B4D053588BDB25CFA8CA91BDDBBB0AF4A314F20419AD84DBB351DB306A85CF44

Function 00439D60 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186fcadbebabc4ac8475eff220d5f03fe57b16df31032e8b523138032ae08221
Instruction ID: 4fd346efeb900e22f944567b89219bf35164593af445f665e6b4c60aa2d00baf
Opcode Fuzzy Hash: 186fcadbebabc4ac8475eff220d5f03fe57b16df31032e8b523138032ae08221
Instruction Fuzzy Hash: 76F187B4D053588BDB25CFA8CA91BDDBBB0BF5A304F20419AD84DAB351DB306A85CF44

Function 004395D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee95dc0e5b5396d58bf0237a5e01a6f13710f7daf9d7380e93e4a8007b91f328
Instruction ID: 7cc2350b8a4e2648267175039a6658fe4e1c6b2b5322fe7f087af9f211071a42
Opcode Fuzzy Hash: ee95dc0e5b5396d58bf0237a5e01a6f13710f7daf9d7380e93e4a8007b91f328
Instruction Fuzzy Hash: 0CF187B4D053588BDB25CFA8CA91BDDBBB0BF4A304F20419AD84DAB351DB306A85CF44

Function 00480C80 Relevance: 19.8, APIs: 13, Instructions: 258
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004808F0: InitializeCriticalSectionEx.KERNEL32(0051C7AC,00000000,00000000), ref: 0048096F
Part of subcall function 004808F0: GetLastError.KERNEL32 ref: 00480979

EnterCriticalSection.KERNEL32(00000004,30B73C3E,?,?), ref: 00480CD8
GdiplusStartup.GDIPLUS(00000000,00000001,?), ref: 00480D08
LeaveCriticalSection.KERNEL32(00000004), ref: 00480D13
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00480D42
GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00480D50
__alloca_probe_16.LIBCMT ref: 00480D7E
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00480DCE
GdipCreateBitmapFromScan0.GDIPLUS(?,?,?,0026200A,?,?), ref: 00480EB3
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 00480ED0
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F33
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F4C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream__alloca_probe_16
String ID:
API String ID: 1308617310-0
Opcode ID: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction ID: f4feccb951fe1b922ecb3dfaf5b8302156747445c0b76c240fb24b0f4f51c94e
Opcode Fuzzy Hash: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction Fuzzy Hash: D1A165B1D10208DFDB50DFA4C984BAEBBF4FF49314F24452AE905A7340D778A949CBA9

Function 00481B10 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 293
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00485E30: GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

WSAStartup.WS2_32(00000202,00516D04), ref: 00481C85
socket.WS2_32(00000002,00000001,00000000), ref: 00481C98
htons.WS2_32(00000002), ref: 00481CBF
inet_pton.WS2_32(00000002,00000000,00516E98), ref: 00481DA2
connect.WS2_32(00516E94,00000010), ref: 00481DB5
closesocket.WS2_32 ref: 00481DD5
WSACleanup.WS2_32 ref: 00481DDB

Strings

geo, xrefs: 00481C1D
NG, xrefs: 00481B1D
system, xrefs: 00481B74

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: NG$geo$system
API String ID: 213021568-968879199
Opcode ID: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction ID: a79096e42c26a1a604384fcb43a931ed9af1c00745f33276f8ffcea807cfd111
Opcode Fuzzy Hash: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction Fuzzy Hash: 1DC1AE70D01248DBDB00EFA8C8457DEBBB5FF15308F14421BE854AB391EBB86A85CB95

Function 004BC57A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BC233: CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

GetLastError.KERNEL32 ref: 004BC68E
__dosmaperr.LIBCMT ref: 004BC695
GetFileType.KERNEL32(00000000), ref: 004BC6A1
GetLastError.KERNEL32 ref: 004BC6AB
__dosmaperr.LIBCMT ref: 004BC6B4
CloseHandle.KERNEL32(00000000), ref: 004BC6D4
CloseHandle.KERNEL32(004BB653), ref: 004BC821
GetLastError.KERNEL32 ref: 004BC853
__dosmaperr.LIBCMT ref: 004BC85A

Strings

H, xrefs: 004BC7DF

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction ID: e4caf95108e2d56c13f9780512823c5111e6df0be3dd416bceb2684eca6e9c1f
Opcode Fuzzy Hash: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction Fuzzy Hash: 65A13632A041549FCF19AF68DCD1BEE3BA1AB46314F14015FF8119F391CB798906CBA9

Function 0047C6C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047C6FD
std::_Lockit::_Lockit.LIBCPMT ref: 0047C71F
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C747
std::_Facet_Register.LIBCPMT ref: 0047C834
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C85E

Strings

`aC, xrefs: 0047C7EE
p]C, xrefs: 0047C7E1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: `aC$p]C
API String ID: 459529453-1363152631
Opcode ID: cabbe5fe4785e35b59348adf3c277be28f3fa8ecccfc8a2d1daf856e2b5672de
Instruction ID: 399bbb442a0c6c40ac274560e971594f6ebfe9651e6100c107b7a0aaef0602e2
Opcode Fuzzy Hash: cabbe5fe4785e35b59348adf3c277be28f3fa8ecccfc8a2d1daf856e2b5672de
Instruction Fuzzy Hash: 2C517A71900249DFDB15CF99C580BEEBBB4EB15318F24805ED409AB381DB79AE09CF95

Function 00481110 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 526
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004812EC
GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,000000B8), ref: 004812FC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00481388
ReadFile.KERNEL32(00000000,00000000,00516C10,00000000,00000000), ref: 004813A4

Strings

exists, xrefs: 0048181F
0hC, xrefs: 004812E2

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: File$Ios_base_dtorPointerReadSizestd::ios_base::_
String ID: 0hC$exists
API String ID: 418202444-4085241440
Opcode ID: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction ID: 03b619e30c80654d4b10cf1501dd509fce63877f60a48615618d7203a258c35b
Opcode Fuzzy Hash: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction Fuzzy Hash: 3E425D70D01248DFDB10DFA9C9447DDBBF4BF19308F10819AE849A7291DB746A89CF95

Function 00453280 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00453446
___std_exception_destroy.LIBVCRUNTIME ref: 00453463

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,30B73C3E), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 004536B0
___std_exception_destroy.LIBVCRUNTIME ref: 004536CD

Strings

MC, xrefs: 0045343C, 00453458, 004536A6, 004536C2
value, xrefs: 00453386, 004535E5

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction ID: 0b049260404a019bd3923239173dd3b15bf9369a861e2bc94eedd162a5d5976f
Opcode Fuzzy Hash: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction Fuzzy Hash: 1EF16B70C05298DEEB20DB65C954BDEFBB4AF19304F1481DED84963282E7746B88CF96

Function 0049EF0E Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a8d8a0d010bfcdd7b7552ae8f1acfd8285e4568f7e2a95cc7afd66be91c88e
Instruction ID: af9c87e70908a1ee06dfbc346dd9d7a470d4d3b04964572cafa80a59c2292356
Opcode Fuzzy Hash: 24a8d8a0d010bfcdd7b7552ae8f1acfd8285e4568f7e2a95cc7afd66be91c88e
Instruction Fuzzy Hash: ACB13274A04249EFEF11CF99C841BAE7FB1AF46304F14417AE5009B392C7B99D4ACB99

Function 0049865A Relevance: 9.3, APIs: 6, Instructions: 265COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004987E2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004987FE
__allrem.LIBCMT ref: 00498815
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498833
__allrem.LIBCMT ref: 0049884A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498868

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction ID: bac2f8d64b4771d1480d5067db4f3a3676e567bfb19d99c183f063f20f68270c
Opcode Fuzzy Hash: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction Fuzzy Hash: A68107B26007069BDB20EA6DCC41B5B7BE9AF52364F24453FF111DB791EB78D9008B98

Function 004823F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

exists, xrefs: 0048291E
0, xrefs: 004827FE
0hC, xrefs: 00482852

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC$exists
API String ID: 323602529-1229763112
Opcode ID: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction ID: 8ad686ceee80f5ac92384c61aa111afe13dce58c6585d204e44adfbc4e8d440e
Opcode Fuzzy Hash: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction Fuzzy Hash: 81D18070D0528CDAEB10DBA8CA45BDCBBF4AF19308F2440DDE4456B282DBB95F48DB56

Function 004865D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 230registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FD70: ___std_fs_get_current_path@8.LIBCPMT ref: 0047FE92

GetVolumeInformationW.KERNEL32(?,?,00000100,?,?,?,?,00000100,00000000,?,30B73C3E,?,?), ref: 00486757
RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905
ProductName, xrefs: 00486900

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InformationValueVolume___std_fs_get_current_path@8
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2814272438-1787575317
Opcode ID: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction ID: 5513a57b40c567382305f19abecc614c7fb65df7785b10e0462d816fc7d7abf5
Opcode Fuzzy Hash: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction Fuzzy Hash: DFA18BB1C012199BDB21DF55CD59BE9B7B4FF14304F1042EAE419A7281EB786B88CF94

Function 004A0DE2 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Standard Time, xrefs: 004A117F
Eastern Summer Time, xrefs: 004A1193

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 8af85f453ba9ab2101ba6703603c3064577747df0583f4df4771313aa803705a
Instruction ID: d63cae11faca7fbaaedfd5ec0c01f193a5a5e64d1a9f5e85edff99bc4745f09f
Opcode Fuzzy Hash: 8af85f453ba9ab2101ba6703603c3064577747df0583f4df4771313aa803705a
Instruction Fuzzy Hash: D5C15872D00211ABDB20AB65CC02ABF7BB9EF76754F10405BF901EB291E7788E41D798

Function 00481F10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D726
Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D750

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00482387

Part of subcall function 0043E440: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0043E4CF

Strings

exists, xrefs: 004823DA
0hC, xrefs: 0048237C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtor___std_fs_convert_narrow_to_wide@20std::ios_base::_
String ID: 0hC$exists
API String ID: 1525435645-4085241440
Opcode ID: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction ID: 349907f898d0770bf1c6c6bee16b757a414fbaa0545e2b95a55e182eb82389be
Opcode Fuzzy Hash: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction Fuzzy Hash: 1ED19F70D0528CDAEB10DBA8CA45BDCBBF0AF19308F2480DDD4456B282D7B95F58DB56

Function 00438180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004381BC

Part of subcall function 004B849F: FindNextFileW.KERNELBASE(?,00000001,?,00437D97,?,00000001,?,004BDC4D,00000001,?,?,?,30B73C3E,00000001), ref: 004B84A8

Strings

., xrefs: 004381CE
directory_iterator::operator++, xrefs: 00438294

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID: .$directory_iterator::operator++
API String ID: 3878998205-1036657373
Opcode ID: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction ID: 735a56af49808cf236c7d8626bd4983a1e4e1118483563b87a501f55d85a1d57
Opcode Fuzzy Hash: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction Fuzzy Hash: C7318D70A047188BCF30DF59C8887ABF7B4EB49310F14429EE45997391DB395E85CA84

Function 00435DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00435DCB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00435E2E

Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9375
Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9399

Strings

bad locale name, xrefs: 00435E51

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction ID: 3ec4c6a4a97d0462a05707b65000259191fcf5f6abdba4908dc577763c239046
Opcode Fuzzy Hash: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction Fuzzy Hash: 3B210570805784DFD320CF69C90478BBFF4AF15714F14868ED48597781D3B9AA04CBA5

Function 004868B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905
ProductName, xrefs: 00486900

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction ID: c2d08890748770af0873008191db5a05c2fa34d27609d4939fc155a72502f57e
Opcode Fuzzy Hash: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction Fuzzy Hash: 95218EB09003599BDB20DF54C805BEABBF8FF04704F10465EE845A7681DBB86A44CB95

Function 00487290 Relevance: 4.7, APIs: 3, Instructions: 178registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,30B73C3E,?,0051C288), ref: 0048735B
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397
RegCloseKey.ADVAPI32(00000000), ref: 0048751D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: f2df89f7ded2f01219635e19fa6094d0543fceec2d71050d0bf781645f1a3f7c
Instruction ID: e90b3dd054a924dd9803ab5f17a38fc1c4cefb0d6438d00707aa441ccba3a8d8
Opcode Fuzzy Hash: f2df89f7ded2f01219635e19fa6094d0543fceec2d71050d0bf781645f1a3f7c
Instruction Fuzzy Hash: E3717FF0D012189FDB20DF24CD94B9DB7B4EB54304F1082DAEA19A7281D774AE88CF99

Function 004870B0 Relevance: 4.6, APIs: 3, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,30B73C3E,0051C570,0051C2A0), ref: 00487182
RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6
RegCloseKey.ADVAPI32(00000000), ref: 00487260

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction ID: b9c4edd99e38da91ddb4c738108b0054469e00b62f6e0a688ac56e9026d709b2
Opcode Fuzzy Hash: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction Fuzzy Hash: 905130B0D042189BDB20DF15CD54B9AB7F8FF45708F5042DEE609A7281DB74AA88CF99

Function 004855F0 Relevance: 4.6, APIs: 3, Instructions: 99networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(00000200), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction ID: c065b03366e761df0b34e2ad76ec595a4b6e3bb6db0e63c2aea2bbb819f94b56
Opcode Fuzzy Hash: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction Fuzzy Hash: 6C415830D11398CEEB14EB65CC59BDEBB71AF10308F1081DAE449672A2DB741E88DFA5

Function 00485E30 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction ID: dee3d2b381a88aa75edb4726eebd2668ef991be1adfc48943d59dd3409b8a73b
Opcode Fuzzy Hash: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction Fuzzy Hash: 60219D70A40305ABE730DF65DD09B5BBBF8EB44B14F104A1EF545AB6C0D7B9AA048BE4

Function 004A2897 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004A2891,00000016,0049036B,?,?,30B73C3E,0049036B,?), ref: 004A28A8
TerminateProcess.KERNEL32(00000000,?,004A2891,00000016,0049036B,?,?,30B73C3E,0049036B,?), ref: 004A28AF
ExitProcess.KERNEL32 ref: 004A28C1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction ID: 5f52cdf8944b70cf92df4f225d6e01553ce615c3954620652ef0a1f31c52b3c3
Opcode Fuzzy Hash: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction Fuzzy Hash: ACD09E71001108BBDF423F65ED0DB8E3F2AEF55745F044026B9095A131DB799995EB98

Function 004487D0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0048A490: GetEnvironmentStringsW.KERNEL32(30B73C3E), ref: 0048A4E4

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00448C83

Strings

0hC, xrefs: 00448C7C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EnvironmentIos_base_dtorStringsstd::ios_base::_
String ID: 0hC
API String ID: 21748421-2581318919
Opcode ID: 61df59d28ddfdf1926466add9277cbc79e4fef289339a47e2564f57312edc11d
Instruction ID: f3a074da2f4c09c6f09d17eaf24c6677e7622b6743d10a431c53a42b2b0ae44f
Opcode Fuzzy Hash: 61df59d28ddfdf1926466add9277cbc79e4fef289339a47e2564f57312edc11d
Instruction Fuzzy Hash: 9DE137B0D00269CBDB25DF18C841BDDBBB4BF59304F1086EAD44977242EB756A85CF91

Function 0047EE90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 0047F1C0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,30B73C3E), ref: 0047F211
Part of subcall function 0047F1C0: RegCloseKey.ADVAPI32(00000000), ref: 0047F221

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047F194

Strings

0hC, xrefs: 0047F18D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseIos_base_dtorOpenstd::ios_base::_
String ID: 0hC
API String ID: 1131316584-2581318919
Opcode ID: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction ID: cfb713b882ce29762410958d43b6c09695d359a02ab63b143eff75d03a191730
Opcode Fuzzy Hash: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction Fuzzy Hash: 59911674C00298CBDB20DF68C845BDDBBB0AB19314F1086EAD45977282DB746E88CF95

Function 00486F20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 00486F86

Strings

Unknown, xrefs: 0048705A

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction ID: 4cfd0b05124d6ad0cc2ed0fe670d1554fe3cca3eb32f1e14fa8b394e0e179909
Opcode Fuzzy Hash: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction Fuzzy Hash: 74418B71D00258CBDB20DF69C8407DEFBF4EF49704F1082AAD899A7281D774AA88CF91

Function 004ABC08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Strings

MC, xrefs: 00434FDC

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction ID: 040724f085c67d798f1d490f9b73413860191a50a7d7deb79defe6124e27c29a
Opcode Fuzzy Hash: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction Fuzzy Hash: 3611EB71800308ABCB10DF58DC01B9AB7ACEB15724F10466FF81597780EB79A940CBD8

Function 00447920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0044799C

Strings

0hC, xrefs: 00447996

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0hC
API String ID: 323602529-2581318919
Opcode ID: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction ID: 8ca8b340eaa0dfe9bad33bee777e0704730a4b63aab2394a13b70ad755bbc225
Opcode Fuzzy Hash: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction Fuzzy Hash: CD11ADB0840609DFDB10DF59C840A9DFBF8FB05328F208A6EE85197390EB74AA05CB80

Function 00460310 Relevance: 3.3, APIs: 2, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004604B4

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction ID: 66707b960993136107624c9d81ef05c918eca4bbb2b21c6d520a63eb0cd0cd41
Opcode Fuzzy Hash: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction Fuzzy Hash: 04A191B1E002159FDB14DF68C981AAFBBB4EB49314F24422FE815E7385E738AD05CB95

Function 00437CB0 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00437D64
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00437D92

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction ID: c774fac7b26238caf8a18ea1cc9dfb162d547f418ec2e445b27f5ef4f4107e88
Opcode Fuzzy Hash: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction Fuzzy Hash: E841A0B1D04218DBCB34DF64C480AEEB7B4EF19324F00516BE851AB381EB789D44CB94

Function 00480F90 Relevance: 3.1, APIs: 2, Instructions: 108COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,30B73C3E,?,?), ref: 0048101E
CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction ID: 3e538bd659216d3e4857fbb8bc962106784e19cd0647cea7878622876b38b54a
Opcode Fuzzy Hash: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction Fuzzy Hash: 4241ACB0D01748DBDB10CFA5C9457AEFBF4EF58314F20421EE811A7280EBB86A44CB94

Function 0047F1C0 Relevance: 3.1, APIs: 2, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,30B73C3E), ref: 0047F211
RegCloseKey.ADVAPI32(00000000), ref: 0047F221

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction ID: 54b3090d3cf4edc9b1beeea5084ab922e7ff7cf66e968ba670c482e571a875e7
Opcode Fuzzy Hash: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction Fuzzy Hash: 1021F675E002199BDB10EF95DC81BEFB7B4EB48714F14827EE819B7382EB399D048694

Function 0049AD6F Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0049ADBB
GetFileType.KERNEL32(00000000), ref: 0049ADCD

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction ID: 9b806bec79c801feb13e2bd810877b0a9fec2b0519df56a68c4b4061daa9a1e0
Opcode Fuzzy Hash: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction Fuzzy Hash: B611B7311047514ACF304A3E8C886677E96AB56331B39073FD4B687AF1C338D9A691CB

Function 0049F3BE Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000), ref: 0049F3FA
GetLastError.KERNEL32(00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000,?,0049BE05,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0049F407

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction ID: e391caa542caa0dd86735aa216be2178a54a5bfb1c46ce41420e93566301b438
Opcode Fuzzy Hash: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction Fuzzy Hash: 57012232614215AFCF058F69DC49D9E3F2AEF95324F24422AF811DB290E775EE41CB94

Function 0047E47D Relevance: 3.1, APIs: 2, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004473D0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,30B73C3E), ref: 0044741C
Part of subcall function 004473D0: Process32FirstW.KERNEL32(00000000,?), ref: 00447468

Part of subcall function 00445950: CredEnumerateA.ADVAPI32(00000000,00000000,?,?,30B73C3E,00000000,?), ref: 004459B2

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction ID: 21d12501465ffecb104f3396b5f4d487cf58cbb0265569f00e2db2d4d6eee1e0
Opcode Fuzzy Hash: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction Fuzzy Hash: D9114C71806548EAEB00FBF7950639DB7A0AF0431CF10C59FE90623182DF7D1A0596AF

Function 0047E4C8 Relevance: 3.0, APIs: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction ID: d8074609c4b6b56a118d8c4864159468ec2ce210cc92c7876c64f9fcb1cee0d4
Opcode Fuzzy Hash: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction Fuzzy Hash: CD017171806518DAE710FBE2D50679DB7A0AF0931CF50869FE90623282DF791A0187AE

Function 0049C0BD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction ID: 589170845ab709ad3b3b60fb6adb52998bb4654d1de7eee66c817f55301082a8
Opcode Fuzzy Hash: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction Fuzzy Hash: 9BE08631500614A7CF222BA1EC0D7893F58DB40355F104036F60897160DF398940CB88

Function 0048FAB0 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048FCEA

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction ID: 258a51d4530bdfdbcfb978a880514f411ab203130510da66870d02f2c2448e76
Opcode Fuzzy Hash: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction Fuzzy Hash: DB71F671A002088FCB24EF28C490B6E77A5BF15314F244A7FE865CB791D739EA49CB95

Function 0044AF90 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction ID: 5047db877c7d9ae38b531aa0dda64427d2377832e7d6361d0852b000475400c5
Opcode Fuzzy Hash: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction Fuzzy Hash: F45180B5A0060ADFDB18CF28D480999FBB4FF4A320B5082AAE819C7B51D735ED55CBD4

Function 0049E314 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction ID: 7d9f16a24b0820fe6bfe4efb506255557b861a5981f24711c09fdeca13a2084c
Opcode Fuzzy Hash: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction Fuzzy Hash: 8751C470A00104EFDF14CF5ACC85AAE7FA5AF99324F28816AE8095B352D379DE41CB95

Function 00458550 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004586AF

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction ID: 39eac46aceff4f274d7df031c3ad8bb7d561d247c585fc64f7f09dd83a036c2e
Opcode Fuzzy Hash: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction Fuzzy Hash: E941A4B1E001159FDB04DFA8C841AAEBBB5EF48315F10422EE815F7386DB34AE09CB95

Function 004520F0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0045223D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction ID: 543f2dd5f5f38f41d79c3b3e326d175c20dbca08f8aec97f7e4552ad9d8ce088
Opcode Fuzzy Hash: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction Fuzzy Hash: E1411272E001149BCB05EF68CD806AFB7A5EF56311F1402AFFC15EB302D6789E158B99

Function 00451F90 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004520DE

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction ID: 53fc907bca80d66a09b4c03435f3e8acb878ccb904669eb33cf36a05cbe64725
Opcode Fuzzy Hash: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction Fuzzy Hash: E7414272D001049BCB15AF68CD806AEBBA5AF4A305F1002ABED15EB342D7749E158BD9

Function 0048F890 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048F9FA

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction ID: 91311e753e2fbbf9cdae31aef67f458025fa5287f257254b7d49e4ed808e7769
Opcode Fuzzy Hash: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction Fuzzy Hash: 4F41B3B2E005049FDB14EF68C985A6EBBA9EB49320F24473EE815D7385DB349D04CB95

Function 004516D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004517DF

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction ID: 65e916faade23ef3c336758c75d3ad3b55c144e32e026a5ec30b5c92d10e86c8
Opcode Fuzzy Hash: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction Fuzzy Hash: BB316772E001105BCB18EE6D9880A6FB7E9EB88312B24427FEC15D7352DA38DD0987D9

Function 0044D7D0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044D8F9

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction ID: 6687ec20b77dec97c90771c2cbe71989815263d1b8fcacfb2e06f2ee49a1853a
Opcode Fuzzy Hash: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction Fuzzy Hash: C3310A71E002045BE714AE6DD880A7EB7A4EF55324F24477FF865C7382D67899408759

Function 0044BAD0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

Part of subcall function 00434F80: ___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction ID: f8cf7cd3dcf405c094d14d4edd2427269fc308b55f739c6c677f8adad7f52d2f
Opcode Fuzzy Hash: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction Fuzzy Hash: 902126B1E006059BE7149F25D48166AB7A4EF15324F20036FE8258BB91E739FE90C7D6

Function 004BB697 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB6D1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction ID: 7232828ef0ab4ea1277fc9c55e8108ad49929c9e06a984f5114aae078e858d40
Opcode Fuzzy Hash: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction Fuzzy Hash: B9113671A0010AAFCB05DF58E9819CF7BF4EF88304F00405AF808AB311D770D9118BA4

Function 00482930 Relevance: 1.5, APIs: 1, Instructions: 43networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000000), ref: 00482968

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction ID: 15365ef676efcd120e403479619ae1d38f6ec3fc5171ce29fb9a7f72e5811cf6
Opcode Fuzzy Hash: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction Fuzzy Hash: 93F0B472302115AB83109A5DAD4096BF7DEDBCA7B0B2003A7FC2CC33E0E9618C0153D4

Function 0049C6A4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0043FE48,00000001,?,00499445,00000001,00000364,00000001,00000006,000000FF,?,004AD408,0043FE4A,0043FE44,?), ref: 0049C6E5

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction ID: bf89d2d5fe5833ab0f4bff440cdb33f04d1e0b68cec02520bce29c64fa949510
Opcode Fuzzy Hash: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction Fuzzy Hash: 82F0BE322852256BAF215B229D85B5B3F589B417E0F195037FC08EA290CE78EC008AEC

Function 00454E60 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00454EB2

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 78740692b221e79a9762ccbd46d7f188a31b2ad2167c780b1c1497364ca8ea36
Instruction ID: 7ed3afec28be053f9a77c7416a11cc0d573f769e31c405d3d1c7fe45b1d11b08
Opcode Fuzzy Hash: 78740692b221e79a9762ccbd46d7f188a31b2ad2167c780b1c1497364ca8ea36
Instruction Fuzzy Hash: D3F0E9B11002080AA628D7A1950796F77C89EA036DB44453FE9058FA53E73DEDD9825D

Function 004406AD Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction ID: a1ffe5c8ce5f1f1a4397a2b9345f76ae3c812c30bf0ac5870f9d4861cf5b4c4e
Opcode Fuzzy Hash: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction Fuzzy Hash: 95015631A0625DDFEB20DFA4D988BAEBBB4EF14314F2040DAD909A7282C7346E04DF55

Function 0049D15A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction ID: de2ad87b2feeaf860c8dfd974d012cc9eb33a1afe18dd843800594eb24cb3dbb
Opcode Fuzzy Hash: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction Fuzzy Hash: 08E0E533A0132166EF212BA6AD02B5B3E48CB513A0F190137EC18962C4CB28DC0082ED

Function 004A8D62 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A8D69

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction ID: f589969de9c028132caa70972cc51c37c6bf7195d426b38a2c2fae52dece88af
Opcode Fuzzy Hash: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction Fuzzy Hash: 71E09A76C4020D9ADB40DFD5C486BEFB7BCAB14304F50406BA205E6181EB7857448BE5

Function 004BC233 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction ID: c65ff2ef24fd0563ec255788cd93a1d7270b85fbbbb51eec7110af243f851585
Opcode Fuzzy Hash: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction Fuzzy Hash: 05D06C3200010DBBDF028F84EC06FDA3BAAFB48714F018010BA1866020C732E821ABA4

Function 004B9AE2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00486DD6,?,?,?,30B73C3E,?,?), ref: 004B9AEC

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction ID: f88b8e15ca571a688dc5d535dfb7cb0f1e1a76fd2fb5174ce8f8aecae7ce3306
Opcode Fuzzy Hash: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction Fuzzy Hash: 0EC09B7490610E97CF00E7E5D94D88E77FCA608204F4004A1D551E3140E770FD45C795

Non-executed Functions

Function 0048A0A0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 325nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtDuplicateObject,30B73C3E,?,?), ref: 0048A0F7
GetProcAddress.KERNEL32(00000000), ref: 0048A0FE
OpenProcess.KERNEL32(00000040,00000000,00000000), ref: 0048A12A
NtQuerySystemInformation.NTDLL ref: 0048A153
NtQuerySystemInformation.NTDLL ref: 0048A178
GetCurrentProcess.KERNEL32 ref: 0048A1FD
NtQueryObject.NTDLL ref: 0048A22B
GetFinalPathNameByHandleA.KERNEL32(00000000,00000000,00000104,00000000,00000104,?,00000104,00000000), ref: 0048A315
CloseHandle.KERNEL32(00000000), ref: 0048A3E6
CloseHandle.KERNEL32(00000000), ref: 0048A441

Strings

ntdll.dll, xrefs: 0048A0EB
File, xrefs: 0048A25B
NtDuplicateObject, xrefs: 0048A0E6

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction ID: 0800680efb81c18e2f896ca5fb1c4f1751909ec1a20682d0b449f1ef79601e33
Opcode Fuzzy Hash: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction Fuzzy Hash: C3C1DE71D00218AFEF10EFA4DC45BAEBBB5FF44704F14452AE801A7281E7B9AD45CB96

Function 00419770 Relevance: 19.9, Strings: 2, Instructions: 17397COMMON

Download Yara Rule

Strings

>c8 , xrefs: 0042CFA0
YD@, xrefs: 0042C513

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: >c8 $YD@
API String ID: 0-2642259206
Opcode ID: 9dcf1b6b055526eb8ca3ce4f11dbcb7f980ceb29aa0c624363f390bc07ec487a
Instruction ID: 09539a6074c3f18202d3a6a28530d7ff6b4f8ede69b731f3fb06677334c75715
Opcode Fuzzy Hash: 9dcf1b6b055526eb8ca3ce4f11dbcb7f980ceb29aa0c624363f390bc07ec487a
Instruction Fuzzy Hash: B0B4BCB4D0525E8FCB15CFA8D9916EEFBB1AF59304F204299E948B7311D7302A81CFA5

Function 0047D2F0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044DCC0: std::ios_base::_Addstd.LIBCPMT ref: 0044DDEF

Part of subcall function 00436640: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047D95A

Strings

open, xrefs: 0047D7E5
.exe, xrefs: 0047D349, 0047D423
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0047D443
.cmd, xrefs: 0047D385
.ps1, xrefs: 0047D365
0hC, xrefs: 0047D950
.G, xrefs: 0047D646, 0047D6BC, 0047D8DD
.vbs, xrefs: 0047D3A5
runas, xrefs: 0047D7EA, 0047D82A, 0047D82B

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$Ios_base_dtor$AddstdConcurrency::cancel_current_task
String ID: .cmd$.exe$.ps1$.vbs$.G$0hC$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$open$runas
API String ID: 2154145882-3307477358
Opcode ID: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction ID: f5ba6b163c3a98fee3f853caf05b9595179ad2eb3f8f0c36a39513699dfd7300
Opcode Fuzzy Hash: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction Fuzzy Hash: 6A122770D00268DFDB20DF64CD85BDEBBB4AF19304F1481EAE849A7282DB755A84CF95

Function 00408270 Relevance: 12.0, Strings: 2, Instructions: 9466COMMON

Download Yara Rule

Strings

:v*-, xrefs: 00412A86
&iK, xrefs: 00412C8D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: &iK$:v*-
API String ID: 0-925339778
Opcode ID: 6b47c74f841ad1849f2da8e01aa531820f855eb79643490a739ceb0f548cc6b8
Instruction ID: a5ef6df3ed742f4fc82cee9b264c17634f39eece1ce4240dfd370ecc90fa88ba
Opcode Fuzzy Hash: 6b47c74f841ad1849f2da8e01aa531820f855eb79643490a739ceb0f548cc6b8
Instruction Fuzzy Hash: 3F44BDB8D0525ECBCB15CFA8C991AEEBBB1BF49300F20429AD94977311D7341A85CFA5

Function 004A70A7 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004A72BE

Strings

1#QNAN, xrefs: 004A71BA
1#INF, xrefs: 004A71DD
1#SNAN, xrefs: 004A71B3
1#IND, xrefs: 004A71AC

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 9bb7f0d4613073bb4100fe9d2ee9a21b6dd33393f0141ef8f2b167b3b51c02dc
Instruction ID: b32a4effb01217c3c1626ef3a6516b83a08c7bb55f85dd273b9c2c9ced56d987
Opcode Fuzzy Hash: 9bb7f0d4613073bb4100fe9d2ee9a21b6dd33393f0141ef8f2b167b3b51c02dc
Instruction Fuzzy Hash: 9ED21871E086288FDB75CE28CD407EAB7B5EB66315F1441EBD40DA7240EB78AE818F45

Function 00479130 Relevance: 9.4, Strings: 7, Instructions: 665COMMON

Download Yara Rule

Strings

port, xrefs: 00479A8E
extensions, xrefs: 00479AC1
links, xrefs: 00479AFA
build_name, xrefs: 00479B33
grabber_max_size, xrefs: 00479AA8
self_destruct, xrefs: 00479B6C
IG, xrefs: 0047913D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: IG$build_name$extensions$grabber_max_size$links$port$self_destruct
API String ID: 0-2908327215
Opcode ID: a51a615a470fb458997f34786117d96a264bb7b4b8cc7aaf03e891e1d6a13de9
Instruction ID: 544ee5dbb5ec9ed8f40eee544311bb513f632f9a1e78c8f4acb08f2b7fcbd3bd
Opcode Fuzzy Hash: a51a615a470fb458997f34786117d96a264bb7b4b8cc7aaf03e891e1d6a13de9
Instruction Fuzzy Hash: DC72F070D04358DBDB18DFA8D990BEDBBB1BF59304F20819AE449AB352DB346A85CF44

Function 0046B620 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B7DA
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B81E
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B924
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B970

Strings

., xrefs: 0046B942

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction ID: 99e23c5b304899c8ab8714ce46d423df57297e0934c6bc539a0dfe6d7ec6f1b4
Opcode Fuzzy Hash: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction Fuzzy Hash: 77C1BF75A016269FCB20DF18C8847AAB3B5FF44314F14829AD915D7390EB39AD85CFC6

Function 004A6109 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,004A641B,00000002,00000000,?,?,?,004A641B,?,00000000), ref: 004A61A2
GetLocaleInfoW.KERNEL32(?,20001004,004A641B,00000002,00000000,?,?,?,004A641B,?,00000000), ref: 004A61CB
GetACP.KERNEL32(?,?,004A641B,?,00000000), ref: 004A61E0

Strings

ACP, xrefs: 004A6127
OCP, xrefs: 004A615D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction ID: 02a1f9ff6d074017cf30d732e6d651dacf3b6180dce544ba7b26bbdffeda2481
Opcode Fuzzy Hash: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction Fuzzy Hash: 14217731B00101A6DB348F54C901A9BBBA7EB76B54B5F8466E909D7302EB36DE41C358

Function 004A62E5 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004A63ED
IsValidCodePage.KERNEL32(00000000), ref: 004A642B
IsValidLocale.KERNEL32(?,00000001), ref: 004A643E
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 004A6486
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004A64A1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction ID: c25bf07a23f3a9ec008bfe0b344d9b34e57977eb2ee5f51d57588e3c0d66081e
Opcode Fuzzy Hash: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction Fuzzy Hash: B351C031A00205ABDF10DFA5CC41AAF77B8BF2A700F09446BF905EB2C0D778D9058B68

Function 0042D150 Relevance: 6.9, APIs: 1, Strings: 2, Instructions: 1683COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0042E6CB

Strings

!dYH, xrefs: 0042EC76
6b6=, xrefs: 0042E43B

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: !dYH$6b6=
API String ID: 118556049-155378937
Opcode ID: 016e682e6e92c56b7e5f52a4a6c50224f71debeb36c814b1b43eac77d68e84f3
Instruction ID: 3adec6fdbd1554a06cbe821abd73873d9aa74c181532ca023f18934c78765b13
Opcode Fuzzy Hash: 016e682e6e92c56b7e5f52a4a6c50224f71debeb36c814b1b43eac77d68e84f3
Instruction Fuzzy Hash: 6023CDB8D0525CCBDB25CFA8C990AEDBBB1BF59300F24429AD84977311E7742A86CF54

Function 00498574 Relevance: 6.1, APIs: 4, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0049859D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 004985B1
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00498602
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00498617

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction ID: 57c86550534b148c15952eeeaf39776b02a492ab104de77fe61266457f658886
Opcode Fuzzy Hash: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction Fuzzy Hash: 91217C72E00119ABCF20DFA9DD85AEFBBB8EF45754F05017AE905E7140EA349D04C794

Function 004AC6BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004AC6CB
IsDebuggerPresent.KERNEL32 ref: 004AC797
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004AC7B0
UnhandledExceptionFilter.KERNEL32(?), ref: 004AC7BA

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction ID: 70dc3419eb2b6db1900c7bd06373213fcab329736da06f39ceabfcfe7a7444e5
Opcode Fuzzy Hash: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction Fuzzy Hash: E1314A75C012189BDF21DF61DC897CEBBB8BF18700F1041AAE40DAB250E7759A84CF48

Function 0043D4A0 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 725COMMON

Download Yara Rule

Strings

content, xrefs: 0043E150
filename, xrefs: 0043E0E3

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: content$filename
API String ID: 0-474635906
Opcode ID: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction ID: d087ffba84baf14db51f89a037efaf3a0efd4671473d6540ebf1f333b1c0f3d3
Opcode Fuzzy Hash: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction Fuzzy Hash: 5392EEB0C052AC9BDB66DF68D9857DDBBB4AF18308F1441DAE80CA7252EB741B84CF45

Function 004B824D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,00435B2A,?,?), ref: 004B8261
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000,?,?,00435B2A,?,?), ref: 004B8288

Strings

!x-sys-default-locale, xrefs: 004B825C

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction ID: 4f66f40a8a4f046c7b0032d4e1a4b833dd41128cf422eed9181fa496fdef01a0
Opcode Fuzzy Hash: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction Fuzzy Hash: 1AF030B5511108FFEF089BD5DC0EEEB77ACEB09394F10416AB501D6150E6B0AE00D778

Function 004BA04D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004805F0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,30B73C3E,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480617
Part of subcall function 004805F0: GetLastError.KERNEL32(?,00000000,00000000,30B73C3E,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480621

IsDebuggerPresent.KERNEL32(?,?,?,00434B5D), ref: 004BA080
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00434B5D), ref: 004BA08F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004BA08A

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction ID: d36ccacf6001ae6edc25a42526d65594664b7a1234a3e60676ee06f56b9b42c5
Opcode Fuzzy Hash: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction Fuzzy Hash: 64E065701007018FD330AF3AD40C3467BE0AB14304F00882FD945C7750E7B9D4088B66

Function 00474190 Relevance: 3.9, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

invalid literal, xrefs: 00474389
null, xrefs: 0047432B
invalid BOM; must be 0xEF 0xBB 0xBF if given, xrefs: 004741D1

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: invalid BOM; must be 0xEF 0xBB 0xBF if given$invalid literal$null
API String ID: 0-704505451
Opcode ID: c2853c1b5150f4562c75b0c9af08e518547b875ff11f585f7cc727e4d436818e
Instruction ID: 900511fe56f482f81459f08a410c1a76c5e1d1655cedb158031f5ff095a229d0
Opcode Fuzzy Hash: c2853c1b5150f4562c75b0c9af08e518547b875ff11f585f7cc727e4d436818e
Instruction Fuzzy Hash: 315183307001089BCB24EF79A5527BDB3E4DB95314F00859FE80E8BBC2DF69AA5497D9

Function 004320A0 Relevance: 2.8, Strings: 1, Instructions: 1521COMMON

Download Yara Rule

Strings

mce, xrefs: 004337A7

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: mce
API String ID: 0-4153875931
Opcode ID: a73292159e262abdb433d94eaae0cf6bfd02510e463947a96e78a37495f057a5
Instruction ID: f690702d9b6e5b1c8f3d94d1572842c367def53288e29523866870a81cfcc782
Opcode Fuzzy Hash: a73292159e262abdb433d94eaae0cf6bfd02510e463947a96e78a37495f057a5
Instruction Fuzzy Hash: 0603DCB8D0424A9FDB04CF98D591AEEBFB1FF59304F248119D945BB302D7312A89CBA5

Function 00407470 Relevance: 2.3, APIs: 1, Instructions: 833COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00407D8B

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: fe31969a8a19a14cbb2cc1aa8e38a226629513882e496fcef040987109d5691f
Instruction ID: 812474a2bd2a8ecf408f930e0567eb9d9337a7355d6dea629df30afde2b5ebb2
Opcode Fuzzy Hash: fe31969a8a19a14cbb2cc1aa8e38a226629513882e496fcef040987109d5691f
Instruction Fuzzy Hash: 7BA2D0B4D0429D8BDB15CFA8C9816EEBBB1FF58304F20819AD949BB345DB341A89CF54

Function 0047E580 Relevance: 1.9, APIs: 1, Instructions: 415COMMON

Download Yara Rule

APIs

Part of subcall function 00481970: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,30B73C3E), ref: 004819D8

ShellExecuteW.SHELL32(00000000,?,?,?,00000000,00000000), ref: 0047EC85

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 7424804a8784dfbdf273c5a717085f3b2be6b7ed6bb5d16cf0bfa5b6ce38600f
Instruction ID: 2a91a513cc0bd4868b0af53c92a7a879c8891e0eaa161494f23d7b10a733aea0
Opcode Fuzzy Hash: 7424804a8784dfbdf273c5a717085f3b2be6b7ed6bb5d16cf0bfa5b6ce38600f
Instruction Fuzzy Hash: 5032AEB4D0625CEBDB25CF98E981ADDBBB1FF48314F24419AE809A7341E7706A85CF44

Function 00462080 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00462407

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 998b97963232ca513792be5bccec286f05fd367684fe6908831998ecf4a6ed59
Instruction ID: ef4cf88e9a4fdd266e31e3aa05a67ef024deafe90fb21754261dea51a8be5403
Opcode Fuzzy Hash: 998b97963232ca513792be5bccec286f05fd367684fe6908831998ecf4a6ed59
Instruction Fuzzy Hash: 87D18A31D04A49DFCB05CFA8C9806ADFBF1BF59310F18865AD841EB341E7B4A985CB95

Function 00462410 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00462797

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 77eb809091e37f4e40faa665b14a1fdc1f259fd5624333971882c80142aac5d8
Instruction ID: ac15f3507e96ea44d263738e0e8876a083df1079939a1e49c6866d189bdfc312
Opcode Fuzzy Hash: 77eb809091e37f4e40faa665b14a1fdc1f259fd5624333971882c80142aac5d8
Instruction Fuzzy Hash: 25D1AB31E0464ADFCB04CFA8C9806ADFBF0BF59310F18865AD841EB341E7B4A941CB95

Function 004A620F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004A5FA9,00000000,00000000,?), ref: 004A623B

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: afed30a40adaf0fe2c2ae6d6b95a375c8a19700a8aa4b2d509547a2ce32d92aa
Instruction ID: 9487850153f17b5aff8b54b84101990ee62d9d6b8c11e223cf6e38bc87e8a6da
Opcode Fuzzy Hash: afed30a40adaf0fe2c2ae6d6b95a375c8a19700a8aa4b2d509547a2ce32d92aa
Instruction Fuzzy Hash: 3C01DB33A10112ABDF286A658D06BBB7768DB51754F1A446FEC06A3680DA38ED41C698

Function 00468750 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346dc23a3b721231884126440995aecd87b62a600a1fea4fb977c7ca1dd55190
Instruction ID: f8786dd4fa61ba6b8208f2a0da3dfae63e0824739066c1b4c5cfb23239ebdf74
Opcode Fuzzy Hash: 346dc23a3b721231884126440995aecd87b62a600a1fea4fb977c7ca1dd55190
Instruction Fuzzy Hash: A2F149B2E112198FDF08CF99D8915EEBBB2BFC8310B29826ED41667344DB346D05CB95

Function 004A5426 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9194f5c757f1635d934fcc685d379f44141296be3cd9e06fdbc5599b6296e9cf
Instruction ID: a96efd13eabcb712d80455b2c4eda02400c9a3c9733d671832283fb3a4145ee2
Opcode Fuzzy Hash: 9194f5c757f1635d934fcc685d379f44141296be3cd9e06fdbc5599b6296e9cf
Instruction Fuzzy Hash: B1B13975500B019FDB389B25CD92BB7B3E9EF65308F44442FE947C6680EA78E985CB18

Function 004B6380 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7fb0066ca0e63ce1a3140edfe9943461d3f2e4af0e2cb6d3b63da6b91ab0d1
Instruction ID: b44fcc7ce13d6765da29ef4693de0a604283395fac7cf3727fef9bca0c1881a8
Opcode Fuzzy Hash: 0a7fb0066ca0e63ce1a3140edfe9943461d3f2e4af0e2cb6d3b63da6b91ab0d1
Instruction Fuzzy Hash: 07E1A551C4CBD891E6274B3D88426E2F3F4BFF9219F15A706EEE422421FB3662C68751

Function 00461250 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ba32d3d0f547d4e0c0c2ee68133de1f9df539ce713836f75fcdfe5a29b6232
Instruction ID: aec3b6c702971bbda01d5f983ffd6c32ec602d3d125e3ae181568633efd48618
Opcode Fuzzy Hash: f0ba32d3d0f547d4e0c0c2ee68133de1f9df539ce713836f75fcdfe5a29b6232
Instruction Fuzzy Hash: E5C17B71E04649DFCB04CFA8C880AACFBB1BF59310F18826EE856E7351E734A955CB95

Function 0045C4C0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c816971dc4f363f466b11f2f4d5d7ddc684e31de2e014f784be5717bcb0236
Instruction ID: df46be6a361dd8f15a6f1edf4f2d8fac6e56a2b7ec9f979b005a651a2e3504fb
Opcode Fuzzy Hash: 66c816971dc4f363f466b11f2f4d5d7ddc684e31de2e014f784be5717bcb0236
Instruction Fuzzy Hash: 1B715372E1061A9FCB14CFADC9805AEB7F1FB88314F15822AE816E7345E774E905CB94

Function 0044E020 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0044E070
std::_Lockit::_Lockit.LIBCPMT ref: 0044E092
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E0BA
std::_Facet_Register.LIBCPMT ref: 0044E1D0
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E1FA

Strings

cC, xrefs: 0044E17E
`aC, xrefs: 0044E16A
p]C, xrefs: 0044E15D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: cC$`aC$p]C
API String ID: 459529453-2177106863
Opcode ID: 0ec5fc01751d5b833a82cdbf1fb86bd01fb7cc1a0f61e7ee4049cbe82690b1d5
Instruction ID: 1ff138599dd9b712ad814e44402e9ca08be03e0a2a2e3ebe43d51928b08ed38c
Opcode Fuzzy Hash: 0ec5fc01751d5b833a82cdbf1fb86bd01fb7cc1a0f61e7ee4049cbe82690b1d5
Instruction Fuzzy Hash: 99518BB0D00259DBEB10CF99C8457AEBBB4FB18314F24815ED811AB381DB79AA44CBA5

Function 00452250 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0045228D
std::_Lockit::_Lockit.LIBCPMT ref: 004522AF
std::_Lockit::~_Lockit.LIBCPMT ref: 004522D7
__Getcoll.LIBCPMT ref: 0045239F
std::_Facet_Register.LIBCPMT ref: 004523EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00452415

Strings

`aC, xrefs: 00452385
p]C, xrefs: 00452378

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID: `aC$p]C
API String ID: 1184649410-1363152631
Opcode ID: ffb4109bd5f0e03f7653836359533883caddf3a46b152359ef2760dfe1b9c1ae
Instruction ID: 568a7e1164ae6cef3cf0599e82aad122ccc02b6897634e5ab4797aad8f19cd87
Opcode Fuzzy Hash: ffb4109bd5f0e03f7653836359533883caddf3a46b152359ef2760dfe1b9c1ae
Instruction Fuzzy Hash: 49518B70800208DFDB01DF95C9457DEBBB4FF55318F24815ED805AB282DBB9AE49CBA9

Function 0047D190 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(File Downloader,00000001,00000000,00000000,00000000), ref: 0047D22D
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 0047D256
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D27C
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D2B2
InternetCloseHandle.WININET(00000000), ref: 0047D2B9
InternetCloseHandle.WININET(?), ref: 0047D2C5

Strings

File Downloader, xrefs: 0047D214

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction ID: 638e9360adee8abd238f5bb9f06079602c51a7af3a4d5d450420b7b82b1eb562
Opcode Fuzzy Hash: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction Fuzzy Hash: 5B318370A01655ABD730CF55CC45BEAB7B8EF44700F1041AAF549E7290DBB8AE84DFA8

Function 004AD600 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004AD637
___except_validate_context_record.LIBVCRUNTIME ref: 004AD63F
_ValidateLocalCookies.LIBCMT ref: 004AD6C8
__IsNonwritableInCurrentImage.LIBCMT ref: 004AD6F3
_ValidateLocalCookies.LIBCMT ref: 004AD748

Strings

csm, xrefs: 004AD6DD

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction ID: fca86a332ffc7d642b39a5fdc798139505592cae81a3a9a41e25a428a24f43dc
Opcode Fuzzy Hash: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction Fuzzy Hash: 2741D834E002089BCF10DF69C880A9E7BB5BF66318F14815BE81A5B752D739EA01CF95

Function 00436640 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,30B73C3E), ref: 004AFA6C

Strings

ios_base::badbit set, xrefs: 00436677, 004366A2
ios_base::failbit set, xrefs: 00436681
(>Q, xrefs: 004366D9
0hC, xrefs: 004366E3
ios_base::eofbit set, xrefs: 00436686

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: (>Q$0hC$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-798308736
Opcode ID: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction ID: 0e9c3b5a5aba75944b05d252eccadd5948fd44e578ec9c0118fa22ff265feac2
Opcode Fuzzy Hash: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction Fuzzy Hash: 4E1122B29046487BD710DB59DC02FAA7398EB09754F04862FFD58872C1EB3DA90487AA

Function 0049D57F Relevance: 9.3, APIs: 6, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction ID: c45b587b2b6024bbc8d631f61cfde13028adc071dc65d72902c8bf59655bd6a7
Opcode Fuzzy Hash: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction Fuzzy Hash: 64B13572D00255AFDF11DF64CC81BAA7FA5EF55310F1441BBE454AB382D2789D01C7A9

Function 004A2113 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004A21FD
__freea.LIBCMT ref: 004A228D
__freea.LIBCMT ref: 004A22A9

Strings

am/pm, xrefs: 004A230B
a/p, xrefs: 004A236F

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 2f1fc7fa59a782c27ac2a0a21d9667bbb23879f6a72bde815bccda8bcba835b0
Instruction ID: 1d0f90a389a6ddb01c6eee3cfed114d4cdbff39c5c4e16d1e763b1923b69fac5
Opcode Fuzzy Hash: 2f1fc7fa59a782c27ac2a0a21d9667bbb23879f6a72bde815bccda8bcba835b0
Instruction Fuzzy Hash: 32C1BF35904212AADB298F6CCA947BB77B0FF2B300F14405BE905AB750D3BD9D42EB59

Function 0048A490 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(30B73C3E), ref: 0048A4E4
FreeEnvironmentStringsW.KERNEL32(?), ref: 0048A685
RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Strings

0Q8w, xrefs: 0048A6D9, 0048A6E4

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID: 0Q8w
API String ID: 2488768755-1710177118
Opcode ID: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction ID: 1a99e4392def1b605416f46e3147960cb17592dd8275db88d5f878599104deaf
Opcode Fuzzy Hash: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction Fuzzy Hash: 6471AAB1C10219EBDB00DF98C884B9EFBF8FF18304F14461BE815A3250E7B8A995CB95

Function 004B82A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,30B73C3E,?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3), ref: 004B82C9
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004B82D5
GetTempPathW.KERNEL32(?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3,?,00000105,?), ref: 004B82F5

Strings

GetTempPath2W, xrefs: 004B82CF
kernel32.dll, xrefs: 004B82C4

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AddressHandleModulePathProcTemp
String ID: GetTempPath2W$kernel32.dll
API String ID: 775647363-1846531799
Opcode ID: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction ID: 490c9918516094a75be01d3e1b1e27de5ce3fa518d230e70400d3a931493a6c9
Opcode Fuzzy Hash: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction Fuzzy Hash: C2F03A36A44654EFCB159F54EC05F9A7BA8FB09B60F008127EC16937A0DB79A800CB98

Function 004B9258 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B925F
std::_Lockit::_Lockit.LIBCPMT ref: 004B926A
std::_Lockit::~_Lockit.LIBCPMT ref: 004B92D8

Part of subcall function 004B93BB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004B93D3

std::locale::_Setgloballocale.LIBCPMT ref: 004B9285
_Yarn.LIBCPMT ref: 004B929B

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction ID: d57bef6452a6d9f87b7c1f6c81a415e25ff1084f0ba862d3ffc406506ccaed08
Opcode Fuzzy Hash: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction Fuzzy Hash: 2101BC75A002149BDB09EF21E881ABE3BA5BF95714B18400EE90157381CF78AE42DBE9

Function 0047F2C0 Relevance: 6.5, APIs: 4, Instructions: 457registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0051C570,00000000,00020019,00000000,?,?,?,30B73C3E,?,0051C2A0), ref: 0047F4D0
RegQueryValueExA.ADVAPI32(00000000,0051C2A0,00000000,000F003F,?,00000400,?,?,?,30B73C3E,?,0051C2A0), ref: 0047F506
RegCloseKey.ADVAPI32(00000000,?,?,?,30B73C3E,?,0051C2A0), ref: 0047F5A4
SysFreeString.OLEAUT32 ref: 0047FA14

Part of subcall function 0047A610: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
Part of subcall function 0047A610: LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,30B73C3E,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FreeOpenQueryValue$CloseCryptDataLocalStringUnprotect
String ID:
API String ID: 2380017125-0
Opcode ID: 24e19619ec6861878dd46b4612fd45863707030a07a4499d5f6f29efbc7ef892
Instruction ID: 56cbdaf4eb2024de0fd4bd59dbcd72090a4e5b75bdf23aa4f75e7a392944198d
Opcode Fuzzy Hash: 24e19619ec6861878dd46b4612fd45863707030a07a4499d5f6f29efbc7ef892
Instruction Fuzzy Hash: 24122BF0E002689BDB24DF24CC5479DB7B5AF44318F1086EAD64DA7282DB346E88CF59

Function 0049B476 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(30B73C3E,00000000,00000000,00000000), ref: 0049B4D9

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0049B72B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0049B771
GetLastError.KERNEL32 ref: 0049B814

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction ID: 17746d06032e39ca1db24970b21defb679d9c3d722e4804f7fdb3bafa319cb4d
Opcode Fuzzy Hash: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction Fuzzy Hash: 15D17A75D002489FCF05CFE9E980AEDBBB5EF49314F18816AE425EB351D734A906CB94

Function 00478300 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00477B00: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,30B73C3E,?,?), ref: 00477B54
Part of subcall function 00477B00: Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Part of subcall function 00477B00: CloseHandle.KERNEL32(00000000), ref: 00477E84

ImpersonateLoggedOnUser.ADVAPI32(00000000,30B73C3E,?,00000000), ref: 00478391

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleImpersonateLoggedProcess32SnapshotToolhelp32User
String ID:
API String ID: 1507787261-0
Opcode ID: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction ID: e502c6a69380433c55fd31efa36561dbf437e01bd72b95285a5588c942f2c0dc
Opcode Fuzzy Hash: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction Fuzzy Hash: F5F17070C0428DDEEB15DBA4C8587DDBBB0AF15308F24819ED04977292DB785F88DBA6

Function 004A077A Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction ID: 6bad779769d7c9384c33fcc5b288381071ef860472916b423066c301ca7f7ee1
Opcode Fuzzy Hash: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction Fuzzy Hash: D141E675A00704AFDB24AF39CC41B6BBBA9EB99714F20452FF101DB781D77DA9418B88

Function 004AB379 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004AB381

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3B9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3D9

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 0a2ae24b67922771a560a7bfaf211a935735e21397bf4215f271d900e53f356c
Instruction ID: 352b9fd8ff6adfd48aa864b65f723ba5a946c2f7c3dd1541d1c3166fed4ac287
Opcode Fuzzy Hash: 0a2ae24b67922771a560a7bfaf211a935735e21397bf4215f271d900e53f356c
Instruction Fuzzy Hash: B21156B19015157E7A1167B65C8AD6F6A5CDE5A398B10403BF801D1203EB7D9D0245BA

Function 004B8430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000400,30B73C3E,00000000,00000000,00000000,00000000,00000000,00000001,?,?,0044E5F3,?,?,00000000,00000000), ref: 004B844D
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,30B73C3E,00000001), ref: 004B8459
WideCharToMultiByte.KERNEL32(00000001,00000000,30B73C3E,00000000,00000000,00000000,00000000,00000000,?,?,0044E5F3,?,?,00000000,00000000,00000000), ref: 004B847F
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,30B73C3E,00000001), ref: 004B848B

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction ID: 6b90caf3a67b14ffb57c64759c70b961d31bb881305e702148557666a2de5e43
Opcode Fuzzy Hash: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction Fuzzy Hash: FB01BF36601156BFCF224F95DC08E9F3F7AEBD9791F118029FA0556220DA31C922EBA5

Function 004A95E5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000), ref: 004A95FC
GetLastError.KERNEL32(?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000,?,0049BE42,?), ref: 004A9608

Part of subcall function 004A95CE: CloseHandle.KERNEL32(FFFFFFFE,004A9618,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000), ref: 004A95DE

___initconout.LIBCMT ref: 004A9618

Part of subcall function 004A9590: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004A95BF,004A6707,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A95A3

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A962D

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction ID: 8abc0c58445a332f8c6052495b9482a66327941653e6e46fd38a52645a0d97bb
Opcode Fuzzy Hash: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction Fuzzy Hash: DCF01237441215BBCF521F91DC09ACE3F66EF19364F024426FA2C86120C6368D60DB94

Function 004B01F1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004B0216

Strings

MOC, xrefs: 004B0228
RCC, xrefs: 004B0230

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction ID: 70788f387beb527cb8114cdc5e5f216b8ccff70d73c61da87df7ae4bd57bd2ae
Opcode Fuzzy Hash: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction Fuzzy Hash: EE415871900209AFCF16CF98CD85AEEBBB5FF48305F18809AFA0567211D3399950DB68

Function 0048A6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Strings

0Q8w, xrefs: 0048A6D9, 0048A6E4

Memory Dump Source

Source File: 00000003.00000002.2343894867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: 0Q8w
API String ID: 4228678080-1710177118
Opcode ID: 7daf87f8c1ea5e59ace241312ec7f61dd946e809b9173c130261c4fe55fa0827
Instruction ID: 9965e4e76de23dc0ee0a0bab637c9cbc157b952fc1d2a329a02330ce3ace71f2
Opcode Fuzzy Hash: 7daf87f8c1ea5e59ace241312ec7f61dd946e809b9173c130261c4fe55fa0827
Instruction Fuzzy Hash: 7CF03036140649DFC701CF99E888D96B7ECBB6C3107548453E945C7620C232F8A9CB61

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gem1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gem1.exe_daf150691981ac57c1cc14cff3d12fbabf996950_5a516dd6_d70f4b9c-129d-44b9-9413-bdafdbcd51f5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1143.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4E.tmp.WERInternalMetadata.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
gem1.exe

Function 029D8089 Relevance: 40.5, APIs: 10, Strings: 13, Instructions: 294
threadinjectionmemoryCOMMON

Function 029D8206 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82
threadinjectionmemoryCOMMON

Function 00E94312 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
memoryCOMMON

Function 00E906D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
memoryCOMMON

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre