Edit tour

Windows Analysis Report
ResPrompt.dll.dll

Overview

General Information

Sample name:	ResPrompt.dll.dll (renamed file extension from exe to dll)
Original sample name:	ResPrompt.dll.exe
Analysis ID:	1528530
MD5:	e1bdfa7bc2ec8370102e69de1fdc2800
SHA1:	1b26bcec613ee069c0905055b40f0e858143562d
SHA256:	15c4c03c0e4345a3fcc08e55164ed5cf004d8c2c40a46d7f7db891f312226497
Tags:	exegibbooc2comremcosuser-PeterGabaldon
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Abnormal high CPU Usage

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 3196 cmdline: loaddll64.exe "C:\Users\user\Desktop\ResPrompt.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 3088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5764 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 4616 cmdline: rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 5724 cmdline: regsvr32.exe /s C:\Users\user\Desktop\ResPrompt.dll.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

rundll32.exe (PID: 3544 cmdline: rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllRegisterServer MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5028 cmdline: rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllUnregisterServer MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: ResPrompt.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34A3250 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	0_2_00007FFDA34A3250
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34A3530 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	0_2_00007FFDA34A3530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34DBC74 FindFirstFileExW,	0_2_00007FFDA34DBC74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34A3250 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	3_2_00007FFDA34A3250
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34A3530 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	3_2_00007FFDA34A3530
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34DBC74 FindFirstFileExW,	3_2_00007FFDA34DBC74

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34A3830 std::_Fac_node::_Fac_node,std::_Fac_node::_Fac_node,std::_Fac_node::_Fac_node,GetLogicalDriveStringsA,GetDriveTypeA,

0_2_00007FFDA34A3830

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 154.21.14.89 22455

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.6:53479 -> 154.21.14.89:22455

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: gibbooc2.com

Source: C:\Windows\System32\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34E03E8	0_2_00007FFDA34E03E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34D0310	0_2_00007FFDA34D0310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34CA0E0	0_2_00007FFDA34CA0E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34CA840	0_2_00007FFDA34CA840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34E2500	0_2_00007FFDA34E2500
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34CABD8	0_2_00007FFDA34CABD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34DE8F8	0_2_00007FFDA34DE8F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34D4FE4	0_2_00007FFDA34D4FE4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34D2DD8	0_2_00007FFDA34D2DD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34DACC4	0_2_00007FFDA34DACC4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34CB26C	0_2_00007FFDA34CB26C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34CB6A4	0_2_00007FFDA34CB6A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34B16D0	0_2_00007FFDA34B16D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34CF694	0_2_00007FFDA34CF694
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34DD680	0_2_00007FFDA34DD680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34D5478	0_2_00007FFDA34D5478
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34D5AF8	0_2_00007FFDA34D5AF8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34D9B1C	0_2_00007FFDA34D9B1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34CFA40	0_2_00007FFDA34CFA40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34D1958	0_2_00007FFDA34D1958
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34C9EDC	0_2_00007FFDA34C9EDC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34E1E64	0_2_00007FFDA34E1E64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34C9CD8	0_2_00007FFDA34C9CD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34DBC74	0_2_00007FFDA34DBC74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34E03E8	3_2_00007FFDA34E03E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34D0310	3_2_00007FFDA34D0310
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34CA0E0	3_2_00007FFDA34CA0E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34CA840	3_2_00007FFDA34CA840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34E2500	3_2_00007FFDA34E2500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34CABD8	3_2_00007FFDA34CABD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34DE8F8	3_2_00007FFDA34DE8F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34D4FE4	3_2_00007FFDA34D4FE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34D2DD8	3_2_00007FFDA34D2DD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34DACC4	3_2_00007FFDA34DACC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34CB26C	3_2_00007FFDA34CB26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34CB6A4	3_2_00007FFDA34CB6A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34B16D0	3_2_00007FFDA34B16D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34CF694	3_2_00007FFDA34CF694
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34DD680	3_2_00007FFDA34DD680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34D5478	3_2_00007FFDA34D5478
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34D5AF8	3_2_00007FFDA34D5AF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34D9B1C	3_2_00007FFDA34D9B1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34CFA40	3_2_00007FFDA34CFA40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34D1958	3_2_00007FFDA34D1958
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34C9EDC	3_2_00007FFDA34C9EDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34E1E64	3_2_00007FFDA34E1E64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34C9CD8	3_2_00007FFDA34C9CD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34DBC74	3_2_00007FFDA34DBC74

Source: ResPrompt.dll.dll

Binary or memory string: OriginalFilenameResourceCommander.exeD vs ResPrompt.dll.dll

Source: classification engine

Classification label: mal52.evad.winDLL@12/0@1/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3088:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{E27727EB-367C-4A9D-96C6-6520160ADF9B}

Source: ResPrompt.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\ResPrompt.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\ResPrompt.dll.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllUnregisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\ResPrompt.dll.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllUnregisterServer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: ResPrompt.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: ResPrompt.dll.dll

Static file information: File size 32843280 > 1048576

Source: ResPrompt.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ResPrompt.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ResPrompt.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ResPrompt.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ResPrompt.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ResPrompt.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ResPrompt.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: ResPrompt.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: ResPrompt.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ResPrompt.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ResPrompt.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ResPrompt.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ResPrompt.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34883E0 LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_00007FFDA34883E0

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\ResPrompt.dll.dll

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Window / User API: foregroundWindowGot 781

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	API coverage: 3.5 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 0.9 %

Source: C:\Windows\System32\rundll32.exe TID: 5376	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5376	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5376	Thread sleep time: -32594s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5376	Thread sleep time: -33180s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5376	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4836	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4836	Thread sleep time: -56000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1404	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1404	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3792	Thread sleep time: -33162s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3792	Thread sleep time: -39118s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3792	Thread sleep time: -35734s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3792	Thread sleep time: -36324s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3604	Thread sleep time: -35282s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3604	Thread sleep time: -32856s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6556	Thread sleep time: -35818s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6556	Thread sleep time: -33848s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6556	Thread sleep time: -52065s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3172	Thread sleep time: -34508s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3172	Thread sleep time: -37452s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3172	Thread sleep time: -36074s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 2760	Thread sleep time: -51774s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5052	Thread sleep time: -39106s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5052	Thread sleep time: -31798s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1088	Thread sleep time: -31664s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1088	Thread sleep time: -35220s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3704	Thread sleep time: -35244s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3704	Thread sleep time: -38360s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3704	Thread sleep time: -34264s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4920	Thread sleep time: -37884s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4920	Thread sleep time: -30772s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 760	Thread sleep time: -36104s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 760	Thread sleep time: -36758s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6312	Thread sleep time: -39580s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 2524	Thread sleep time: -30580s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5696	Thread sleep time: -36152s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5696	Thread sleep time: -33706s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3460	Thread sleep time: -39294s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3460	Thread sleep time: -31620s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3460	Thread sleep time: -31066s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5176	Thread sleep time: -38800s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5984	Thread sleep time: -32866s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5984	Thread sleep time: -32840s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5984	Thread sleep time: -35786s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5984	Thread sleep time: -36756s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 2760	Thread sleep time: -30440s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 2760	Thread sleep time: -33066s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6636	Thread sleep time: -35226s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3000	Thread sleep time: -31784s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3000	Thread sleep time: -38608s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3000	Thread sleep time: -32382s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3000	Thread sleep time: -33722s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3000	Thread sleep time: -37340s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6888	Thread sleep time: -30710s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1944	Thread sleep time: -38044s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1944	Thread sleep time: -39782s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4932	Thread sleep time: -30410s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4364	Thread sleep time: -39948s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4364	Thread sleep time: -38928s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6076	Thread sleep time: -33560s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6076	Thread sleep time: -37360s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6076	Thread sleep time: -38778s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6076	Thread sleep time: -38914s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5028	Thread sleep time: -34048s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5028	Thread sleep time: -34830s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3200	Thread sleep time: -35942s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4188	Thread sleep time: -30908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3916	Thread sleep time: -39524s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6720	Thread sleep time: -31624s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5768	Thread sleep time: -32692s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5044	Thread sleep time: -36956s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4952	Thread sleep time: -35140s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5040	Thread sleep time: -31034s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3504	Thread sleep time: -30466s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3924	Thread sleep time: -35694s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34A3250 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	0_2_00007FFDA34A3250
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34A3530 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	0_2_00007FFDA34A3530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34DBC74 FindFirstFileExW,	0_2_00007FFDA34DBC74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34A3250 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	3_2_00007FFDA34A3250
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34A3530 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileW,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,FindNextFileW,FindClose,	3_2_00007FFDA34A3530
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34DBC74 FindFirstFileExW,	3_2_00007FFDA34DBC74

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34A3830 std::_Fac_node::_Fac_node,std::_Fac_node::_Fac_node,std::_Fac_node::_Fac_node,GetLogicalDriveStringsA,GetDriveTypeA,

0_2_00007FFDA34A3830

Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34C40A0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FFDA34C40A0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34883E0 LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_00007FFDA34883E0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34DD000 GetProcessHeap,

0_2_00007FFDA34DD000

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34C4354 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FFDA34C4354
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34C40A0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FFDA34C40A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDA34C9238 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FFDA34C9238
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34C4354 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFDA34C4354
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34C40A0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFDA34C40A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFDA34C9238 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFDA34C9238

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 154.21.14.89 22455

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1

Jump to behavior

Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Ping>>//>>Program Manager>>//>>F3723}
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Ping>>//>>Program Manager>>//>>
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ClientInfo>>//>>992547/user<-->Windows 10 Pro=19045<-->C:\Windows\system32\rundll32.exe<-->Microsoft Defender Antivirus-<-->1709044087<-->A<-->7/9/2022 23:6 p.m.<-->Program Manager<-->
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 992547/user<-->Windows 10 Pro=19045<-->C:\Windows\system32\rundll32.exe<-->Microsoft Defender Antivirus-<-->1709044087<-->A<-->7/9/2022 23:6 p.m.<-->Program Manager<-->
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerF3723}
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Ping>>//>>Program Manager>>//>>7F3723}
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ClientInfo>>//>>992547/user<-->Windows 10 Pro=19045<-->C:\Windows\system32\rundll32.exe<-->Microsoft Defender Antivirus-<-->1709044087<-->A<-->7/9/2022 23:6 p.m.<-->Program Manager<-->\|G\
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ClientInfo>>//>>992547/user<-->Windows 10 Pro=19045<-->C:\Windows\system32\rundll32.exe<-->Microsoft Defender Antivirus-<-->1709044087<-->A<-->7/9/2022 23:6 p.m.<-->Program Manager<-->iGO
Source: rundll32.exe, 00000004.00000002.4588163768.000002375B338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 992547/user<-->Windows 10 Pro=19045<-->C:\Windows\system32\rundll32.exe<-->Microsoft Defender Antivirus-<-->1709044087<-->A<-->7/9/2022 23:6 p.m.<-->Program Manager<-->: 0<-->

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34E4F90 cpuid

0_2_00007FFDA34E4F90

Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00007FFDA34D40D8
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,	0_2_00007FFDA34D44C4
Source: C:\Windows\System32\loaddll64.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FFDA34DEE88
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00007FFDA34DF2B4
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FFDA34DF34C
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00007FFDA34DF1E4
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,	0_2_00007FFDA34DF79C
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FFDA34DF6EC
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,	0_2_00007FFDA34DF594
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FFDA34DF8D0
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	3_2_00007FFDA34D40D8
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	3_2_00007FFDA34D44C4
Source: C:\Windows\System32\regsvr32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_00007FFDA34DEE88
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	3_2_00007FFDA34DF2B4
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00007FFDA34DF34C
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	3_2_00007FFDA34DF1E4
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	3_2_00007FFDA34DF79C
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00007FFDA34DF6EC
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	3_2_00007FFDA34DF594
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00007FFDA34DF8D0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDA34C41E8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FFDA34C41E8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	112 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	112 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Regsvr32	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ResPrompt.dll.dll	8%	ReversingLabs	Win64.Trojan.SpywareX

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gibbooc2.com	154.21.14.89	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.21.14.89	gibbooc2.com	United States		174	COGENT-174US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528530
Start date and time:	2024-10-08 00:46:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ResPrompt.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	ResPrompt.dll.exe
Detection:	MAL
Classification:	mal52.evad.winDLL@12/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 251
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: ResPrompt.dll.dll

Simulations

Behavior and APIs

Time	Type	Description
18:47:08	API Interceptor	904x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.21.14.89	Player reports algnet 07-10-2024 .pdf www.skype.com.exe	Get hash	malicious	Unknown	Browse
	Player reports algnet 07-10-2024 .pdf www.skype.com.7z	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.tjawiq.27210.15987.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gibbooc2.com	Player reports algnet 07-10-2024 .pdf www.skype.com.exe	Get hash	malicious	Unknown	Browse	154.21.14.89
	Player reports algnet 07-10-2024 .pdf www.skype.com.7z	Get hash	malicious	Unknown	Browse	154.21.14.89
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.tjawiq.27210.15987.exe	Get hash	malicious	Unknown	Browse	154.21.14.89
	hi.zip.exe	Get hash	malicious	Unknown	Browse	172.111.186.180
	hi.zip.exe	Get hash	malicious	Unknown	Browse	172.111.186.180
	Screenshoot Error Feed Today 24-05 Skype.com	Get hash	malicious	Unknown	Browse	172.111.186.180
	Screenshoot Error Feed Today 24-05 Skype.com	Get hash	malicious	Unknown	Browse	172.111.186.180

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	Player reports algnet 07-10-2024 .pdf www.skype.com.exe	Get hash	malicious	Unknown	Browse	154.21.14.89
	cenSXPimaG.elf	Get hash	malicious	Mirai, Okiru	Browse	38.9.223.35
	2UngC9fiGa.elf	Get hash	malicious	Mirai, Okiru	Browse	38.9.223.19
	970Qh1XiFt.elf	Get hash	malicious	Mirai, Okiru	Browse	38.208.16.112
	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	143.244.33.74
	Player reports algnet 07-10-2024 .pdf www.skype.com.7z	Get hash	malicious	Unknown	Browse	154.21.14.89
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	154.23.184.60
	rInvoiceCM60916_xlx.exe	Get hash	malicious	FormBook	Browse	38.55.251.233
	NEW INVOICE.exe	Get hash	malicious	FormBook	Browse	206.238.91.127
	invoice_45009.xls	Get hash	malicious	Remcos	Browse	38.240.44.9

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9672098266294284
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	ResPrompt.dll.dll
File size:	32'843'280 bytes
MD5:	e1bdfa7bc2ec8370102e69de1fdc2800
SHA1:	1b26bcec613ee069c0905055b40f0e858143562d
SHA256:	15c4c03c0e4345a3fcc08e55164ed5cf004d8c2c40a46d7f7db891f312226497
SHA512:	333f62fb4abba81f09a5d12afaafd8ed716ca03e7ef251c49b4dcf75eea7d6adf790c1fa9eed346ac8d22831904b8729dc771f9d66ce94c8f23f23bd0643a6e8
SSDEEP:	49152:r+NwYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYVYT:Cm
TLSH:	DA77123EFAD9E686CB37813ED0B01293529410F57D12AADE18C0B68689F4D674E7E371
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L...O...L...I...L...H...L...K...L..cH...L..cO...L..cI...L...M...L...M.}.L..bI...L..bL...L..b....L.......L..bN...L

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180043c24
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6702AD9C [Sun Oct 6 15:32:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7149bac1e870d1b31b80f84558b9a0fe

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FC390B604D7h
call 00007FC390B60A78h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FC390B60370h
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FC390B604E2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FC390B604E5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FC390B604DDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FC390B604E6h
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x875d0	0x6c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8763c	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x97000	0x4b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x8e000	0x8be0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x98000	0xce4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7bd30	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x7bf00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7bbf0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6e000	0x560	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6cf78	0x6d000	b10c83dbf498717845a242058d9ff200	False	0.41129855934633025	data	6.009497717786238	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6e000	0x1a8d4	0x1aa00	42c9f6c4392d286da9e89b93e32296a0	False	0.4043885710093897	data	5.04939780158208	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x89000	0x4984	0x2e00	0b9ef87aa964ebe71e74fcf925cdfe8a	False	0.16329823369565216	data	4.178042406936022	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x8e000	0x8be0	0x8c00	581e4a5effd480ab46c4c3dc5ff8e248	False	0.4501395089285714	data	5.799701347388758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x97000	0x4b0	0x600	0c9a5c2aa6bc49c2745a4d626eb64702	False	0.3515625	data	3.0268938776808603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x98000	0xce4	0xe00	de6c1f46af49d78684e7ae073ec36fef	False	0.4634486607142857	data	5.2915373741432665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x970a0	0x378	data	English	United States	0.4155405405405405
RT_MANIFEST	0x97418	0x91	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.8689655172413793

Imports

DLL	Import
KERNEL32.dll	FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeA, GetFileSize, GetFullPathNameA, ReadFile, CloseHandle, CreateProcessW, GetLogicalDriveStringsA, MultiByteToWideChar, WideCharToMultiByte, GetFileTime, CreateFileA, GetComputerNameW, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, lstrlenA, lstrlenW, SetEndOfFile, WriteConsoleW, HeapSize, CreateFileW, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, lstrcmpA, MoveFileW, RemoveDirectoryW, DeleteFileW, CreateDirectoryW, LoadLibraryA, FreeLibrary, GetProcAddress, OpenProcess, TerminateProcess, GetCurrentProcessId, CreateMutexW, GetModuleFileNameA, GetLastError, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, HeapReAlloc, ReadConsoleW, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleOutputCP, WriteFile, FlushFileBuffers, GetFileType, GetStdHandle, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, QueryPerformanceCounter, QueryPerformanceFrequency, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, SleepConditionVariableSRW, Sleep, GetCurrentThreadId, RtlPcToFileHeader, RaiseException, InitOnceBeginInitialize, InitOnceComplete, WakeAllConditionVariable, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, WaitForSingleObjectEx, GetExitCodeThread, InitializeCriticalSectionEx, GetSystemTimeAsFileTime, GetModuleHandleW, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetStringTypeW, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, InitializeSListHead, GetCurrentProcess, RtlUnwindEx, InterlockedFlushSList, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, CreateThread, ExitThread, FreeLibraryAndExitThread, ExitProcess, GetModuleFileNameW, HeapAlloc, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, RtlUnwind
USER32.dll	GetMonitorInfoW, ReleaseDC, GetForegroundWindow, MessageBoxA, DestroyIcon, EnumDisplayMonitors, GetWindowTextW
GDI32.dll	DeleteObject, DeleteDC, CreateDCW, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, SelectObject
ADVAPI32.dll	RegOpenKeyExA, RegOpenKeyA, RegEnumKeyExA, RegCloseKey, RegQueryValueExA
SHELL32.dll	SHGetFileInfoW, SHGetSpecialFolderPathW
ole32.dll	CLSIDFromString, CreateStreamOnHGlobal
gdiplus.dll	GdiplusShutdown, GdipDisposeImage, GdipFree, GdipAlloc, GdipSaveImageToStream, GdipGetImageGraphicsContext, GdipGetImageWidth, GdipGetImageHeight, GdipCreateBitmapFromFile, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromScan0, GdipCloneImage, GdipCreateBitmapFromHBITMAP, GdipCreateBitmapFromHICON, GdipDeleteGraphics, GdipDrawImageRectI, GdiplusStartup

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180005be0
DllUnregisterServer	2	0x180005c00

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:47:10.107829094 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.115717888 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.115796089 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.117966890 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.126327038 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.126378059 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.132348061 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.240071058 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.249757051 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.249833107 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.259021044 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.349590063 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.355050087 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.355118036 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.361038923 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.498677969 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.503880024 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.503941059 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.509232998 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.615473986 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.621032953 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.622046947 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.627844095 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.726131916 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.731487989 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.731554985 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.737027884 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.833878040 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.839091063 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.842032909 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.847462893 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.943470001 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.948585033 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:10.950040102 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:10.955328941 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.060740948 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.071091890 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.071211100 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.077066898 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.177505016 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.183077097 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.186026096 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.191483021 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.286983013 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.291963100 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.293049097 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.317090988 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.396509886 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.401505947 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.401570082 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.406433105 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.506171942 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.511110067 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.515036106 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.519938946 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.616254091 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.621396065 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.622031927 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.627012968 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.724613905 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.729607105 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.731015921 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:11.735876083 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.842348099 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:11.842438936 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.163208961 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.169754028 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.169837952 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.170572996 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.170960903 CEST	53479	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.177027941 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.177089930 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.178188086 CEST	22455	53479	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.184452057 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.287282944 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.293850899 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.293966055 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.300753117 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.411983967 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.418426037 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.418478966 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.425096035 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.537070990 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.543987989 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.544070005 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.550431967 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.661988020 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.668535948 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.668762922 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.675234079 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.787070036 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.793673992 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.793816090 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.800292015 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.896478891 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.903361082 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:15.903451920 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:15.909975052 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.008722067 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.014827967 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.014883041 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.021492958 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.130731106 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.135879993 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.135927916 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.140738010 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.241705894 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.246649027 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.246716022 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.252051115 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.368642092 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.373718977 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.373836994 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.378807068 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.477912903 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.482877016 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.482949018 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.487946033 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.591701031 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.597853899 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.597908974 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.604948997 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.696511030 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.703005075 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.703079939 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.709846973 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.818299055 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.825546980 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.833863020 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.841074944 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.928704023 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.935632944 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.935693979 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:16.941843987 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.983002901 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:16.983084917 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.194303036 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.199636936 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.199692011 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.200457096 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.200798035 CEST	53501	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.206561089 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.206597090 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.206804037 CEST	22455	53501	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.214005947 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.318387985 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.327063084 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.327244043 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.335042953 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.427891970 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.435127974 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.435195923 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.440082073 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.537084103 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.542357922 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.542500973 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.547478914 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.646401882 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.655064106 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.655112982 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.662422895 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.755845070 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.762593985 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.762660027 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.769788027 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.865149975 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.872209072 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.872262955 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.879769087 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.975380898 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.983592033 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:19.987060070 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:19.994277954 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.099894047 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.107105970 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.107166052 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.114615917 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.224487066 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.231251001 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.231302977 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.237972975 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.349699974 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.354767084 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.354814053 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.359616995 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.459166050 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.464143991 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.467097044 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.471963882 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.716960907 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.723419905 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:20.723464966 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:20.730330944 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:21.049563885 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:21.129028082 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:21.129085064 CEST	53529	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:21.129930019 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:21.135468006 CEST	22455	53529	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.225373030 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.231751919 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.232506037 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.232506037 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.238955021 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.239100933 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.245554924 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.351069927 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.357805014 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.359435081 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.365942955 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.477075100 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.484021902 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.484534025 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.491209984 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.583913088 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.590722084 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.591025114 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.597606897 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.708906889 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.715491056 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.715591908 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.722299099 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.820348024 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.826831102 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.833944082 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.840224981 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.971107006 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.975953102 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:23.976011038 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:23.980772018 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.083956003 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.088825941 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.088906050 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.093692064 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.225544930 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.230509043 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.230566978 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.235553026 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.335268974 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.626679897 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.626739025 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.631700039 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.717160940 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.722407103 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.722460985 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.727255106 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.838443041 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.843343973 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.843416929 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.848189116 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.943888903 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.949023008 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.949876070 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:24.955106020 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.973993063 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:24.974680901 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.256645918 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.261579037 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.261727095 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.262593031 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.263106108 CEST	53557	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.267508030 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.267585993 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.267946005 CEST	22455	53557	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.272536993 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.384804964 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.389801979 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.389888048 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.394706011 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.506066084 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.511008024 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.511101007 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.515986919 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.630830050 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.635699987 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.635762930 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.640558004 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.745439053 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.751847982 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.751985073 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:27.758392096 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:27.865221977 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.177508116 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.217551947 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.217590094 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.224673986 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.229614973 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.229661942 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.234558105 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.349518061 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.354587078 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.354659081 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.359555006 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.459285021 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.631952047 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.632015944 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.638437033 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.709093094 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.715019941 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.715110064 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.721043110 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.818387985 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.824692011 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.824788094 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.830689907 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.951960087 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.958131075 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:28.958188057 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:28.964301109 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:29.003422976 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:29.003525019 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.287848949 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.294111967 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.294209957 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.294852018 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.295375109 CEST	53585	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.301413059 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.301485062 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.302134037 CEST	22455	53585	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.307743073 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.412305117 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.419354916 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.419455051 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.426484108 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.532335043 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.540395975 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.540499926 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.546492100 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.646709919 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.655167103 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.655246019 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.662914991 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.755871058 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.764475107 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.764545918 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.770977020 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.869050980 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.875499010 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.875602007 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.882680893 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.974886894 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.979788065 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:31.979840994 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:31.984750986 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.099647999 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.104672909 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.104732037 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.109597921 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.221616983 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.226558924 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.226602077 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.231486082 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.334098101 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.581125975 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.581207991 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.587580919 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.677944899 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.684922934 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.684979916 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.691096067 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.787247896 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.793659925 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.793766022 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.800379038 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.910204887 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.915112972 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:32.915195942 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:32.920203924 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:33.037130117 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:33.042238951 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:33.042331934 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:33.047204971 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:33.051604033 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:33.051695108 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.319156885 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.325417995 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.325561047 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.326472044 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.331768036 CEST	53611	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.333101988 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.333178043 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.338140965 CEST	22455	53611	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.339895964 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.450325966 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.456799030 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.456881046 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.463063002 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.552936077 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.559490919 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.559586048 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.566257954 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.662508965 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.669511080 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.669609070 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.676752090 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.771554947 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.779004097 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.779094934 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.785780907 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.896513939 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.903829098 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:35.903932095 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:35.911204100 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.007261992 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.014368057 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.014410019 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.022382021 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.116636038 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.123812914 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.123899937 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.131190062 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.240829945 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.248194933 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.248245955 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.255785942 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.366404057 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.373444080 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.373503923 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.381232977 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.476227045 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.490195036 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.490242004 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.499191999 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:36.584012985 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:36.896363974 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:37.172384024 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:37.172458887 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:37.172518969 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:37.172549009 CEST	53638	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:37.182184935 CEST	22455	53638	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.350542068 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.359832048 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.359896898 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.360753059 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.368297100 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.368339062 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.375154018 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.474788904 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.481740952 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.481781960 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.488770962 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.620640993 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.627393007 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.627435923 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.633748055 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.748960018 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.756398916 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.756441116 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.764579058 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.865200043 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.871447086 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.871525049 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.878680944 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.974725962 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.981858969 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:39.987174034 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:39.995215893 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.115484953 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.122266054 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.125212908 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.133384943 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.225732088 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.443212986 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.482197046 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.482209921 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.482278109 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.489799976 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.568691015 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.575058937 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.575208902 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.582340956 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.677839041 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.685213089 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.686213017 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.693703890 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.815728903 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.822566986 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.823118925 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.829864979 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.927769899 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.934735060 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:40.937330008 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:40.944330931 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:41.053262949 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:41.060061932 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:41.060143948 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:41.067404985 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:41.097560883 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:41.097647905 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.381942987 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.388777971 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.388868093 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.389697075 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.390271902 CEST	53663	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.396778107 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.396883965 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.397855043 CEST	22455	53663	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.403784037 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.506165981 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.513076067 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.513183117 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.520416975 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.630987883 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.638509035 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.638632059 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.645792961 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.756510973 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.763915062 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.764005899 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.771351099 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.868439913 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.875983953 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.876100063 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.883785009 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.990535021 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:43.998399019 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:43.998528957 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.005628109 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.099658966 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.106556892 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.106658936 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.113809109 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.227426052 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.232381105 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.232522011 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.237441063 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.350471020 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.359236002 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.359285116 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.364145994 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.459086895 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.465929031 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.466027021 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.472819090 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.571764946 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.578260899 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.578486919 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.583436966 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.677989006 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.683861971 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.683975935 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.688999891 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.787200928 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.792329073 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.792423010 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.797384024 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.942804098 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.947634935 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:44.947683096 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:44.952495098 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:45.068533897 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:45.073508978 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:45.073584080 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:45.078557968 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:45.124706984 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:45.125819921 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.413049936 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.420131922 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.420217991 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.421049118 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.421428919 CEST	53688	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.428416967 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.428478956 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.428484917 CEST	22455	53688	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.435072899 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.537240982 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.543899059 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.544117928 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.550972939 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.649525881 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.656553984 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.656663895 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.664118052 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.757180929 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.765170097 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.765295982 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.772468090 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.867532015 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.872567892 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:47.872627020 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:47.877947092 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.019927979 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.026777029 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.026884079 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.031883955 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.259704113 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.568224907 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.587692976 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.587760925 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.587810040 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.598275900 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.696660042 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.704699039 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.704840899 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.713145971 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.818653107 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.828366041 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.828497887 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.834907055 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.927829027 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.935672998 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:48.935767889 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:48.942223072 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:49.058409929 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:49.065231085 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:49.065342903 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:49.072294950 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:49.160496950 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:49.160732985 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.444636106 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.450017929 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.450140953 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.450896978 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.451487064 CEST	53718	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.455866098 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.455977917 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.456316948 CEST	22455	53718	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.461636066 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.570125103 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.575705051 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.575781107 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.581271887 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.693547010 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.698548079 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.698745012 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.703758001 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.805819035 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.811057091 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.811170101 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.817080975 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.912357092 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.917383909 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:51.917493105 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:51.922383070 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.021557093 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.028310061 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.028441906 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.034888029 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.131103039 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.137629032 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.137697935 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.144257069 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.240442991 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.247205019 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.247308969 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.252578974 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.365607023 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.370517969 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.370579004 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.375472069 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.474822998 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.772531033 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.772602081 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.779402971 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.837265968 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.843849897 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.843967915 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.850595951 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.943713903 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.948559999 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:52.948671103 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:52.953542948 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:53.068548918 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:53.073693991 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:53.073766947 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:53.078742027 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:53.174763918 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:53.174936056 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.475661993 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.480520964 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:55.480698109 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.481522083 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.482067108 CEST	53741	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.487415075 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:55.487487078 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.487962008 CEST	22455	53741	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:55.493532896 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:55.599879026 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.606555939 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:55.606681108 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:55.613121986 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:55.732966900 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.037018061 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.062210083 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.062226057 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.241715908 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.246606112 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.246687889 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.251455069 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.438563108 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.443439007 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.443506956 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.448354006 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.554512978 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.561235905 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.561285973 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.567687988 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.722342968 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.729016066 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.729124069 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.735527039 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.866501093 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.873712063 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.873817921 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.881885052 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.990562916 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:56.998872995 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:56.999001026 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.005667925 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.103785992 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.112226963 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.112283945 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.119868040 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.209120035 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.217132092 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.217232943 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.225847006 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.318600893 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.325345993 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.325442076 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.332709074 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.443564892 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.451050997 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.451111078 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.458566904 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.553334951 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.561132908 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.561263084 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.568465948 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.662395954 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.670933008 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.670990944 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.678983927 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.771939993 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.780405045 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.780570984 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.789099932 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.881454945 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.890172958 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.890237093 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.898439884 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.990535021 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:57.997956991 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:57.998084068 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.005630016 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.115933895 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.124242067 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.124336958 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.131444931 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.233582973 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.241740942 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.241822958 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.249690056 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.349982977 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.359455109 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.359563112 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.367043018 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.459105015 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.466564894 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.466658115 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.473731041 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.615566969 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.622991085 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.623104095 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.630038023 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.853687048 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.861155033 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:58.861277103 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:58.868643045 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.172199965 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.179450035 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.179502964 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.186542988 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.287350893 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.294822931 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.294931889 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.301610947 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.412760019 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.419605970 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.419661999 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.426896095 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.537285089 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.544661045 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.544761896 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.551580906 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.662292004 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.669323921 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.669418097 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.676595926 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.778233051 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.785598040 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.785648108 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.793399096 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.896975994 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.905463934 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:47:59.905519962 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:47:59.916647911 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.006292105 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.013498068 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.013549089 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.022955894 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.131392956 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.139029026 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.139096975 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.146692038 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.240921021 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.247983932 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.248116016 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.259763002 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.354660988 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.361948967 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.362005949 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.369091034 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.462366104 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.469445944 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.469500065 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.476686954 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.568614960 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.575855017 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.575902939 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.583123922 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.693883896 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.701555967 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.701637030 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.708791971 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.806061029 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.813769102 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.813875914 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.820972919 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.912401915 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.919616938 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:00.919708014 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:00.927134037 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.037265062 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.044744015 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.047327995 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.054495096 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.149746895 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.156639099 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.159328938 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.166098118 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.257349014 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.264266968 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.265326977 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.272140026 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.374407053 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.381616116 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.383306026 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.390710115 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.596170902 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.604127884 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.607251883 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.614439964 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.828248978 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.835217953 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.835309029 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.842411041 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.943510056 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.950759888 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:01.950824022 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:01.958125114 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.069652081 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.076910019 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.077050924 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.083913088 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.180516958 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.187513113 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.187622070 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.194783926 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.303011894 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.310758114 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.310879946 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.318032980 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.434425116 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.442255020 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.442389965 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.449798107 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.559154034 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.567500114 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.567621946 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:02.576041937 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.597148895 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:02.597260952 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.757184029 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.763585091 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:05.763700008 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.764630079 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.765120029 CEST	53762	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.770719051 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:05.770802021 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.772918940 CEST	22455	53762	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:05.777384043 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:05.881120920 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.887634039 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:05.887732983 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:05.894239902 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:05.994237900 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.000444889 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.000613928 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.007033110 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.115911961 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.120827913 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.120908022 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.125725031 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.235977888 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.240926981 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.240993023 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.245812893 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.349982023 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.354902029 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.354998112 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.359741926 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.459361076 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.467365980 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.467518091 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.475305080 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.584254026 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.589246035 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.589391947 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.594229937 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.709022999 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.713994980 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.714057922 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.718923092 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.818692923 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.823949099 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.824104071 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.828999043 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.928056955 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.933361053 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:06.933414936 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:06.938343048 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.053746939 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.059349060 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.059408903 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.064364910 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.163481951 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.170187950 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.170258999 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.178580999 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.295958042 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.302388906 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.302437067 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.309444904 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.397648096 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.402616978 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.402725935 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:07.407735109 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.502437115 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:07.502583027 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.788322926 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.795536041 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:09.795680046 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.796509981 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.796994925 CEST	53765	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.802876949 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:09.802979946 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.803342104 CEST	22455	53765	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:09.810072899 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:09.912503958 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.919101000 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:09.919188976 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:09.925947905 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.021836042 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.028907061 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.029011965 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.035865068 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.147200108 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.154330015 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.154405117 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.161432028 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.261723042 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.266628027 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.266726017 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.271485090 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.372889042 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.377774954 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.377841949 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.382586002 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.474773884 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.479626894 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.479693890 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.484458923 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.606079102 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.611012936 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.611078024 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.615973949 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.724956989 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.729752064 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.729809046 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.734807968 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.849834919 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.855720997 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.855823994 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.861952066 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.959832907 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.967426062 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:10.967489004 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:10.974685907 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.085004091 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.089922905 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.089967012 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.094791889 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.193802118 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.200505018 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.200551033 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.206932068 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.303215981 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.309735060 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.309776068 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.316318989 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.412368059 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.418803930 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.418853998 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:11.423652887 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.520060062 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:11.520131111 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.820168018 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.827635050 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:13.831465006 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.832331896 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.832959890 CEST	53766	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.839538097 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:13.840074062 CEST	22455	53766	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:13.840154886 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.847198963 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:13.960783005 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.967941999 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:13.971373081 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:13.978070021 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.084216118 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.091377974 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.091480017 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.097651958 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.198817968 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.205920935 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.205971956 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.213103056 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.319940090 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.326430082 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.326556921 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.333607912 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.428045988 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.434644938 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.434743881 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.441410065 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.537455082 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.543764114 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.543889046 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.550704956 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.662472963 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.669771910 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.670011044 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.677279949 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.787451982 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.792432070 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.792530060 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.797326088 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.939205885 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.944150925 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:14.944276094 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:14.949153900 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.068540096 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.073487043 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.073568106 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.078396082 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.193592072 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.198437929 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.198543072 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.203284979 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.303039074 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.309669018 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.309778929 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.316183090 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.414736032 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.423963070 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.424022913 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.430504084 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.537353039 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.543844938 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.543929100 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.547452927 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.547516108 CEST	53768	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:15.551090002 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:15.553976059 CEST	22455	53768	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:17.850593090 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:17.857897043 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:17.857969046 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:17.858623981 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:17.865953922 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:17.866017103 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:17.873513937 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:17.974984884 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:17.981878996 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:17.981941938 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:17.988975048 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.084193945 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.090970993 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.091029882 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.098231077 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.209242105 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.216250896 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.216295958 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.226172924 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.334214926 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.341536999 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.341599941 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.348820925 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.444066048 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.450897932 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.450958014 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.457509995 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.568578005 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.575511932 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.575583935 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.582659960 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.677970886 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.685228109 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.685303926 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.692528009 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.787364006 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.794914007 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.794962883 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.802069902 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.912291050 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.918961048 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:18.919133902 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:18.927272081 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.021682978 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.028368950 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.028448105 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.035569906 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.151155949 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.158133030 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.158201933 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.165293932 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.256159067 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.263329029 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.263401031 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.270313025 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.368026972 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.375236988 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.375288010 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.382091045 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.474852085 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.482114077 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.482160091 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.489311934 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.599838972 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.607124090 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.607192993 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:19.614001989 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.652738094 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:19.652820110 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:21.883354902 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:21.889921904 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:21.890132904 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:21.891067028 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:21.891871929 CEST	53769	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:21.897684097 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:21.897769928 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:21.898668051 CEST	22455	53769	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:21.904844999 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.006202936 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.012672901 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.012736082 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.019176006 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.118153095 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.124526978 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.124567032 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.130546093 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.224896908 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.230963945 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.231035948 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.237634897 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.334429026 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.340792894 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.340871096 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.347450972 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.464153051 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.469326973 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.469383955 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.474558115 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.590111971 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.596934080 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.597143888 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.603060961 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.709353924 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.714562893 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.714636087 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.720323086 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.838505030 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.845350027 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.845510006 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.852224112 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.959263086 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.966366053 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:22.966478109 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:22.973315954 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.068712950 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.075227976 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.075333118 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.081979990 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.218698978 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.225375891 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.225423098 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.232029915 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.334223986 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.339251995 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.339309931 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.362437010 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.445465088 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.451525927 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.451627970 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.456572056 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.568588018 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.573358059 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.573422909 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:23.579037905 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.652822018 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:23.653024912 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:25.913093090 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:25.924448967 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:25.924609900 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:25.925468922 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:25.925970078 CEST	53770	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:25.936784029 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:25.936894894 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:25.941270113 CEST	22455	53770	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:25.948647022 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.037542105 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.048706055 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.048772097 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.059710979 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.162420034 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.173907995 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.174043894 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.184859991 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.284722090 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.295336962 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.295526981 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.305598974 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.396794081 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.405208111 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.405348063 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.414135933 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.506148100 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.513488054 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.513590097 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.520802021 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.627326965 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.634138107 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.634192944 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.640683889 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.740953922 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.749273062 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.749387980 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.758337975 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.850056887 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.858741999 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.858820915 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.866111040 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.963109970 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.968131065 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:26.968241930 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:26.973495007 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.084501982 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.105998039 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.106108904 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.114048004 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.193872929 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.199285030 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.199374914 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.205199003 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.314810038 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.321329117 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.321391106 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.327960968 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.428018093 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.435499907 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.435590982 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.442555904 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.553030968 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.559832096 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.559922934 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.568011999 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.678169966 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.687220097 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.687308073 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.695940971 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.695952892 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:27.696041107 CEST	53772	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:27.704969883 CEST	22455	53772	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:29.944745064 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:29.949740887 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:29.949865103 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:29.950639963 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:29.955490112 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:29.955585957 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:29.960444927 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.094185114 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.099214077 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.099298000 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.104602098 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.209336042 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.214950085 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.215092897 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.220009089 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.318768978 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.323910952 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.324032068 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.328910112 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.428037882 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.436275005 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.436394930 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.443095922 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.553141117 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.560305119 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.560414076 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.567791939 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.664912939 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.670196056 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.670270920 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.675235987 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.772217035 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.777354956 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.777440071 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.782479048 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.881187916 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.886214972 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:30.886295080 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:30.891232967 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.006304979 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.011257887 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.011327028 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.016343117 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.115951061 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.121181011 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.121265888 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.126221895 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.257220030 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.262623072 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.262715101 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.267726898 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.365614891 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.370830059 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.370907068 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.376014948 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.479187965 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.485035896 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.485140085 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.490365028 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.631345034 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.636461973 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.636552095 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:31.641537905 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.707624912 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:31.707833052 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:33.975936890 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:33.981921911 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:33.982059002 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:33.982934952 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:33.983356953 CEST	53773	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:33.988095999 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:33.988194942 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:33.989341021 CEST	22455	53773	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:33.993761063 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.100362062 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.106755018 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.106851101 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.113152027 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.217160940 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.225234985 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.225307941 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.231606960 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.365631104 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.371778011 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.371869087 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.378346920 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.478692055 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.484879971 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.484937906 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.491240978 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.664762974 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.671945095 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.672082901 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.678987980 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.826654911 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.833487988 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.833619118 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.840231895 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.943907976 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.950656891 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:34.950764894 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:34.957118988 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.053039074 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.273561001 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.273657084 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.279922962 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.292840958 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.299416065 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.299477100 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.305938005 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.412566900 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.419092894 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.419159889 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.425376892 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.524769068 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.531368971 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.531486034 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.537957907 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.646996021 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.653168917 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.653279066 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:35.659867048 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.703459024 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:35.703635931 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.007291079 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.014069080 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.014223099 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.016016006 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.016881943 CEST	53774	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.022329092 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.022396088 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.022831917 CEST	22455	53774	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.029064894 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.146881104 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.153490067 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.153552055 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.159553051 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.274636030 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.280884027 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.280932903 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.287580967 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.412662983 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.419375896 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.419464111 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.425879955 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.553092003 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.559602976 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.559657097 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.566179037 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.673580885 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.679888964 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.679970026 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.686507940 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.787373066 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.793845892 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.793900967 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:38.800407887 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:38.912461042 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.224709034 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.226946115 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.230870008 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.272835970 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.279464006 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.279520988 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.285620928 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.381452084 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.387655973 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.387742996 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.394231081 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.506366014 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.513006926 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.513098955 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.519866943 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.631175041 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.637944937 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.638040066 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:39.644520998 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.734570980 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:39.734642029 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.038412094 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.045021057 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.045105934 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.046189070 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.046452045 CEST	53775	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.053383112 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.053400040 CEST	22455	53775	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.053447962 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.059988976 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.162547112 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.169169903 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.169244051 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.175884008 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.291326046 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.296382904 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.296466112 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.301367044 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.399820089 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.404755116 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.404853106 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.409679890 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.522088051 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.527046919 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.527174950 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.531912088 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.631692886 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.636785984 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.637006044 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.641879082 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.744663000 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.749617100 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.749986887 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.754951954 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.851634979 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.856683969 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.856751919 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.861691952 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.959444046 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.964478016 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:42.964550018 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:42.969773054 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.068787098 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.073868036 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.073956013 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.078888893 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.186369896 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.192948103 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.193015099 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.199559927 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.303545952 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.310858965 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.310928106 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.317380905 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.430965900 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.437347889 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.437427044 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.444120884 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.568397045 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.574759960 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.574949026 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.581389904 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.678724051 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.685388088 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.685472012 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:43.692060947 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.768449068 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:43.768517971 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.069463015 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.076199055 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.076282978 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.077045918 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.077424049 CEST	53777	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.083487988 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.083575010 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.083997011 CEST	22455	53777	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.090101004 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.194358110 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.201323986 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.201399088 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.208223104 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.316857100 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.323267937 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.323380947 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.329842091 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.444173098 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.449034929 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.449173927 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.455971956 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.558665991 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.565334082 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.565470934 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.571983099 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.709990025 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.717982054 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.718069077 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.727195978 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.837584019 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.844208002 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:46.844310045 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:46.850967884 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.057677031 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.065243006 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.065336943 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.073071957 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.191663027 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.198765039 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.198873997 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.206981897 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.310566902 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.317552090 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.317662001 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.324778080 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.412967920 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.420156956 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.420213938 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.427252054 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.521893024 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.529511929 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.529637098 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.536499023 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.631460905 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.636343956 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.636498928 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.641397953 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.756513119 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.761791945 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.761905909 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:47.766911030 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.798675060 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:47.798799992 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.102904081 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.108016968 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.108225107 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.109102964 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.109570980 CEST	53778	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.113924026 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.114003897 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.114393950 CEST	22455	53778	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.118824005 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.225215912 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.230242968 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.230415106 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.235244989 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.334614992 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.339534998 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.339627981 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.344506025 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.458492994 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.463432074 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.463485956 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.468242884 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.568723917 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.573681116 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.573743105 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.578552961 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.678071022 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.683042049 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.683177948 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.688193083 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.803118944 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.808003902 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.808109045 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.812899113 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.912545919 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.917484045 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:50.917598009 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:50.922449112 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.037487984 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.042388916 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.042504072 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.047415018 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.146892071 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.151807070 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.151897907 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.157485008 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.256337881 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.261568069 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.261647940 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.266695023 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.371248960 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.377778053 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.377895117 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.384789944 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.484210014 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.491045952 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.491106987 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.497430086 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.600193024 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.608031988 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.608129025 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.614712000 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.709593058 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.717534065 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.717720985 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:51.725187063 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.829773903 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:51.830068111 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.132122040 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.139503002 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.139739990 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.140503883 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.141128063 CEST	53779	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.147877932 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.148044109 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.150224924 CEST	22455	53779	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.155457020 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.261620045 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.266550064 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.266617060 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.272784948 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.381511927 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.386892080 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.386969090 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.392046928 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.506648064 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.513367891 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.513484001 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.519790888 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.631236076 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.638437033 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.638530970 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.645139933 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.740727901 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.747708082 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.747802019 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.754900932 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.851980925 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.858736992 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.858808041 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.865219116 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.975191116 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.981693029 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:54.981815100 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:54.988128901 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.100147009 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.105099916 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.105180025 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.110133886 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.212337971 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.217248917 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.217346907 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.223226070 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.349605083 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.362301111 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.362427950 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.367259979 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.476097107 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.480989933 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.481137037 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.486921072 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.596878052 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.602518082 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.602581024 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.609818935 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.721916914 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.728945971 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.729120970 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.738303900 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.985569000 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:55.992636919 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:55.992734909 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.000252962 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.144120932 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.151468039 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.151560068 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.158277988 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.256341934 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.264014959 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.264096975 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.270514965 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.365659952 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.371515989 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.371598959 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.376665115 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.490808010 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.495986938 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.496104002 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.501219988 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.605456114 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.612227917 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.612339973 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.618778944 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.725042105 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.730046034 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.730133057 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.734988928 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.834445000 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.839526892 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.839683056 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.844496012 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.943924904 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.949323893 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:56.949421883 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:56.955085039 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.053265095 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.060220957 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.060349941 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.067061901 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.162622929 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.169115067 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.169195890 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.176103115 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.278068066 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.284780025 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.284878969 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.291193008 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.396909952 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.403799057 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.403923988 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.410285950 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.506362915 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.513272047 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.513372898 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.520133972 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.615902901 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.622673988 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.622746944 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.629160881 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.740616083 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.746932030 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.747050047 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.752856970 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.852893114 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.858901024 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.858992100 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.866986036 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.975079060 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.981445074 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:57.981547117 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:57.988132000 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:58.084399939 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:58.091142893 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:58.091248989 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:58.097641945 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:58.202084064 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:58.208596945 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:58.208672047 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:48:58.215234041 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:58.218381882 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:48:58.218456984 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.179207087 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.184930086 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.185039043 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.185852051 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.186261892 CEST	53781	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.190845966 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.190941095 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.191467047 CEST	22455	53781	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.196877956 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.303304911 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.309416056 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.309535980 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.314517021 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.431102991 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.436800957 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.436928034 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.442364931 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.538304090 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.543479919 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.543554068 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.550288916 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.687429905 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.692699909 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.692797899 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.698893070 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.803308010 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.810056925 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.810159922 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.816845894 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.912641048 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.918904066 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:01.919106960 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:01.927031040 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.022070885 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.027187109 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.027456045 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.034423113 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.159475088 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.166543961 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.166649103 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.173981905 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.272456884 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.280647993 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.280728102 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.287607908 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.397000074 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.403336048 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.403461933 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.410260916 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.521929026 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.527787924 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.527883053 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.533880949 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.641683102 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.648433924 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.648504972 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.655594110 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.756356001 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.762901068 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.763037920 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:02.769457102 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:02.865900993 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:03.119739056 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:03.119894028 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:03.120110989 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:03.120136023 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:03.120177031 CEST	53782	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:03.126712084 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:03.126765013 CEST	22455	53782	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.213670015 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.220133066 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.220242977 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.221319914 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.227822065 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.227894068 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.234513044 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.350219011 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.356775045 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.357089996 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.363909006 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.459477901 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.465903997 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.466077089 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.472486019 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.590250015 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.595002890 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.595221043 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.600013971 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.712388039 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.717327118 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.717430115 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.722290039 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.834976912 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.840023994 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.840246916 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.845144033 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.960254908 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.965121031 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:05.965626001 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:05.970448017 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.068950891 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.073771954 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.073864937 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.078687906 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.194006920 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.199017048 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.199094057 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.207451105 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.306337118 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.311589003 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.311666965 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.316899061 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.428240061 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.433334112 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.433424950 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.438365936 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.537636042 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.544502020 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.544585943 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.551522970 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.647180080 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.653815031 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.653902054 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.660490036 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.765799999 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.772334099 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.772445917 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.778671980 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.882517099 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.889316082 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.889400959 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:06.895680904 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.937809944 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:06.937906981 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.523406029 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.528450966 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.528546095 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.529505968 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.530076981 CEST	53783	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.534616947 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.534738064 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.534934998 CEST	22455	53783	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.539912939 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.649975061 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.654962063 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.655409098 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.660387993 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.772205114 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.779957056 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.780128956 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.786339998 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.891150951 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.896076918 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:09.896172047 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:09.901072979 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.007431984 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.012836933 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.013297081 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.018135071 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.131407022 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.136682034 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.136898041 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.141819000 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.241187096 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.246562004 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.246634960 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.252051115 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.350689888 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.356456041 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.356554031 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.364476919 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.460798979 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.466567039 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.466633081 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.472834110 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.607971907 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.615256071 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.615365028 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.622376919 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.825534105 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.832799911 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:10.832910061 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:10.839762926 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:11.102704048 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:11.110179901 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:11.110405922 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:11.117600918 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:11.241483927 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:11.248744965 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:11.248806000 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:11.254973888 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:11.271156073 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:11.271223068 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.554670095 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.562056065 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.562175035 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.564070940 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.564728975 CEST	53784	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.570790052 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.570854902 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.571727991 CEST	22455	53784	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.577101946 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.678702116 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.685090065 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.685230970 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.691667080 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.809770107 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.816843033 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.816957951 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.823707104 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.928374052 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.933151007 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:13.933262110 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:13.938281059 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.037595034 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.044451952 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.044513941 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.051528931 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.186955929 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.191935062 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.192033052 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.197169065 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.303152084 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.307965994 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.308027029 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.316554070 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.412662983 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.417578936 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.417643070 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.422494888 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.530031919 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.535347939 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.535435915 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.540193081 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.646960974 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.651901007 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.651978016 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.657042027 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.758317947 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.763601065 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.763678074 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.768547058 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.881472111 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.886368036 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:14.886450052 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:14.891360998 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.006421089 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:15.011296034 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.011369944 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:15.017061949 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.115818977 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:15.121558905 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.121679068 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:15.129777908 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.225145102 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:15.230128050 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.230207920 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:15.235146046 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.285437107 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:15.285499096 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.593888998 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.600337982 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:17.600460052 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.670002937 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.670828104 CEST	53785	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.674885035 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:17.674942017 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.675664902 CEST	22455	53785	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:17.679723978 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:17.904160976 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.909229994 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:17.909316063 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:17.914710999 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.030169010 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.034915924 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.034967899 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.039745092 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.146939039 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.153913021 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.154001951 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.158833981 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.279311895 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.286479950 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.286622047 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.292859077 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.397030115 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.402554035 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.402686119 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.407479048 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.506376028 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.511169910 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.511274099 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.516227961 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.659575939 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.664330959 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.664376974 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.669344902 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.785012960 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.789796114 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.789875031 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.794647932 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.897066116 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.902698994 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:18.902806044 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:18.909063101 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.006696939 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:19.011636019 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.011729002 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:19.016613007 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.131450891 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:19.136327982 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.136401892 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:19.141238928 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.259727955 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:19.264935017 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.264998913 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:19.270518064 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.331037045 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:19.331156015 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.694998980 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.700134039 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:21.700268030 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.701037884 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.701673985 CEST	53786	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.706147909 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:21.706214905 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.706427097 CEST	22455	53786	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:21.710946083 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:21.819005966 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.825640917 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:21.825731993 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.832005024 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:21.944063902 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.950742960 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:21.950886965 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:21.957310915 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.075011015 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.081712008 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.081880093 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.088284016 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.194272995 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.199039936 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.199155092 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.203999043 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.305668116 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.311089993 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.311175108 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.316176891 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.418858051 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.423798084 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.424143076 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.428987026 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.522270918 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.527184010 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.527345896 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.532242060 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.647159100 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.656748056 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.656840086 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.663007975 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.762404919 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.771796942 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.771961927 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.779927969 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.875838041 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.883778095 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.883912086 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.892487049 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.990792990 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:22.997730017 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:22.997853041 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:23.005300999 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.103041887 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:23.109802961 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.109859943 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:23.117244005 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.225333929 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:23.231956005 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.232084990 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:23.238344908 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.350214958 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:23.373986006 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.374079943 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:23.380820990 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.461926937 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:23.462302923 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.725975990 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.733227015 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:25.733319044 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.734039068 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.734350920 CEST	53787	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.741116047 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:25.741130114 CEST	22455	53787	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:25.741163969 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.747847080 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:25.853338957 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.860280991 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:25.860416889 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.867368937 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:25.975178957 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.981492043 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:25.981595993 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:25.988672018 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.100415945 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.106981039 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.107043028 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.114310026 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.231112957 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.238918066 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.239042044 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.248631954 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.350203037 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.356533051 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.356611967 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.363054991 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.459655046 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.464766026 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.464854002 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.469820976 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.578073025 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.582907915 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.582967997 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.587743044 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.694108963 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.698930025 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.699008942 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.703974009 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.822570086 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.828517914 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.828586102 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.834532976 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.963933945 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.970181942 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:26.970259905 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:26.977423906 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.084722996 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:27.091092110 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.091151953 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:27.097804070 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.209506035 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:27.216094017 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.216155052 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:27.223943949 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.334481955 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:27.341355085 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.341444016 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:27.365566015 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.455621958 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:27.455739021 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.757263899 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.764240980 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:29.764343023 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.765088081 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.765542984 CEST	53789	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.772181034 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:29.772268057 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.772593975 CEST	22455	53789	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:29.779303074 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:29.897151947 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.904246092 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:29.904326916 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:29.911293030 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.015669107 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.022618055 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.022687912 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.029536963 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.131568909 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.139910936 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.140021086 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.149163008 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.241183043 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.248536110 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.248625994 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.255774975 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.350290060 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.358948946 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.359034061 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.366481066 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.459847927 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.472851992 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.472922087 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.481802940 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.584944963 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.596251965 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.596304893 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.604955912 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.707200050 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.716439962 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.716486931 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.725188017 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.818934917 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.827735901 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.827868938 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.837249994 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.928539038 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.935547113 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:30.935627937 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:30.942928076 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.047521114 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:31.053880930 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.053942919 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:31.060261965 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.195245981 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:31.202383041 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.202467918 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:31.208795071 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.354302883 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:31.374110937 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.374197960 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:31.380544901 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.506323099 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:31.507785082 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.803245068 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.808137894 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:33.808207035 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.808955908 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.809303999 CEST	53790	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.813709974 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:33.813780069 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.814198017 CEST	22455	53790	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:33.818589926 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:33.951939106 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.956815004 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:33.956896067 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:33.961952925 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.196531057 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.201339006 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.201432943 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.206254005 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.360256910 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.365068913 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.365148067 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.369980097 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.475337982 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.480314016 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.480443001 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.485250950 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.584738970 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.589615107 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.589797974 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.594593048 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.709608078 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.714442015 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.714520931 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.719276905 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.834701061 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.839648008 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.839731932 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.844660044 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.966299057 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.971517086 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:34.971585989 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:34.976373911 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.084542036 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.089402914 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.089493036 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.094280005 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.194299936 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.199686050 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.199812889 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.204719067 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.303433895 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.308290005 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.308372974 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.313261986 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.412875891 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.418184042 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.418246031 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.423003912 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.542464972 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.547319889 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.547379017 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:35.552229881 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.552757025 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:35.552808046 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.835438013 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.840811014 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:37.840940952 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.841768980 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.842221022 CEST	53792	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.846545935 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:37.846600056 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.846986055 CEST	22455	53792	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:37.852088928 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:37.959954023 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.965243101 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:37.965308905 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:37.970751047 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.084786892 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.090419054 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.090524912 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.095566034 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.209567070 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.215049028 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.215132952 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.220422983 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.318960905 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.326042891 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.326105118 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.334086895 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.430931091 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.437825918 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.437874079 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.445079088 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.577231884 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.583976984 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.584055901 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.590790987 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.723445892 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.731205940 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.731734037 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.739053011 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.891225100 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.898168087 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:38.898262024 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:38.905317068 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.118529081 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.125124931 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.125189066 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.132596016 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.242192984 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.247437954 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.247517109 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.252687931 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.353614092 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.364376068 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.364459038 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.373327017 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.475213051 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.482441902 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.482541084 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:39.487421036 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.564860106 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:39.564944029 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:41.869169950 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:41.876888990 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:41.877007008 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:41.886534929 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:41.892477036 CEST	53793	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:41.893172026 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:41.893258095 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:41.899754047 CEST	22455	53793	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:41.900337934 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.022233009 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.029402018 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.029476881 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.036515951 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.140503883 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.145396948 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.145457029 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.150271893 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.256700993 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.417273998 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.417332888 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.422559023 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.484730959 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.489617109 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.489684105 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.494461060 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.600339890 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.605062962 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.605254889 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.610028028 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.710161924 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.715380907 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.715440989 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.720195055 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.824215889 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.830002069 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.830068111 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.835207939 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.943934917 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.948823929 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:42.948883057 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:42.953725100 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.069147110 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.074090958 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.074230909 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.079036951 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.188342094 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.193111897 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.193185091 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.197946072 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.303585052 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.308506012 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.308607101 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.313653946 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.412887096 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.417831898 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.417931080 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.422883987 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.537820101 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.542722940 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.542785883 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:43.547646046 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.627352953 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:43.627461910 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:45.914347887 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:45.919176102 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:45.919292927 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:45.921087027 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:45.922048092 CEST	53794	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:45.925918102 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:45.926012039 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:45.927016973 CEST	22455	53794	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:45.930902958 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.041913033 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.046716928 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.046797991 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.051590919 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.147027016 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.297334909 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.297429085 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.302197933 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.381448984 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.389681101 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.389864922 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.395407915 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.490883112 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.496543884 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.496737957 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.502346992 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.609736919 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.614501953 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.614567041 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.619419098 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.725158930 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.730969906 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.731079102 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.736927032 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.836381912 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.841200113 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.841270924 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:46.846019030 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:46.946909904 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.100217104 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.100274086 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.105601072 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.162641048 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.167409897 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.167460918 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.172249079 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.279329062 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.284152031 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.284240007 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.288953066 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.397327900 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.403307915 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.403404951 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.408190012 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.522087097 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.526846886 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.526922941 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.531877995 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.639744997 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.644716024 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.644768000 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:47.649540901 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.661573887 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:47.661720991 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:49.944729090 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:49.949592113 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:49.949700117 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:49.951689959 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:49.952334881 CEST	53795	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:49.956501961 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:49.956578970 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:49.957083941 CEST	22455	53795	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:49.961430073 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.069245100 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.074074030 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.074295998 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.079152107 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.178802967 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.183625937 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.183682919 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.188462019 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.303406000 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.308223963 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.308379889 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.313690901 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.428369045 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.433407068 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.433516026 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.438282013 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.553433895 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.558187962 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.558643103 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.564143896 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.662818909 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.667644978 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.668031931 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.672848940 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.842895031 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.848017931 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.848063946 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.852986097 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.976409912 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.983439922 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:50.983696938 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:50.990463018 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.127201080 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.133341074 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.133439064 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.138334036 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.362896919 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.367676973 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.367768049 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.372813940 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.475316048 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.480487108 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.480562925 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.485388994 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.601047039 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.605808973 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.605860949 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:51.611089945 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.694345951 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:51.694479942 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:53.976275921 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:53.981259108 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:53.981364965 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:53.982239962 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:53.982755899 CEST	53796	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:53.986991882 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:53.987047911 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:53.988075018 CEST	22455	53796	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:53.992189884 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.100343943 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.105288029 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.105356932 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.110222101 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.209613085 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.214440107 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.214500904 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.219883919 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.323765039 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.328598022 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.328680992 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.333905935 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.428327084 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.433159113 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.433226109 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.438087940 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.537770987 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.542718887 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.542790890 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.547774076 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.662816048 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.667638063 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.667736053 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.672488928 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.772310972 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.777120113 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.777199030 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.782382011 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.901093006 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.905905008 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:54.905961037 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:54.910964966 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.022140980 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.027009010 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.027072906 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.031914949 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.131500006 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.136441946 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.136626959 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.141552925 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.256546974 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.262684107 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.262779951 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.267671108 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.381764889 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.386645079 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.386857986 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.391683102 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.491058111 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.495882988 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.495943069 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.500778913 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.600972891 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.616076946 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.616158962 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:55.621620893 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.707638979 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:55.707783937 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.007767916 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.031644106 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.031903028 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.033353090 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.034203053 CEST	53797	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.038149118 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.038239956 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.038949013 CEST	22455	53797	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.043153048 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.147227049 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.152014971 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.152086020 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.156894922 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.256513119 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.261606932 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.261739016 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.266815901 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.370959044 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.383445024 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.383498907 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.388235092 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.490900993 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.627868891 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.628025055 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.844752073 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.844887018 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:58.849967003 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:58.944000959 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.106667042 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.106760025 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.111912012 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.194425106 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.199784994 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.199997902 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.205566883 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.339189053 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.345477104 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.345535994 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.352965117 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.459949017 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.464721918 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.464792013 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.469728947 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.571500063 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.576416016 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.576464891 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.581507921 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.683876038 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.690218925 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.690359116 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:49:59.695713043 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.752875090 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:49:59.752988100 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.057049036 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.061836004 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.061928034 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.062700033 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.063407898 CEST	53798	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.067409992 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.067477942 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.068181038 CEST	22455	53798	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.072230101 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.210493088 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.215359926 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.215507984 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.220422983 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.319415092 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.324440956 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.324553013 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.329670906 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.437654972 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.442485094 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.442542076 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.447297096 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.553735971 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.558734894 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.558877945 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.563612938 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.663129091 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.668849945 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.668997049 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.674367905 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.797182083 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.801994085 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.802074909 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.806899071 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.912844896 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.917633057 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:02.917746067 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:02.922497034 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.052953959 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.057894945 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.057969093 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.062757969 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.178350925 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.183403969 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.183473110 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.188277006 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.303539038 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.308931112 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.309041977 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.314069986 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.412863016 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.417740107 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.417809963 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.422827005 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.538552046 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.764677048 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.764791965 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:03.770387888 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.861324072 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:03.861505985 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.086472034 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.091304064 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.091490984 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.092422962 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.092900038 CEST	53799	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.097171068 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.097229958 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.097908974 CEST	22455	53799	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.102143049 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.209435940 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.214485884 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.214586973 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.219482899 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.319312096 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.324343920 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.324487925 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.329202890 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.444072962 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.448960066 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.449264050 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.454077959 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.562804937 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.567876101 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.567954063 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.572734118 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.699142933 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.705625057 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.705694914 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.711797953 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.854383945 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.860728025 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:06.860851049 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:06.865835905 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.105113029 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.110192060 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.110280991 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.115044117 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.288297892 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.293160915 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.293384075 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.298187017 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.397527933 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.402686119 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.402848959 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.409930944 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.522305012 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.527115107 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.527221918 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.532068014 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.631608963 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.636432886 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.636632919 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.641704082 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.740950108 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.745762110 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.745877028 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:07.751065969 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.835983038 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:07.836055994 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.118556976 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.125967979 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.126245022 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.128057003 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.128938913 CEST	53800	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.136200905 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.136410952 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.136569023 CEST	22455	53800	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.144391060 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.241128922 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.249990940 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.250081062 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.257742882 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.381804943 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.386619091 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.386725903 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.391473055 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.491031885 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.495791912 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.496092081 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.500906944 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.600857019 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.605613947 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.605911970 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.610697985 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.715933084 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.720940113 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.720999956 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.725697041 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.820245981 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.824966908 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.825139999 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.829992056 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.928522110 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.934701920 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:10.934806108 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:10.939512014 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.053468943 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.058255911 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.058576107 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.064652920 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.178705931 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.183465958 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.183588982 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.188340902 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.313846111 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.318634987 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.318789005 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.323589087 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.428608894 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.433403015 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.433542013 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.438342094 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.537954092 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.543622971 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.543817043 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.549483061 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.663110018 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.667960882 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.668062925 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.672971010 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.772476912 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.777532101 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.777632952 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:11.782622099 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.877911091 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:11.878154039 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.148103952 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.153312922 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.153551102 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.154462099 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.154906034 CEST	53801	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.159416914 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.159487009 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.159997940 CEST	22455	53801	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.164388895 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.272686005 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.279033899 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.279205084 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.285947084 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.381797075 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.387954950 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.388073921 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.395184040 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.503231049 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.509989977 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.510310888 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.516681910 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.616168022 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.622709036 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.622833014 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.629576921 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.725960016 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.732374907 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.732515097 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.738867044 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.850913048 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.857311010 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.857391119 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.863785982 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.960122108 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.967426062 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:14.967536926 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:14.974651098 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.069154978 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.076411963 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.076486111 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.084076881 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.178622961 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.188465118 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.188581944 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.196362019 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.310039043 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.317089081 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.317198992 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.323766947 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.430994987 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.438366890 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.438429117 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.445920944 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.543873072 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.550955057 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.551024914 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.559964895 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.694122076 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.700999975 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.701076984 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:15.709208012 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.879292011 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:15.879381895 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.179991961 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.186374903 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.186534882 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.188472986 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.189235926 CEST	53802	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.194942951 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.195033073 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.196002960 CEST	22455	53802	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.202852011 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.319252968 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.326481104 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.326574087 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.332959890 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.463776112 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.468601942 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.468712091 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.473587990 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.801330090 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.807812929 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.807933092 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.814424038 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.917206049 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.924407005 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:18.924468994 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:18.930680037 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.038156033 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.044460058 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.044565916 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.050944090 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.163234949 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.174591064 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.174727917 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.182023048 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.297869921 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.304835081 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.304984093 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.311485052 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.413012028 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.419307947 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.419372082 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.425940990 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.522778988 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.529061079 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.529117107 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.535274982 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.641376972 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.647717953 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.647836924 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.654330015 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.756829977 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.763343096 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.763535976 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.769866943 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.866183043 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.872419119 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.872570038 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:19.879089117 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.946441889 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:19.946548939 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.258435965 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.263206005 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.263343096 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.264048100 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.265161991 CEST	53803	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.269165993 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.269368887 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.270776033 CEST	22455	53803	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.274277925 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.381685019 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.388149023 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.388314009 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.396163940 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.491245985 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.498868942 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.498975039 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.509654045 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.600569010 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.608541012 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.608628988 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.618439913 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.725703955 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.732094049 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.732146025 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.740606070 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.846321106 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.853216887 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.853270054 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.861136913 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.985531092 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:22.992886066 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:22.992981911 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.000818968 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.100579023 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.108611107 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.108833075 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.116277933 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.216501951 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.224666119 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.224767923 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.232528925 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.319207907 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.326306105 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.326503038 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.333739996 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.444176912 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.452471018 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.452574015 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.460156918 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.569292068 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.578891993 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.579025984 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.588804007 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.678559065 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.687701941 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.687809944 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.698590040 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.803627014 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.812037945 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.812092066 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.820765972 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.912878036 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.920912981 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:23.921067953 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:23.928673029 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:24.006665945 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:24.007339001 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.288794041 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.295753002 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.295880079 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.297456980 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.298183918 CEST	53804	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.304486990 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.304548025 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.306627035 CEST	22455	53804	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.311430931 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.413064957 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.420754910 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.420850992 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.428127050 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.522409916 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.531200886 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.531291008 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.539024115 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.631741047 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.639719009 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.639902115 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.647315025 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.741029024 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.750067949 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.750122070 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.758527994 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.850449085 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.857953072 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.858064890 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.865936995 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.960024118 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.965500116 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:26.965553999 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:26.970766068 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.084852934 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.090447903 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.090503931 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.095577002 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.209844112 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.215015888 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.215078115 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.220096111 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.334706068 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.339559078 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.339617014 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.344604015 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.459863901 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.464687109 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.464761019 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.471494913 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.569087029 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.577348948 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.577449083 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.584886074 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.680387020 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.685589075 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.685694933 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.691728115 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.807348967 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.812279940 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.812333107 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.817395926 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.948601961 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.953989983 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:27.954037905 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:27.958949089 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:28.051954031 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:28.052086115 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.321135044 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.326335907 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.326457977 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.327197075 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.327719927 CEST	53805	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.332114935 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.332182884 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.332736015 CEST	22455	53805	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.338036060 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.444315910 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.449249983 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.449353933 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.454422951 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.569797039 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.574732065 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.574856997 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.579648018 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.817938089 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.823363066 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:30.823448896 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:30.828249931 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.020670891 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.025584936 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.025648117 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.030488968 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.148885965 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.155730009 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.155834913 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.160700083 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.256983995 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.262801886 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.262890100 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.270410061 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.366334915 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.371145010 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.371252060 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.377106905 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.491075993 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.497865915 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.497970104 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.502810955 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.600413084 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.792828083 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.792911053 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.799144983 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.819230080 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.825397015 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.825637102 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.830816984 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.944204092 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.949470043 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:31.949724913 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:31.956110001 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:32.050282955 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:32.050384998 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.351332903 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.356256962 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.356373072 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.357834101 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.358570099 CEST	53806	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.362740040 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.363065004 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.365621090 CEST	22455	53806	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.368531942 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.479013920 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.483834028 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.484014988 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.489025116 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.585599899 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.590574980 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.590711117 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.595637083 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.710058928 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.914226055 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.914346933 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.921926022 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.960477114 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.965460062 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:34.965543985 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:34.970472097 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.084849119 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.089992046 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.090209961 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.094970942 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.198880911 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.203860998 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.204026937 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.209022045 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.322742939 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.327672005 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.327941895 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.332823038 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.444318056 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.449402094 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.449594021 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.456625938 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.567835093 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.575611115 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.575679064 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.582724094 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.695251942 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.860627890 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.860955000 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.866038084 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.944222927 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.949248075 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:35.949338913 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:35.954838991 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:36.069189072 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:36.075359106 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:36.075613022 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:36.080535889 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:36.096702099 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:36.096822977 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.383378983 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.388206005 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.388340950 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.389238119 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.389929056 CEST	53807	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.394190073 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.394279003 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.394918919 CEST	22455	53807	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.399126053 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.509581089 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.516239882 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.516295910 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.521095037 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.636938095 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.641755104 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.641851902 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.646811008 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.741094112 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.745843887 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.745932102 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.750675917 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.850667000 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.855516911 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.855660915 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.860923052 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.962966919 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.968751907 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:38.968872070 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:38.975476980 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.069953918 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.074701071 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.074754000 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.079756021 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.178807020 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.183584929 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.183655024 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.188441038 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.294431925 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.299341917 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.299454927 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.304358959 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.397464991 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.402322054 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.403405905 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.408269882 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.506786108 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.511538982 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.511640072 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.516762018 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.619524002 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.624360085 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.624836922 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.629868984 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.725713015 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.730603933 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.730812073 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.735637903 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.835410118 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.840859890 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.841125965 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.846039057 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.944441080 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.949254036 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:39.949592113 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:39.954914093 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:40.053874016 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:40.058706045 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:40.058813095 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:40.063833952 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:40.130458117 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:40.130640984 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.438410044 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.443219900 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.443401098 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.444236994 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.444916964 CEST	53808	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.448992968 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.449054003 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.449673891 CEST	22455	53808	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.453948021 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.569454908 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.574275970 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.574321985 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.579077959 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.695846081 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.700716019 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.700757027 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.705549002 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.819163084 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.824456930 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.824522018 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.829251051 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.928658962 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.933561087 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:42.933628082 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:42.938534975 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.053539991 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.058464050 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.058557987 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.063517094 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.163094997 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.167869091 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.167952061 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.172971964 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.272644997 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.277765989 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.277825117 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.282911062 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.381804943 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.388181925 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.388252974 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.393151045 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.496998072 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.503146887 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.503195047 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.508024931 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.616410971 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.621387005 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.621447086 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.626456976 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.746206045 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.751120090 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.751208067 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.756052971 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.866236925 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.871259928 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.871324062 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.876136065 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.975709915 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.980622053 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:43.980894089 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:43.985944033 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:44.105484962 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:44.110301971 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:44.110507011 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:44.115309000 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:44.162496090 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:44.162610054 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.478132963 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.482959986 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.483149052 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.485213041 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.486509085 CEST	53809	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.489988089 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.490125895 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.491326094 CEST	22455	53809	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.494966984 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.600763083 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.605698109 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.605803013 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.610776901 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.710113049 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.715115070 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.715219021 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.719974995 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.819210052 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.824033022 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.824104071 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.828947067 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.944375038 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.949299097 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:46.949667931 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:46.954647064 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.053838968 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.058649063 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.058762074 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.063685894 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.163126945 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.168073893 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.168160915 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.173257113 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.273394108 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.279228926 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.279453993 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.284332991 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.383960009 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.397850990 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.397901058 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.403462887 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.491462946 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.507020950 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.507147074 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.513385057 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.621006966 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.625859022 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.625963926 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.637207031 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.725739002 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.730686903 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.730796099 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.736030102 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.835127115 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.840040922 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.840141058 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.844983101 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.944804907 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.949656010 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:47.949712992 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:47.954559088 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:48.069499969 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:48.074578047 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:48.074681997 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:48.079581976 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:48.178813934 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:48.184376955 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:48.184439898 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:48.190159082 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:48.205919981 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:48.206089973 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.508100033 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.515240908 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.515351057 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.516511917 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.519758940 CEST	53810	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.522927999 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.523281097 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.526546001 CEST	22455	53810	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.531702042 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.636183023 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.642541885 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.642716885 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.649182081 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.756943941 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.763031960 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.763156891 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.770255089 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.883924961 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.891048908 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:50.891182899 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:50.898135900 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.033402920 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.040566921 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.040666103 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.047914028 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.147349119 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.155426979 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.155680895 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.162601948 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.256793022 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.262936115 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.263036966 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.270786047 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.366209984 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.373311996 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.373389959 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.381402969 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.491390944 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.498306990 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.498413086 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.505558014 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.616270065 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.623390913 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.623486042 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.629708052 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.768759966 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.775711060 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.775795937 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.783504009 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.898617029 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.906316996 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:51.906476021 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:51.913585901 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:52.041943073 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:52.050401926 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:52.050540924 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:52.058303118 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:52.163413048 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:52.173167944 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:52.173392057 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:52.180058002 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:52.241045952 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:52.241275072 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.538961887 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.546271086 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.546423912 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.547215939 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.547722101 CEST	53811	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.554562092 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.554579020 CEST	22455	53811	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.554641962 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.561888933 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.663373947 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.670195103 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.670286894 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.677650928 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.791018963 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.798434019 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.798527956 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.805970907 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.898513079 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.906302929 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:54.906409025 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:54.913801908 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.022604942 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.030231953 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.030364990 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.037890911 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.158449888 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.166049004 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.166121006 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.174390078 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.272646904 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.281307936 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.281373024 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.288345098 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.382499933 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.390731096 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.390801907 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.399442911 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.505861998 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.513618946 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.513695002 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.522409916 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.616472006 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.624469995 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.624583960 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.632138968 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.725678921 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.733614922 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.733680964 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.740879059 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.859647036 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.866883993 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.866964102 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.875123024 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.975483894 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.985027075 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:55.985114098 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:55.994394064 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:56.101752043 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:56.108524084 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:56.108597994 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:56.115917921 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:56.209986925 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:56.216835022 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:56.216912031 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:56.223280907 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:56.273035049 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:56.273103952 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.570310116 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.576666117 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.576816082 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.577660084 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.578178883 CEST	53812	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.586111069 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.586133003 CEST	22455	53812	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.586244106 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.593004942 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.694622040 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.701706886 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.701860905 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.708436966 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.803746939 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.811254025 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.811357975 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.819010973 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.932845116 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.939094067 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:58.939209938 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:58.946294069 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.055944920 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.062875986 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.062926054 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.069052935 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.163063049 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.169658899 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.169868946 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.176762104 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.282633066 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.289771080 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.289855957 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.296230078 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.397641897 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.407370090 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.407563925 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.414387941 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.522449970 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.528867960 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.528956890 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.536091089 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.648164034 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.655196905 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.655412912 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.661993027 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.772767067 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.779144049 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.779273033 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.786345959 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.898274899 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.905105114 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:50:59.905498028 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:50:59.912617922 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.022578001 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:00.029270887 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.029361963 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:00.036056042 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.131959915 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:00.138716936 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.138830900 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:00.145236015 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.241513968 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:00.248852968 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.248955011 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:00.257438898 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.347803116 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:00.348084927 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.602169991 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.608494997 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.608578920 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.609422922 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.609833956 CEST	53814	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.616687059 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.616740942 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.617324114 CEST	22455	53814	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.623505116 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.725934982 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.733012915 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.733072042 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.739320040 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.850586891 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.858479023 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.858572006 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.865556002 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.959995031 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.968195915 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:02.968269110 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:02.974860907 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.084918976 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.091726065 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.091811895 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.099499941 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.194397926 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.201292992 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.201391935 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.208544970 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.344021082 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.351465940 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.351535082 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.361049891 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.460062027 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.467166901 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.467264891 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.474343061 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.585155964 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.592024088 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.592122078 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.599117041 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.695787907 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.702620983 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.702712059 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.709666014 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.803793907 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.814129114 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.814254999 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.821203947 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.929173946 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.936280966 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:03.936343908 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:03.943936110 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.040993929 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:04.050417900 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.050479889 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:04.057710886 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.172683954 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:04.179733992 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.179836035 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:04.186893940 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.288455009 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:04.295435905 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.295509100 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:04.302987099 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.330296040 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:04.330359936 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.632895947 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.639749050 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:06.639884949 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.640711069 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.641254902 CEST	53815	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.650345087 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:06.650361061 CEST	22455	53815	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:06.650703907 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.658631086 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:06.772682905 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.780106068 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:06.780206919 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.787899971 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:06.897624969 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.904875994 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:06.904979944 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:06.912121058 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.007014036 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.014580965 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.014754057 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.020771980 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.129096985 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.134097099 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.134203911 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.139468908 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.256867886 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.262564898 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.262731075 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.267683983 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.366878033 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.371973991 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.372034073 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.377126932 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.505860090 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.510763884 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.510838985 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.516158104 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.616173983 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.621264935 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.621335983 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.626322985 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.725630045 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.731247902 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.731328011 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.736248016 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.897425890 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.902559996 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:07.902659893 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:07.907723904 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.038486004 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:08.043550014 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.043607950 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:08.048800945 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.203185081 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:08.208594084 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.208647966 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:08.214063883 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.343717098 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:08.349008083 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.349261999 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:08.354382038 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.398818970 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:08.398948908 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.664669037 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.669483900 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:10.669666052 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.671504974 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.672466993 CEST	53817	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.676223993 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:10.676306009 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.677237988 CEST	22455	53817	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:10.681757927 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:10.788582087 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.793442011 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:10.793538094 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.798319101 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:10.918164015 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.927004099 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:10.927077055 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:10.933139086 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:11.038130999 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:11.045211077 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:11.045293093 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:11.051932096 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:11.147613049 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:11.154050112 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:11.154556990 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:11.160851955 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:11.272926092 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:11.280749083 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:11.280836105 CEST	53818	22455	192.168.2.6	154.21.14.89
Oct 8, 2024 00:51:11.287672997 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:12.400562048 CEST	22455	53818	154.21.14.89	192.168.2.6
Oct 8, 2024 00:51:12.400645971 CEST	53818	22455	192.168.2.6	154.21.14.89

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:47:10.088104010 CEST	57390	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:47:10.104392052 CEST	53	57390	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 00:47:10.088104010 CEST	192.168.2.6	1.1.1.1	0x96ed	Standard query (0)	gibbooc2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 00:47:10.104392052 CEST	1.1.1.1	192.168.2.6	0x96ed	No error (0)	gibbooc2.com		154.21.14.89	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	18:47:03
Start date:	07/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\ResPrompt.dll.dll"
Imagebase:	0x7ff6a48b0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:47:03
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:47:03
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1
Imagebase:	0x7ff6607c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:47:03
Start date:	07/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\ResPrompt.dll.dll
Imagebase:	0x7ff6c6bf0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:47:03
Start date:	07/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ResPrompt.dll.dll",#1
Imagebase:	0x7ff639690000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:47:03
Start date:	07/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllRegisterServer
Imagebase:	0x7ff639690000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:47:06
Start date:	07/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ResPrompt.dll.dll,DllUnregisterServer
Imagebase:	0x7ff639690000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFDA3485C20 Relevance: 75.5, APIs: 5, Strings: 38, Instructions: 235
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA3485CFD
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3485DD5
CreateMutexExW.KERNELBASE ref: 00007FFDA3485DE4
GetLastError.KERNEL32 ref: 00007FFDA3485DFD
std::bad_exception::bad_exception.LIBCMTD ref: 00007FFDA3485E53

Strings

}, xrefs: 00007FFDA3485CE3
3, xrefs: 00007FFDA3485C5C
2, xrefs: 00007FFDA3485CB1
7, xrefs: 00007FFDA3485C48
-, xrefs: 00007FFDA3485CA2
D, xrefs: 00007FFDA3485C84
{, xrefs: 00007FFDA3485C2A
4, xrefs: 00007FFDA3485C75
A, xrefs: 00007FFDA3485C7A
C, xrefs: 00007FFDA3485C6B
A, xrefs: 00007FFDA3485CCA
1, xrefs: 00007FFDA3485CBB
-, xrefs: 00007FFDA3485C57
9, xrefs: 00007FFDA3485C7F
-, xrefs: 00007FFDA3485C70
F, xrefs: 00007FFDA3485CD4
6, xrefs: 00007FFDA3485CC0
6, xrefs: 00007FFDA3485C9D
9, xrefs: 00007FFDA3485CD9
E, xrefs: 00007FFDA3485C4D
9, xrefs: 00007FFDA3485C8E
B, xrefs: 00007FFDA3485C52
5, xrefs: 00007FFDA3485CAC
D, xrefs: 00007FFDA3485CCF
E, xrefs: 00007FFDA3485C2F
0, xrefs: 00007FFDA3485CC5
B, xrefs: 00007FFDA3485CDE
-, xrefs: 00007FFDA3485C89
7, xrefs: 00007FFDA3485C66
6, xrefs: 00007FFDA3485C93
7, xrefs: 00007FFDA3485C39
2, xrefs: 00007FFDA3485C34
C, xrefs: 00007FFDA3485C98
6, xrefs: 00007FFDA3485C61
6, xrefs: 00007FFDA3485CA7
7, xrefs: 00007FFDA3485C3E
0, xrefs: 00007FFDA3485CB6
2, xrefs: 00007FFDA3485C43

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::CreateEmptyErrorFac_nodeFac_node::_LastMutexQueue::StructuredWorkstd::_std::bad_exception::bad_exception
String ID: -$-$-$-$0$0$1$2$2$2$3$4$5$6$6$6$6$6$7$7$7$7$9$9$9$A$A$B$B$C$C$D$D$E$E$F${$}
API String ID: 1149196539-2202459216
Opcode ID: c23fd9ccd435e09b8d6fabbe867b38cfc7cb505c9ffd75c4aa2e92c9946ef1c7
Instruction ID: 1a739cb218d9d2e1fcb8d4c306d2c1ff18591819e4ce9bc390a783d896db3949
Opcode Fuzzy Hash: c23fd9ccd435e09b8d6fabbe867b38cfc7cb505c9ffd75c4aa2e92c9946ef1c7
Instruction Fuzzy Hash: EBC1862160E6C185E7A1DB14E4643AEBB92EB92344F400035E3CD97BDBDFAED548CB09

Function 00007FFDA34C3914 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA34C393C
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA34C398E
_RTC_Initialize.LIBCMT ref: 00007FFDA34C39BC
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA34C39E2
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA34C3A0D

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 379fb157a98799b01100bb80668918f310a9638619fe247a65667b2318d9597b
Instruction ID: a43f2535a819569e9d976f8f0fc38704da9e9645581593b4f479050693ffa25e
Opcode Fuzzy Hash: 379fb157a98799b01100bb80668918f310a9638619fe247a65667b2318d9597b
Instruction Fuzzy Hash: E581D421F0F64345FA60AB6E94612BA6693AF86780F544035F90CE7397DEBFE851870C

Function 00007FFDA34860D0 Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFDA34860D9
OpenProcess.KERNEL32 ref: 00007FFDA34860EF
TerminateProcess.KERNELBASE ref: 00007FFDA3486101

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Process$CurrentOpenTerminate
String ID:
API String ID: 1665377759-0
Opcode ID: f438164aa293f679cc8d685dac6f048bff96706690f7a88d4d1aeed23efbc951
Instruction ID: 56cbdb1cfcec7b89421891b8137fec777f84d9df6e62d1323c4323657ac38337
Opcode Fuzzy Hash: f438164aa293f679cc8d685dac6f048bff96706690f7a88d4d1aeed23efbc951
Instruction Fuzzy Hash: 36E0BF36A09A4186D320DB65A814059F7A2FBCC745F548134D68D92729DF7DD1968B08

Function 00007FFDA34D4D28 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FFDA34D4DA1
GetFileType.KERNELBASE ref: 00007FFDA34D4DB7

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: c975e2ac7706f3e4683587d3d6c8d90ca69842364e3eb4dd00c166d6981ac890
Instruction ID: 218836f4d6fd6bc2dcecb0c8155ba88ce6428470ae87aa21a70ace1748fe8d90
Opcode Fuzzy Hash: c975e2ac7706f3e4683587d3d6c8d90ca69842364e3eb4dd00c166d6981ac890
Instruction Fuzzy Hash: 09310A33B19B4191D7608B2485A11782652FB45BF0F690339DB6EA73E5CF7EE4A1C348

Function 00007FFDA34DFDDC Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34DFE07

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f6778a97db3e7d7cc00ddc368c5f4a02c47bb974696b7abc8e093fa4e358170f
Instruction ID: 890145cd6ef4805792575877b3a7b6bc91b6605a2b480cd8f41319fe8a1de047
Opcode Fuzzy Hash: f6778a97db3e7d7cc00ddc368c5f4a02c47bb974696b7abc8e093fa4e358170f
Instruction Fuzzy Hash: 48118233B0E78286F3209B18A4606697392FB41780F150436E64DA77A7DFBEE8108B08

Function 00007FFDA34D3FEC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FFDA34D25E2,?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000), ref: 00007FFDA34D4041

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b865d5f5eb091f35a37736941d99cb0038ee27259a523f223bb2da8cdd44aaf9
Instruction ID: a72686633b526673f5fc1291b704ac5e2e17dfb16867ba047205c6039f14c877
Opcode Fuzzy Hash: b865d5f5eb091f35a37736941d99cb0038ee27259a523f223bb2da8cdd44aaf9
Instruction Fuzzy Hash: 75F06D62B0B20741FE665B6669363B552925F49BC0F1C4430CA0EE73C3DDAFE8804228

Non-executed Functions

Function 00007FFDA34B16D0 Relevance: 230.0, APIs: 20, Strings: 111, Instructions: 759COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1756
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1819
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B18A0
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B196B
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B19FB
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1A64
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1ACD
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1B36
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1BB3
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1D3E
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1DAC
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1E07
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B20D3
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B21DA

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

Part of subcall function 00007FFDA34B57C0: DNameNode::DNameNode.LIBCMTD ref: 00007FFDA34B57CE

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B22E1
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B23E0

Part of subcall function 00007FFDA34B5720: DNameNode::DNameNode.LIBCMTD ref: 00007FFDA34B572E

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B248C
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B2538
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B1FCC

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Strings

e, xrefs: 00007FFDA34B17BE
o, xrefs: 00007FFDA34B17EE
n, xrefs: 00007FFDA34B19C9
R, xrefs: 00007FFDA34B1796
e, xrefs: 00007FFDA34B1B7B
t, xrefs: 00007FFDA34B1872
d, xrefs: 00007FFDA34B1B99
D, xrefs: 00007FFDA34B1C4B
0, xrefs: 00007FFDA34B1C1B
a, xrefs: 00007FFDA34B171B
C, xrefs: 00007FFDA34B1859
7, xrefs: 00007FFDA34B1C2B
a, xrefs: 00007FFDA34B170B
0, xrefs: 00007FFDA34B1C43
5, xrefs: 00007FFDA34B1CCB
D, xrefs: 00007FFDA34B17C6
DfC, xrefs: 00007FFDA34B19EE
r, xrefs: 00007FFDA34B1D92
t, xrefs: 00007FFDA34B19DB
-, xrefs: 00007FFDA34B1C3B
i, xrefs: 00007FFDA34B1B8A
w, xrefs: 00007FFDA34B1920
P, xrefs: 00007FFDA34B1AA4
B, xrefs: 00007FFDA34B1CE3
g, xrefs: 00007FFDA34B1723
d, xrefs: 00007FFDA34B1948
3, xrefs: 00007FFDA34B1CFB
n, xrefs: 00007FFDA34B187C
c, xrefs: 00007FFDA34B1B80
l, xrefs: 00007FFDA34B185E
n, xrefs: 00007FFDA34B1AAE
s, xrefs: 00007FFDA34B17D6
3, xrefs: 00007FFDA34B1D13
4, xrefs: 00007FFDA34B1C7B
e, xrefs: 00007FFDA34B16FB
p, xrefs: 00007FFDA34B17F6
I, xrefs: 00007FFDA34B1877
l, xrefs: 00007FFDA34B1930
e, xrefs: 00007FFDA34B172B
{wSsR, xrefs: 00007FFDA34B1D2E
e, xrefs: 00007FFDA34B1868
M, xrefs: 00007FFDA34B1703
e, xrefs: 00007FFDA34B179E
3, xrefs: 00007FFDA34B1C83
P, xrefs: 00007FFDA34B1A3B
-, xrefs: 00007FFDA34B1C63
a, xrefs: 00007FFDA34B1940
g, xrefs: 00007FFDA34B1A4A
l, xrefs: 00007FFDA34B1B1C
e, xrefs: 00007FFDA34B19CE
-, xrefs: 00007FFDA34B1C8B
5, xrefs: 00007FFDA34B1C73
o, xrefs: 00007FFDA34B1AA9
FcDfC, xrefs: 00007FFDA34B1746
e, xrefs: 00007FFDA34B1B94
m, xrefs: 00007FFDA34B17A6
7, xrefs: 00007FFDA34B1CEB
3, xrefs: 00007FFDA34B1CD3
v, xrefs: 00007FFDA34B1B8F
c, xrefs: 00007FFDA34B19BA
7, xrefs: 00007FFDA34B1D03
e, xrefs: 00007FFDA34B17CE
-, xrefs: 00007FFDA34B1CB3
e, xrefs: 00007FFDA34B1900
D, xrefs: 00007FFDA34B1910
o, xrefs: 00007FFDA34B1918
4, xrefs: 00007FFDA34B1C33
n, xrefs: 00007FFDA34B1713
i, xrefs: 00007FFDA34B1A40
EKPP, xrefs: 00007FFDA34B1D9F
o, xrefs: 00007FFDA34B17AE
6, xrefs: 00007FFDA34B1CA3
R, xrefs: 00007FFDA34B1B76
1, xrefs: 00007FFDA34B1CBB
o, xrefs: 00007FFDA34B19BF
r, xrefs: 00007FFDA34B1733
}, xrefs: 00007FFDA34B1D1B
t, xrefs: 00007FFDA34B17B6
c, xrefs: 00007FFDA34B19D3
i, xrefs: 00007FFDA34B16EB
l, xrefs: 00007FFDA34B16F3
8, xrefs: 00007FFDA34B1C93
KPP, xrefs: 00007FFDA34B1B29
t, xrefs: 00007FFDA34B17E6
A, xrefs: 00007FFDA34B1CC3
1, xrefs: 00007FFDA34B1C53
n, xrefs: 00007FFDA34B186D
A, xrefs: 00007FFDA34B1CAB
F, xrefs: 00007FFDA34B16E3
i, xrefs: 00007FFDA34B1863
REKPP, xrefs: 00007FFDA34B1BA6
o, xrefs: 00007FFDA34B1938
o, xrefs: 00007FFDA34B1886
k, xrefs: 00007FFDA34B18F8
>>//>>, xrefs: 00007FFDA34B1EFE
g, xrefs: 00007FFDA34B1AB3
k, xrefs: 00007FFDA34B17DE
n, xrefs: 00007FFDA34B19C4
n, xrefs: 00007FFDA34B1928
D, xrefs: 00007FFDA34B1C9B
4, xrefs: 00007FFDA34B1C6B
3, xrefs: 00007FFDA34B1C5B
F, xrefs: 00007FFDA34B1CF3
f, xrefs: 00007FFDA34B1881
n, xrefs: 00007FFDA34B1A45
t, xrefs: 00007FFDA34B1908
e, xrefs: 00007FFDA34B1B85
E, xrefs: 00007FFDA34B1CDB
SsR, xrefs: 00007FFDA34B195B
2, xrefs: 00007FFDA34B1D0B
2, xrefs: 00007FFDA34B1C23

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$type_info::_name_internal_method$Name$Concurrency::cancel_current_taskNodeNode::$Decorator::getTableType
String ID: -$-$-$-$0$0$1$1$2$2$3$3$3$3$3$4$4$4$5$5$6$7$7$7$8$>>//>>$A$A$B$C$D$D$D$D$DfC$E$EKPP$F$F$FcDfC$I$KPP$M$P$P$R$R$REKPP$SsR$a$a$a$c$c$c$d$d$e$e$e$e$e$e$e$e$e$e$e$f$g$g$g$i$i$i$i$k$k$l$l$l$l$m$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$p$r$r$s$t$t$t$t$t$v$w${wSsR$}
API String ID: 4012674335-2829735596
Opcode ID: e85dae151a44eb091defe35ba637c263de70e7b14c8f55e1bf6d3ceb456dbeab
Instruction ID: 336bec897270894ce28aa594649575924dd8bc3251e957f086a060aa84f8b7c9
Opcode Fuzzy Hash: e85dae151a44eb091defe35ba637c263de70e7b14c8f55e1bf6d3ceb456dbeab
Instruction Fuzzy Hash: D6826D2260E6C185EB31D724E4643EFAB92EBD5784F400036E6CD97B9BDEAEC504CB54

Function 00007FFDA34A3830 Relevance: 37.0, APIs: 5, Strings: 16, Instructions: 257COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A3899
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A3925
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A3987
GetLogicalDriveStringsA.KERNEL32 ref: 00007FFDA34A39EC
GetDriveTypeA.KERNEL32 ref: 00007FFDA34A3A7B

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

==>, xrefs: 00007FFDA34A3B0E
i, xrefs: 00007FFDA34A385E
o, xrefs: 00007FFDA34A38E3
a, xrefs: 00007FFDA34A38ED
v, xrefs: 00007FFDA34A38E8
e, xrefs: 00007FFDA34A38D9
R, xrefs: 00007FFDA34A38D4
F, xrefs: 00007FFDA34A3859
e, xrefs: 00007FFDA34A38FC
x, xrefs: 00007FFDA34A3863
l, xrefs: 00007FFDA34A38F7
d, xrefs: 00007FFDA34A386D
==>, xrefs: 00007FFDA34A3C56
e, xrefs: 00007FFDA34A3868
b, xrefs: 00007FFDA34A38F2
m, xrefs: 00007FFDA34A38DE

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Drive$LogicalStringsTypechar_traits
String ID: ==>$==>$F$R$a$b$d$e$e$e$i$l$m$o$v$x
API String ID: 3293995294-766430890
Opcode ID: 490619949d2f79f6bcc13f69530309b5a26baaa1be1e3715154f21850153d81e
Instruction ID: a781bb84484166f94cf314473b81a85a83a2f94d70868b4233237ba23f029205
Opcode Fuzzy Hash: 490619949d2f79f6bcc13f69530309b5a26baaa1be1e3715154f21850153d81e
Instruction Fuzzy Hash: 06D1283260EAC591DA70DB14E4603EBA762FBC5784F400136E6CD93BAAEEBDC545CB44

Function 00007FFDA34E03E8 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FFDA34E0436
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E0AA2
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E0C18
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E0ED6
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E10F6
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E1333
memcpy_s.LIBCPMT ref: 00007FFDA34E140E
memcpy_s.LIBCPMT ref: 00007FFDA34E14B9
memcpy_s.LIBCPMT ref: 00007FFDA34E1588

Strings

1#QNAN, xrefs: 00007FFDA34E054F
1#INF, xrefs: 00007FFDA34E055F
1#SNAN, xrefs: 00007FFDA34E0546
1#IND, xrefs: 00007FFDA34E0523

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: e12e97ca3a661d8159419231ea41b25cecad96e2787ffc5696d229e70e87b0d6
Instruction ID: 2957cbb3b39e48b2a92629ad414ce1cd4de5e3f7267b182bfb079e24a3e67c6b
Opcode Fuzzy Hash: e12e97ca3a661d8159419231ea41b25cecad96e2787ffc5696d229e70e87b0d6
Instruction Fuzzy Hash: 82B20572F192828BE7648F65D4607FC7BA2FB44348F601135DA1DA7B86DBBDA900CB44

Function 00007FFDA34E2500 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34E20E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E2125
Part of subcall function 00007FFDA34E20E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E21A3
Part of subcall function 00007FFDA34E20E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E21F4

CreateFileW.KERNEL32 ref: 00007FFDA34E2606
CreateFileW.KERNEL32 ref: 00007FFDA34E2656
GetLastError.KERNEL32 ref: 00007FFDA34E2686
GetFileType.KERNEL32 ref: 00007FFDA34E269B
GetLastError.KERNEL32 ref: 00007FFDA34E26A5
CloseHandle.KERNEL32 ref: 00007FFDA34E26D8
CloseHandle.KERNEL32 ref: 00007FFDA34E283B
CreateFileW.KERNEL32 ref: 00007FFDA34E2870
GetLastError.KERNEL32 ref: 00007FFDA34E287F

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 31f4d597e0a6cc1620dd34189c80ad889813dc24754eb01cce36e0114bd77507
Instruction ID: 4221a4fea999383377a046d333ddebf60b0cd00c7a3885456d6450d76875bae3
Opcode Fuzzy Hash: 31f4d597e0a6cc1620dd34189c80ad889813dc24754eb01cce36e0114bd77507
Instruction Fuzzy Hash: E2C1C137B25A4286EB10DF68D4A06AC3762FB49B98B104335DE2EA7396CF7AD455C304

Function 00007FFDA34DEE88 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

TranslateName.LIBCMT ref: 00007FFDA34DEEF2
TranslateName.LIBCMT ref: 00007FFDA34DEF2D
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FFDA34D2F90), ref: 00007FFDA34DEF74
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FFDA34D2F90), ref: 00007FFDA34DEFAC
GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DF169

Strings

utf8, xrefs: 00007FFDA34DF090

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 464451e8a7c017b7fe8d594a29d962222612a71da5a0740ad1618ad19dd93d6f
Instruction ID: f63726a5c05bc061a5d7a741b026dc9ff6778441b2271cbb144d738fd2239159
Opcode Fuzzy Hash: 464451e8a7c017b7fe8d594a29d962222612a71da5a0740ad1618ad19dd93d6f
Instruction Fuzzy Hash: 22919E33B0A74281EB649F21E5612B923A6FB44BC0F444536DA5CA7787DFBEE591C308

Function 00007FFDA34DF8D0 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D244D

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FFDA34DFA40

Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D247A
Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D248B
Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D249C

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FFDA34D2F89), ref: 00007FFDA34DFA27
ProcessCodePage.LIBCMT ref: 00007FFDA34DFA6A
IsValidCodePage.KERNEL32 ref: 00007FFDA34DFA7C
IsValidLocale.KERNEL32 ref: 00007FFDA34DFA92
GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DFAEE
GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DFB0A

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 6e470d9f2d7b73803100a9a2eb3339135561f8c11b01556d55fef5b7594b0bfb
Instruction ID: 6ee3bfcdb73d0751c8431ec58efa84f2f78fe03293a3893ef0f57d35b238935f
Opcode Fuzzy Hash: 6e470d9f2d7b73803100a9a2eb3339135561f8c11b01556d55fef5b7594b0bfb
Instruction Fuzzy Hash: 00716E33F0660299FB609B60D4617BC33A6AF44B84F444036CE0DA7796DFBEA945C718

Function 00007FFDA34A3530 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A35B8
FindFirstFileW.KERNEL32 ref: 00007FFDA34A35C8
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A372D
FindNextFileW.KERNEL32 ref: 00007FFDA34A37A9
FindClose.KERNEL32 ref: 00007FFDA34A37BC

Strings

/*.*, xrefs: 00007FFDA34A3588

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Find$File$CloseConcurrency::details::Concurrency::details::_CriticalEmptyFirstLock::_NextQueue::ReentrantScoped_lockScoped_lock::~_StructuredWork
String ID: /*.*
API String ID: 669816757-1014195128
Opcode ID: cce196c4780de0ee261d72a6a8be92af0337c90a253831200769ab8a909ca2ff
Instruction ID: 08be2c281efaeb016c0f70ba6d802a29832d52335b9c1b4b6de4709e80864360
Opcode Fuzzy Hash: cce196c4780de0ee261d72a6a8be92af0337c90a253831200769ab8a909ca2ff
Instruction Fuzzy Hash: AF715032A0EAC291DA70DB14E4613EEA361FBC4780F405532E68DD3BAAEF6DD545CB04

Function 00007FFDA34A3250 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A32D8
FindFirstFileW.KERNEL32 ref: 00007FFDA34A32E8
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A343A
FindNextFileW.KERNEL32 ref: 00007FFDA34A34B6
FindClose.KERNEL32 ref: 00007FFDA34A34C9

Part of subcall function 00007FFDA34A6340: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A63C7

Strings

/*.*, xrefs: 00007FFDA34A32A8

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Find$Concurrency::details::EmptyFileQueue::StructuredWork$CloseConcurrency::details::_CriticalFirstLock::_NextReentrantScoped_lockScoped_lock::~_
String ID: /*.*
API String ID: 771618737-1014195128
Opcode ID: 417e3439b01502627f2c3f68e797be1636a0383c23f555452f6b9c8aeea56bb4
Instruction ID: 00a23e70e961c213e6a81e284e3da387f936b41a65222caa9d02446540fcc48f
Opcode Fuzzy Hash: 417e3439b01502627f2c3f68e797be1636a0383c23f555452f6b9c8aeea56bb4
Instruction Fuzzy Hash: 74612C32A0EAC292D660DB14F4A13EEA361FBC4780F405532E69D93BAADF6DD544CB04

Function 00007FFDA34C40A0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA34C40BC
RtlCaptureContext.KERNEL32 ref: 00007FFDA34C40E9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA34C4103
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA34C4144
IsDebuggerPresent.KERNEL32 ref: 00007FFDA34C4198
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C41B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C41C0

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1fdbbc56d82b575a71ab0e7532a7e43e535db65f2d0fd3c01a85fe32ae7de389
Instruction ID: 759ffcdb70b4b0b041a7811beb8b14c3bb9d5dbccc326112a1b5b4c923f59785
Opcode Fuzzy Hash: 1fdbbc56d82b575a71ab0e7532a7e43e535db65f2d0fd3c01a85fe32ae7de389
Instruction Fuzzy Hash: 4E318F7270AB8186EB608F65E8503ED3361FB84744F50443ADB4E97B9ADF79C548CB04

Function 00007FFDA34C9238 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDA34C92B1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA34C92C9
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA34C9304
IsDebuggerPresent.KERNEL32 ref: 00007FFDA34C933D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C9347
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C9352

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 1300e7eb66910485c596afe65c521b45d2f063167b9c5b78a57fe06e37c487e2
Instruction ID: b3f8b129a9e9693b672e705a40e0b37200984a6e1010ce5c5b052f232f991c69
Opcode Fuzzy Hash: 1300e7eb66910485c596afe65c521b45d2f063167b9c5b78a57fe06e37c487e2
Instruction Fuzzy Hash: 77318032719B8186EB60CF29E8502EE33A5FB88754F500135EA9D93BAADF7DC545CB04

Function 00007FFDA34883E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BADD7), ref: 00007FFDA34883FF
GetProcAddress.KERNEL32 ref: 00007FFDA3488425
FreeLibrary.KERNEL32 ref: 00007FFDA348843D

Strings

send, xrefs: 00007FFDA3488419
ws2_32.dll, xrefs: 00007FFDA34883F8

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: send$ws2_32.dll
API String ID: 145871493-892776409
Opcode ID: c72203c53a645444ab5a65247ba5a24b2c4a71c4cc6107fc3a1fdc2c7bd87a1a
Instruction ID: e22c6cdafc4035790fa7306b1aba77462b06ce57dd63942a6981acaf5060e7a9
Opcode Fuzzy Hash: c72203c53a645444ab5a65247ba5a24b2c4a71c4cc6107fc3a1fdc2c7bd87a1a
Instruction Fuzzy Hash: 81011B76A1DB41C6D720CB14F45022AB7A1FB88BA4F500235FA8D93BA9DFBDD5948F04

Function 00007FFDA34C41E8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDA34C4214
GetCurrentThreadId.KERNEL32 ref: 00007FFDA34C4222
GetCurrentProcessId.KERNEL32 ref: 00007FFDA34C422E
QueryPerformanceCounter.KERNEL32 ref: 00007FFDA34C423E

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9ec5600b05cd82a8e10f8fc1781d40101dc96b0f7a75fb69ad6eecb34d5e0eaa
Instruction ID: b517fd4e4ba6c70d484acbff46fdfc63dd848f5b53adff3f5cb17d668341b6a6
Opcode Fuzzy Hash: 9ec5600b05cd82a8e10f8fc1781d40101dc96b0f7a75fb69ad6eecb34d5e0eaa
Instruction Fuzzy Hash: 7D117C32B15F018AEB00CF74E8652B833A4FB59758F041E35EA2D967A9DF79D194C340

Function 00007FFDA34D0310 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFDA34D0376
memcpy_s.LIBCPMT ref: 00007FFDA34D03A1

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 8101bab96facb9530bfb020494a0e1e968264cdbe7156957248635d7c5768935
Instruction ID: 6b538dfc22a0ad5091fb5fa874c454dd099a9a18e6a4c6a188eea48d4f447d2e
Opcode Fuzzy Hash: 8101bab96facb9530bfb020494a0e1e968264cdbe7156957248635d7c5768935
Instruction Fuzzy Hash: C8C1F373B1A28687E724CF19A0546AAFB92F784BC4F448134DB4E97745DB7EE800CB44

Function 00007FFDA34DF34C Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D244D

GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DF3B8

Part of subcall function 00007FFDA34DB690: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34DB6AD

GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DF401

Part of subcall function 00007FFDA34DB690: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34DB706

GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DF4C9

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: c48819b180904961f1f32d5462f44575ad073186aa2b6a60f47a47cf0137d1b3
Instruction ID: acc757a73d76a46e0b5259587a918f1d815d9cbd6285cf62f9bbb23b08da3334
Opcode Fuzzy Hash: c48819b180904961f1f32d5462f44575ad073186aa2b6a60f47a47cf0137d1b3
Instruction Fuzzy Hash: E5618C33B0A54286EB748F15E5602B963A2FB94784F408136CB9EE3796DFBEE4518704

Function 00007FFDA34D44C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FFDA34D3162), ref: 00007FFDA34D4538

Strings

GetLocaleInfoEx, xrefs: 00007FFDA34D44E0, 00007FFDA34D44F1

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: b69c55550dd8372e8f3bd53483b63269a9f729ff5fd4a9f23643f3f3a475a0a7
Instruction ID: b08b0151c6bad353aad7af0f609385b78ae088920d7eb1ace752dc10560a233f
Opcode Fuzzy Hash: b69c55550dd8372e8f3bd53483b63269a9f729ff5fd4a9f23643f3f3a475a0a7
Instruction Fuzzy Hash: 91012B31F0978185EB408B46B4100A6A7A2FF88FC0F584031DF0DA3B57CE7DD5548744

Function 00007FFDA34D9B1C Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFDA34D9D6B
RaiseException.KERNEL32 ref: 00007FFDA34D9D7C

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: cb08b8b98451d329f1216890254e8639781e64dd0602fbbd80406a2a0687eaf2
Instruction ID: 9e9bf8100731984bc9e6fba9f155fc71cb3f959f8bb201e0dfef6a701b5b3766
Opcode Fuzzy Hash: cb08b8b98451d329f1216890254e8639781e64dd0602fbbd80406a2a0687eaf2
Instruction Fuzzy Hash: BEB17A73605B848BEB19CF29C8963683BE1F784B88F148922DB5DC37A9CB7AD451C704

Function 00007FFDA34D5478 Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

e+000, xrefs: 00007FFDA34D5585
gfff, xrefs: 00007FFDA34D5602

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: ffd28e6c5c02c45a7b5b9001791b3dc5886d0b4c2c5e967d0dbd740f28f2cdbe
Instruction ID: aa5020136a6505dee81829df37e337584295119ef99d4f740f16d59e960983fb
Opcode Fuzzy Hash: ffd28e6c5c02c45a7b5b9001791b3dc5886d0b4c2c5e967d0dbd740f28f2cdbe
Instruction Fuzzy Hash: 71518763B192C147E7618E39A8207696B93E744BD0F488271CBAC8BBD6CFBED0018704

Function 00007FFDA34CFA40 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FFDA34CFB88

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 6bfd4f3a0bf9b5e35434d6109a361d930ff9e45c5dbcbe01b59c693bca66bdb6
Instruction ID: 56f8f1a54bbc61cc0a7ae92b664c29c92f993c9a3243a3655948006b1754482a
Opcode Fuzzy Hash: 6bfd4f3a0bf9b5e35434d6109a361d930ff9e45c5dbcbe01b59c693bca66bdb6
Instruction Fuzzy Hash: E212AE33A09BC186E752CF2894252F973A5FB59748F059236EB8D92753EF7AE184C304

Function 00007FFDA34DD680 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b382c4507d1edf34b785a1e02c16715189adb29d69b0d4dba2ef1785cd887c3
Instruction ID: 36919e379b3fe92a565ce68e8cd7a76d906e33bc3bbd5d8ab8536deba7ed4de1
Opcode Fuzzy Hash: 6b382c4507d1edf34b785a1e02c16715189adb29d69b0d4dba2ef1785cd887c3
Instruction Fuzzy Hash: 0AE16033B05B8186E720DB61E4512EA67A5FB95BC8F008531DB8DA3796EF7DD245C304

Function 00007FFDA34DBC74 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50aed87eef68f79266f6e6f4283b1da05f0d1b012dd98c2ba34c9db35ce9c7d
Instruction ID: 3f491f49a05d6d8a3e20686a9d84110877d9d5262517bdaa5372593450ee2959
Opcode Fuzzy Hash: c50aed87eef68f79266f6e6f4283b1da05f0d1b012dd98c2ba34c9db35ce9c7d
Instruction Fuzzy Hash: 1951F523B0978185FB109B76A8506AE7BA6FB44BD4F144238EE5CB7B9ACE7DD401C704

Function 00007FFDA34DF594 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D244D

GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DF5FC

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 612a9204371c78f22ca7deba1f8129528e6bafacea7c20a8cc21ea31929da954
Instruction ID: a2342d0c4901becf1e74750e8e421912f3b8be1d9e85633ccf784987d7d397f0
Opcode Fuzzy Hash: 612a9204371c78f22ca7deba1f8129528e6bafacea7c20a8cc21ea31929da954
Instruction Fuzzy Hash: FA31A433B0968246EB648B21E4617AA7392FB847C4F448035DA4DD3BA7DF7DE4428704

Function 00007FFDA34DF1E4 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDA34DF9D3,?,00000000,00000092,?,?,00000000,?,00007FFDA34D2F89), ref: 00007FFDA34DF282

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 7b55d7e7a37fe749f6c74a2d212c2c7cb41baea0870bc8e2bf6a4b600ee84061
Instruction ID: 7643f3178afb7c5e01a800279c2035f0fc655cc1109b3f5c31ed0d64be456bab
Opcode Fuzzy Hash: 7b55d7e7a37fe749f6c74a2d212c2c7cb41baea0870bc8e2bf6a4b600ee84061
Instruction Fuzzy Hash: 61112767F0964586EB248F55D0502B877A2F790BE0F444132CA29933C1DABAD5D1C700

Function 00007FFDA34DF79C Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

GetLocaleInfoW.KERNEL32(?,?,?,00007FFDA34DF546), ref: 00007FFDA34DF7D3

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 90b648d9eea99e32473642e310b728a41b7a43989c6c3debb278290af27b6ee3
Instruction ID: fb13d11b09bf7b2328462b3fea8385884df14989d2bc0b5f592353e5adf24538
Opcode Fuzzy Hash: 90b648d9eea99e32473642e310b728a41b7a43989c6c3debb278290af27b6ee3
Instruction Fuzzy Hash: 8A115733F1955243EB788725E060B7A6292EB40794F544232EA2DE37C6DF6BE8928304

Function 00007FFDA34DF2B4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDA34DF98F,?,00000000,00000092,?,?,00000000,?,00007FFDA34D2F89), ref: 00007FFDA34DF332

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 204dd6ae1cd5eee430f5dba8dfa2ed3c28fbfb011178cd42bd1cad3b11adec73
Instruction ID: c15a362e72feb762a11e7caed7ec7edf59d0695e57ef7c1f2ed5fa5c1f7ff85e
Opcode Fuzzy Hash: 204dd6ae1cd5eee430f5dba8dfa2ed3c28fbfb011178cd42bd1cad3b11adec73
Instruction Fuzzy Hash: 6F01F573F0928146E7644F16F5607B976D3EB447E0F458232C629977C6CFAA98818704

Function 00007FFDA34D40D8 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FFDA34D4493,?,?,?,?,?,?,?,?,00000000,00007FFDA34DE834), ref: 00007FFDA34D4127

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 4e1681deb3ae625eb10517da4b04623cc88c87d5d74a99c275469e2c03469948
Instruction ID: 585637b3e59e823f6fbad3cf238d7353cc940fb2b2a236203daa395ed29fba2f
Opcode Fuzzy Hash: 4e1681deb3ae625eb10517da4b04623cc88c87d5d74a99c275469e2c03469948
Instruction Fuzzy Hash: AFF03172705B4186E704DB29F8A11A92362EB99B80F548035EA4D9336ADE3ED451C708

Function 00007FFDA34D4FE4 Relevance: 1.5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 00007FFDA34D5326

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 9eb11a5139b860ec689106c531227738ed5de37a15a15e703f0ba588c082e3c9
Instruction ID: ef7945a1eb7abce3c93118f02f11265dfb39c6006b6abccb11049061bcd420a6
Opcode Fuzzy Hash: 9eb11a5139b860ec689106c531227738ed5de37a15a15e703f0ba588c082e3c9
Instruction Fuzzy Hash: E8A15563B0A7C587EB21CB29A4207AE7792AB51BC4F048172DA8D97782DFBED505C701

Function 00007FFDA34CA840 Relevance: 1.5, Strings: 1, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00007FFDA34CAA4A

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0d56e185a6f5c393efdfe29e65eb388ef1e3e89cc9312fdd40847f5c21c96711
Instruction ID: 4f5e486a56a27e1ee07d3e80d448671c0fa2ba44065c40cdd9f39f112a0eb269
Opcode Fuzzy Hash: 0d56e185a6f5c393efdfe29e65eb388ef1e3e89cc9312fdd40847f5c21c96711
Instruction Fuzzy Hash: 1FB1AE72B0A78185E7648F3DC06127D7BA2EB45B48F194135CB4EA739ADFBAD840C718

Function 00007FFDA34CABD8 Relevance: 1.5, Strings: 1, Instructions: 247COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00007FFDA34CADB4

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6e1565131a72630e28cd35d5a7a422671125bf8fca0ecded1d184da54ae6dca5
Instruction ID: 5e47d93c464d6aeacab19c9718562ddef5648e40e7551124de81050cacd9fb7e
Opcode Fuzzy Hash: 6e1565131a72630e28cd35d5a7a422671125bf8fca0ecded1d184da54ae6dca5
Instruction Fuzzy Hash: FDB18E72A0AB4586E765CF2DC06027C3BA2EB49F48F284135CB4E97396DF7AD841C749

Function 00007FFDA34DACC4 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDA34DAD69

Part of subcall function 00007FFDA34D3FEC: HeapAlloc.KERNEL32(?,?,00000000,00007FFDA34D25E2,?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000), ref: 00007FFDA34D4041

Part of subcall function 00007FFDA34D4064: HeapFree.KERNEL32(?,?,00000000,00007FFDA34DDF0E,?,?,?,00007FFDA34DE28B,?,?,00000000,00007FFDA34DD3BD,?,?,?,00007FFDA34DD2EF), ref: 00007FFDA34D407A
Part of subcall function 00007FFDA34D4064: GetLastError.KERNEL32(?,?,00000000,00007FFDA34DDF0E,?,?,?,00007FFDA34DE28B,?,?,00000000,00007FFDA34DD3BD,?,?,?,00007FFDA34DD2EF), ref: 00007FFDA34D4084

Part of subcall function 00007FFDA34E2DD8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E2E0B

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: d512d9b99f61f478c9dd67fde5bf6bd50aa0a62c88787923826a81cf53a83db8
Instruction ID: 45f6ec238ffb7dfcbf35742ec871958899335d71a815faadec67c9551bffd408
Opcode Fuzzy Hash: d512d9b99f61f478c9dd67fde5bf6bd50aa0a62c88787923826a81cf53a83db8
Instruction Fuzzy Hash: 6D41A523F0A74341EA619A266461BBAA2937F85BC0F444135EE5DA7787DEBEE4018608

Function 00007FFDA34DD000 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFDA34DD004

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 69adad11b75528e173244cf05b58ffaf7a7f9aff53e86366b35c1d5acc58023b
Instruction ID: 39c2ba7c68d39e5b1b2ebc53cbde962f29f470d7ea016b780d75ff143c841556
Opcode Fuzzy Hash: 69adad11b75528e173244cf05b58ffaf7a7f9aff53e86366b35c1d5acc58023b
Instruction Fuzzy Hash: 59B09224F27B02C6EA092B15AC9222462E67F48B00F954438C88CA1325DF2E20E54B04

Function 00007FFDA34CB26C Relevance: .4, Instructions: 351COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad28b59e3dbe68954b82f201316b4cdfd6c440b27104c11c395bfb58901ff097
Instruction ID: e65eafae76ceb82cc730e487dc11f118db4dfd70014062b9c1aa1dc320ef01f9
Opcode Fuzzy Hash: ad28b59e3dbe68954b82f201316b4cdfd6c440b27104c11c395bfb58901ff097
Instruction Fuzzy Hash: D1E1A132B0964287EB648A2EC57437D2793AB45B58F144235CE4DA77E7CFBAE841C708

Function 00007FFDA34CB6A4 Relevance: .3, Instructions: 327COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391f715d3d191edc86a31a9a08a08798222532380929de8cf233e3c6661f7760
Instruction ID: 66478b8c17c6b0be02b6db358f5a26fb6fcc215951a0a1901e7d76b855d71241
Opcode Fuzzy Hash: 391f715d3d191edc86a31a9a08a08798222532380929de8cf233e3c6661f7760
Instruction Fuzzy Hash: E8D1B526B0A64287EB688E2F857027D77A2EF05B48F144135CE4DA7796CFBBD841C748

Function 00007FFDA34D2DD8 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 03c96eefac53fecb16332d4fe778c5908cc7685ab83fd7ba0e40df9a2ba7ef57
Instruction ID: f4fd1d8e5bb5c147b1febeed2f2ec0658435fe5689109e8d326d861267a83a53
Opcode Fuzzy Hash: 03c96eefac53fecb16332d4fe778c5908cc7685ab83fd7ba0e40df9a2ba7ef57
Instruction Fuzzy Hash: A1C1D727B0968245EB609B61D8203BE67A2FB94BC8F404035EE4DE779ADFBED545C304

Function 00007FFDA34DE8F8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 4e4624929bb0779aac866043fe9095ab607f6aa03735a5caac00b095881373a4
Instruction ID: 08f58d224ad9b3c29d8140e05030657316e7e6d1295fa4c6795c8c7745bdc493
Opcode Fuzzy Hash: 4e4624929bb0779aac866043fe9095ab607f6aa03735a5caac00b095881373a4
Instruction Fuzzy Hash: 3FB1A323B1A64682EB64DF21D5216B92392FB44BC8F044131DA5AE37CADFBEE581C744

Function 00007FFDA34CF694 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6bb6e613accf3856864cd71ac29d1423caa4528c7ad06f46eb6abe103eafa424
Instruction ID: 4fb2e6e44d6744879261189efca5bcc43f981c78743a823fe631b2e06b723395
Opcode Fuzzy Hash: 6bb6e613accf3856864cd71ac29d1423caa4528c7ad06f46eb6abe103eafa424
Instruction Fuzzy Hash: 0781A272B06A1286EB64CF29D4A137D2361FB44BD8F048636EE1EA7796CF7ED4418704

Function 00007FFDA34D5AF8 Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d7210e4d54181cb0b2b73f2c9f49a88c8a056fd04e2009e77447b2d656a869
Instruction ID: 369640af19087079be654dfd4b89e09d34b3a4747ac83fd1dc2f50d9c563a708
Opcode Fuzzy Hash: f6d7210e4d54181cb0b2b73f2c9f49a88c8a056fd04e2009e77447b2d656a869
Instruction Fuzzy Hash: BC81F273B0978187EBB4CB19906437A7A92FB457D4F108275DA8E97B8ACF7ED4008B04

Function 00007FFDA34E1E64 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa3c348ed9be85e164c530600c7f89b58dd1911d92c2e2fc2ba9024f1b7ab6af
Instruction ID: f35686dc355b84c8648c176aad44dfa8277789eedf3b76c3eeac892f21eb422e
Opcode Fuzzy Hash: aa3c348ed9be85e164c530600c7f89b58dd1911d92c2e2fc2ba9024f1b7ab6af
Instruction Fuzzy Hash: 0461D622F1A28246F7689A28D4706B96693AF40770F240235D71DE27C7DFBFE840C749

Function 00007FFDA34CA0E0 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 3f8dd59e285e7258a85cc526b69259ab53cf29e87ae81ae280c20ea9030e4fe1
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 7F518036B1A76186E7248B2DC06427837A2EB45B58F244131CE4DA7796CFBBEC52C784

Function 00007FFDA34C9EDC Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 5303517a1606d82630fa06d6e3ad17be8a94c43585b16bde0302691d6347721e
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: AB519336B1AA5186E7648F2DC06023837A2EB45B98F244131DE4DA7796CF7BEC53C748

Function 00007FFDA34C9CD8 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: c0f50570e519736bd5b7c6aaceab2206f0cc69cb6b1129f4dab9a429e37ba77e
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: F151D332B1A65192E7648B2DC06063837A2EB55F58F244131CE4CB77A6CF7BE842C788

Function 00007FFDA34D1958 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bcadb0f65099c0efc5460ce4e314de804ec4df621e58b7dde1e8fb267b46e287
Instruction ID: 2961352f615766a8b1a0f21d60e47bfefbd78cc3b7edd55b25a90fe87e2f46b6
Opcode Fuzzy Hash: bcadb0f65099c0efc5460ce4e314de804ec4df621e58b7dde1e8fb267b46e287
Instruction Fuzzy Hash: 9F410633715A5486EF48CF2AD9241A97392F748FC0B499036EE0DA7B59DE7ED441C304

Function 00007FFDA34E4F90 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefa92ed17a17b3685cc36cac0f6a443215e38dbe71faa2ba466a38d0bc98af5
Instruction ID: 866555e6e14d1150b6273d5b68206a108740d384202fe7686c5cbe58fb06be4f
Opcode Fuzzy Hash: fefa92ed17a17b3685cc36cac0f6a443215e38dbe71faa2ba466a38d0bc98af5
Instruction Fuzzy Hash: 3EF06871B1A2558FEB958F2DA45262977E1E708380F508439E5CD93B48D63E9450CF08

Function 00007FFDA34B9EF0 Relevance: 189.3, APIs: 3, Strings: 105, Instructions: 349COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34BA10D
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34BA275
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34BA3C9

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Part of subcall function 00007FFDA34BEE30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEE90

Part of subcall function 00007FFDA34920D0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34920E3

Part of subcall function 00007FFDA34831C0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 00007FFDA34831F3
Part of subcall function 00007FFDA34831C0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 00007FFDA348320D
Part of subcall function 00007FFDA34831C0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 00007FFDA3483239

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34917F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491803

Strings

J, xrefs: 00007FFDA34BA372
e, xrefs: 00007FFDA34BA2C8
V, xrefs: 00007FFDA34B9F9D
M, xrefs: 00007FFDA34BA246
B, xrefs: 00007FFDA34BA1FB
k, xrefs: 00007FFDA34BA2CD
t, xrefs: 00007FFDA34B9FED
k, xrefs: 00007FFDA34BA2D2
Z, xrefs: 00007FFDA34BA02D
0, xrefs: 00007FFDA34B9FE5
R, xrefs: 00007FFDA34BA35E
=, xrefs: 00007FFDA34BA0D5
Z, xrefs: 00007FFDA34BA241
Z, xrefs: 00007FFDA34BA2DC
n, xrefs: 00007FFDA34BA34A
3, xrefs: 00007FFDA34BA2F0
4, xrefs: 00007FFDA34BA23C
V, xrefs: 00007FFDA34B9FBD
a, xrefs: 00007FFDA34BA0BD
J, xrefs: 00007FFDA34BA0B5
k, xrefs: 00007FFDA34BA20A
I, xrefs: 00007FFDA34B9FD5
L, xrefs: 00007FFDA34BA075
Z, xrefs: 00007FFDA34B9F8D
E, xrefs: 00007FFDA34BA309
m, xrefs: 00007FFDA34BA363
X, xrefs: 00007FFDA34B9F85
2, xrefs: 00007FFDA34BA2FF
W, xrefs: 00007FFDA34BA2F5
t, xrefs: 00007FFDA34BA313
5, xrefs: 00007FFDA34BA36D
Z, xrefs: 00007FFDA34BA08D
Q, xrefs: 00007FFDA34BA38B
=, xrefs: 00007FFDA34BA39A
e, xrefs: 00007FFDA34BA03D
z, xrefs: 00007FFDA34BA232
d, xrefs: 00007FFDA34BA2EB
F, xrefs: 00007FFDA34BA2D7
R, xrefs: 00007FFDA34B9FAD
j, xrefs: 00007FFDA34B9FA5
1, xrefs: 00007FFDA34BA37C
Z, xrefs: 00007FFDA34BA055
J, xrefs: 00007FFDA34BA04D
9, xrefs: 00007FFDA34BA20F
c, xrefs: 00007FFDA34BA05D
/**/, xrefs: 00007FFDA34BA591
V, xrefs: 00007FFDA34BA085
V, xrefs: 00007FFDA34BA01D
,, xrefs: 00007FFDA34BA237
x, xrefs: 00007FFDA34BA205
7, xrefs: 00007FFDA34BA340
N, xrefs: 00007FFDA34BA035
R, xrefs: 00007FFDA34B9FFD
O, xrefs: 00007FFDA34BA200
D, xrefs: 00007FFDA34BA31D
0, xrefs: 00007FFDA34BA2E6
A, xrefs: 00007FFDA34BA331
T, xrefs: 00007FFDA34BA09D
Z, xrefs: 00007FFDA34BA07D
1, xrefs: 00007FFDA34BA095
s, xrefs: 00007FFDA34BA2C3
6, xrefs: 00007FFDA34BA322
5, xrefs: 00007FFDA34BA34F
i, xrefs: 00007FFDA34BA2FA
Z, xrefs: 00007FFDA34BA368
o, xrefs: 00007FFDA34BA015
N, xrefs: 00007FFDA34B9FB5
k, xrefs: 00007FFDA34BA33B
N, xrefs: 00007FFDA34BA390
N, xrefs: 00007FFDA34BA354
q, xrefs: 00007FFDA34BA214
U, xrefs: 00007FFDA34BA345
q, xrefs: 00007FFDA34B9F95
U, xrefs: 00007FFDA34BA395
a, xrefs: 00007FFDA34BA327
2, xrefs: 00007FFDA34BA0C5
n, xrefs: 00007FFDA34BA336
a, xrefs: 00007FFDA34BA21E
N, xrefs: 00007FFDA34BA00D
3, xrefs: 00007FFDA34BA2E1
N, xrefs: 00007FFDA34B9FCD
S, xrefs: 00007FFDA34B9FDD
h, xrefs: 00007FFDA34BA0AD
g, xrefs: 00007FFDA34BA22D
6, xrefs: 00007FFDA34BA359
D, xrefs: 00007FFDA34BA304
e, xrefs: 00007FFDA34BA381
U, xrefs: 00007FFDA34BA045
H, xrefs: 00007FFDA34BA005
T, xrefs: 00007FFDA34BA065
I, xrefs: 00007FFDA34BA223
U, xrefs: 00007FFDA34BA228
e, xrefs: 00007FFDA34BA386
6, xrefs: 00007FFDA34BA377
R, xrefs: 00007FFDA34BA219
2, xrefs: 00007FFDA34B9FF5
V, xrefs: 00007FFDA34BA06D
E, xrefs: 00007FFDA34BA32C
c, xrefs: 00007FFDA34BA30E
n, xrefs: 00007FFDA34BA0A5
n, xrefs: 00007FFDA34B9FC5
0, xrefs: 00007FFDA34BA0CD
R, xrefs: 00007FFDA34B9F7D
m, xrefs: 00007FFDA34BA025
m, xrefs: 00007FFDA34BA318

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::$Fac_nodeFac_node::_Factory::FreeProxyRetireThreadstd::_$Decorator::getEmptyQueue::StructuredTableTypeWork$char_traits
String ID: ,$/**/$0$0$0$1$1$2$2$2$3$3$4$5$5$6$6$6$7$9$=$=$A$B$D$D$E$E$F$H$I$I$J$J$J$L$M$N$N$N$N$N$N$O$Q$R$R$R$R$R$S$T$T$U$U$U$U$V$V$V$V$V$W$X$Z$Z$Z$Z$Z$Z$Z$Z$a$a$a$c$c$d$e$e$e$e$g$h$i$j$k$k$k$k$m$m$m$n$n$n$n$o$q$q$s$t$t$x$z
API String ID: 1768506830-3784889792
Opcode ID: ed4ddddc12d98e72ae5fe04b24863b89c5ffce575c5e63bf3c35c8c8b54d9598
Instruction ID: c7cb5f27a96057ffed64e1ef74c154076ba60fb9e3280debfa0dc3e272d0ffef
Opcode Fuzzy Hash: ed4ddddc12d98e72ae5fe04b24863b89c5ffce575c5e63bf3c35c8c8b54d9598
Instruction Fuzzy Hash: 4412122220EBC185E772D728E4643DBABA1E7D2744F444026E2CC47B9BDFAEC548CB15

Function 00007FFDA34A97B0 Relevance: 98.2, APIs: 9, Strings: 47, Instructions: 229registryCOMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A98E1
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A998F
RegOpenKeyExA.ADVAPI32 ref: 00007FFDA34A99B4
RegEnumKeyExA.ADVAPI32 ref: 00007FFDA34A9A6D
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A9AE3
RegOpenKeyExA.ADVAPI32 ref: 00007FFDA34A9B08
RegQueryValueExA.ADVAPI32 ref: 00007FFDA34A9B5C
RegCloseKey.ADVAPI32 ref: 00007FFDA34A9BF5
RegCloseKey.ADVAPI32 ref: 00007FFDA34A9C2C

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

S, xrefs: 00007FFDA34A97D4
u, xrefs: 00007FFDA34A9842
r, xrefs: 00007FFDA34A9847
d, xrefs: 00007FFDA34A989C
e, xrefs: 00007FFDA34A98A1
t, xrefs: 00007FFDA34A9829
displayName, xrefs: 00007FFDA34A9B4D
y, xrefs: 00007FFDA34A9856
v, xrefs: 00007FFDA34A9892
W, xrefs: 00007FFDA34A97E8
F, xrefs: 00007FFDA34A97DE
i, xrefs: 00007FFDA34A9806
A, xrefs: 00007FFDA34A98B0
n, xrefs: 00007FFDA34A986A
f, xrefs: 00007FFDA34A9824
R, xrefs: 00007FFDA34A97F2
A, xrefs: 00007FFDA34A97ED
T, xrefs: 00007FFDA34A97E3
r, xrefs: 00007FFDA34A9810
, xrefs: 00007FFDA34A985B
M, xrefs: 00007FFDA34A9801
\, xrefs: 00007FFDA34A982E
o, xrefs: 00007FFDA34A9815
e, xrefs: 00007FFDA34A9874
E, xrefs: 00007FFDA34A97F7
e, xrefs: 00007FFDA34A9838
O, xrefs: 00007FFDA34A97D9
P, xrefs: 00007FFDA34A9883
i, xrefs: 00007FFDA34A9897
i, xrefs: 00007FFDA34A984C
\, xrefs: 00007FFDA34A987E
r, xrefs: 00007FFDA34A9888
t, xrefs: 00007FFDA34A9851
s, xrefs: 00007FFDA34A981A
C, xrefs: 00007FFDA34A9860
v, xrefs: 00007FFDA34A98B5
\, xrefs: 00007FFDA34A98AB
o, xrefs: 00007FFDA34A988D
t, xrefs: 00007FFDA34A986F
o, xrefs: 00007FFDA34A981F
\, xrefs: 00007FFDA34A97FC
S, xrefs: 00007FFDA34A9833
r, xrefs: 00007FFDA34A98A6
e, xrefs: 00007FFDA34A9865
r, xrefs: 00007FFDA34A9879
c, xrefs: 00007FFDA34A983D
c, xrefs: 00007FFDA34A980B

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CloseConcurrency::details::EmptyOpenQueue::StructuredWork$EnumFac_nodeFac_node::_QueryValuechar_traitsstd::_
String ID: $A$A$C$E$F$M$O$P$R$S$S$T$W$\$\$\$\$c$c$d$displayName$e$e$e$e$f$i$i$i$n$o$o$o$r$r$r$r$r$s$t$t$t$u$v$v$y
API String ID: 1441156695-1915070847
Opcode ID: e4361326d0e3c8bc700f733f902279f19f363e10ede73ef7b9bac91b2170a774
Instruction ID: 35055f7304c524a11153f64fb0df9d43a3b9e9906e3402091b716a6fe59b230b
Opcode Fuzzy Hash: e4361326d0e3c8bc700f733f902279f19f363e10ede73ef7b9bac91b2170a774
Instruction Fuzzy Hash: 6BC1282260DAC186E721DB24E4543EBBBA1E7D1344F404126E3CC97BAADFBED548CB54

Function 00007FFDA34A91E0 Relevance: 94.7, APIs: 8, Strings: 46, Instructions: 217registryCOMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A9348

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A93BE
RegOpenKeyA.ADVAPI32 ref: 00007FFDA34A93D2
RegQueryValueExA.ADVAPI32 ref: 00007FFDA34A943C
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34A945A
RegQueryValueExA.ADVAPI32 ref: 00007FFDA34A948B
RegCloseKey.ADVAPI32 ref: 00007FFDA34A949E
RegCloseKey.ADVAPI32 ref: 00007FFDA34A954B

Part of subcall function 00007FFDA348FE90: char_traits.LIBCPMTD ref: 00007FFDA348FEC2
Part of subcall function 00007FFDA348FE90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA348FEFE

Strings

i, xrefs: 00007FFDA34A92A9
s, xrefs: 00007FFDA34A930D
r, xrefs: 00007FFDA34A9281
e, xrefs: 00007FFDA34A9303
n, xrefs: 00007FFDA34A92AE
r, xrefs: 00007FFDA34A92EA
S, xrefs: 00007FFDA34A9245
CurrentBuild, xrefs: 00007FFDA34A947F
n, xrefs: 00007FFDA34A931C
n, xrefs: 00007FFDA34A92F4
w, xrefs: 00007FFDA34A92BD
o, xrefs: 00007FFDA34A9286
s, xrefs: 00007FFDA34A92C2
r, xrefs: 00007FFDA34A92E5
e, xrefs: 00007FFDA34A92EF
f, xrefs: 00007FFDA34A9295
R, xrefs: 00007FFDA34A9263
T, xrefs: 00007FFDA34A9254
\, xrefs: 00007FFDA34A929F
d, xrefs: 00007FFDA34A92B3
N, xrefs: 00007FFDA34A92CC
\, xrefs: 00007FFDA34A926D
C, xrefs: 00007FFDA34A92DB
s, xrefs: 00007FFDA34A928B
\, xrefs: 00007FFDA34A92D6
u, xrefs: 00007FFDA34A92E0
W, xrefs: 00007FFDA34A92A4
o, xrefs: 00007FFDA34A92B8
r, xrefs: 00007FFDA34A9308
V, xrefs: 00007FFDA34A92FE
t, xrefs: 00007FFDA34A92F9
M, xrefs: 00007FFDA34A9272
i, xrefs: 00007FFDA34A9312
E, xrefs: 00007FFDA34A9268
, xrefs: 00007FFDA34A92C7
o, xrefs: 00007FFDA34A9290
t, xrefs: 00007FFDA34A929A
o, xrefs: 00007FFDA34A9317
c, xrefs: 00007FFDA34A927C
i, xrefs: 00007FFDA34A9277
W, xrefs: 00007FFDA34A9259
ProductName, xrefs: 00007FFDA34A9430
T, xrefs: 00007FFDA34A92D1
O, xrefs: 00007FFDA34A924A
A, xrefs: 00007FFDA34A925E
F, xrefs: 00007FFDA34A924F

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CloseConcurrency::details::EmptyQueryQueue::StructuredValueWork$Decorator::getFac_nodeFac_node::_OpenTableTypechar_traitsstd::_type_info::_name_internal_method
String ID: $A$C$CurrentBuild$E$F$M$N$O$ProductName$R$S$T$T$V$W$W$\$\$\$c$d$e$e$f$i$i$i$n$n$n$o$o$o$o$r$r$r$r$s$s$s$t$t$u$w
API String ID: 1239499685-786305380
Opcode ID: 13569eeb28de908d15b91c27bdb5b0d39f4d3520f413788c1801af54ad5c7272
Instruction ID: 6062cc7aa62aef948d616e0c52b71a61e3e8cb3c7e956702011da25b0a491166
Opcode Fuzzy Hash: 13569eeb28de908d15b91c27bdb5b0d39f4d3520f413788c1801af54ad5c7272
Instruction Fuzzy Hash: B7C15B2261D6C185E721DB24E4643DBBBA2EBD1744F400026E3CD97BAADFBED508CB14

Function 00007FFDA34B5B00 Relevance: 86.2, APIs: 11, Strings: 38, Instructions: 410COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5D30

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5DC0
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5E2D
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5EB8
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5F10

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B5FC8
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B6008
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B6039

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B6187

Strings

t, xrefs: 00007FFDA34B5E9E
c, xrefs: 00007FFDA34B5E80
g, xrefs: 00007FFDA34B5D9C
K, xrefs: 00007FFDA34B5E04
l, xrefs: 00007FFDA34B5E13
e, xrefs: 00007FFDA34B5CF3
i, xrefs: 00007FFDA34B5D79
i, xrefs: 00007FFDA34B5E09
e, xrefs: 00007FFDA34B5CFD
t, xrefs: 00007FFDA34B5CEE
l, xrefs: 00007FFDA34B5D7E
n, xrefs: 00007FFDA34B5E8A
t, xrefs: 00007FFDA34B5D0C
p, xrefs: 00007FFDA34B5D16
n, xrefs: 00007FFDA34B5E8F
a, xrefs: 00007FFDA34B5D97
e, xrefs: 00007FFDA34B5E94
c, xrefs: 00007FFDA34B5E99
D, xrefs: 00007FFDA34B5CF8
a, xrefs: 00007FFDA34B5D8D
e, xrefs: 00007FFDA34B5CDF
l, xrefs: 00007FFDA34B5E0E
k, xrefs: 00007FFDA34B5D07
s, xrefs: 00007FFDA34B5E7B
m, xrefs: 00007FFDA34B5CE4
F, xrefs: 00007FFDA34B5D74
n, xrefs: 00007FFDA34B5D92
r, xrefs: 00007FFDA34B5DA6
s, xrefs: 00007FFDA34B5D02
e, xrefs: 00007FFDA34B5D83
o, xrefs: 00007FFDA34B5D11
D, xrefs: 00007FFDA34B5E71
e, xrefs: 00007FFDA34B5DA1
M, xrefs: 00007FFDA34B5D88
o, xrefs: 00007FFDA34B5E85
o, xrefs: 00007FFDA34B5CE9
i, xrefs: 00007FFDA34B5E76
R, xrefs: 00007FFDA34B5CDA

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::cancel_current_taskConcurrency::details::EmptyQueue::StructuredWorktype_info::_name_internal_method$Decorator::getTableTypechar_traits
String ID: D$D$F$K$M$R$a$a$c$c$e$e$e$e$e$e$g$i$i$i$k$l$l$l$m$n$n$n$o$o$o$p$r$s$s$t$t$t
API String ID: 2028585780-760767060
Opcode ID: 59bd2d8ec4de32a4ecc2802f7587c4c348fb0e6e645ba743dd23d46785d07151
Instruction ID: 24d59dacae956527ea0718e7a1306d1fd5afed3d53277119a22a71d1fe655a5a
Opcode Fuzzy Hash: 59bd2d8ec4de32a4ecc2802f7587c4c348fb0e6e645ba743dd23d46785d07151
Instruction Fuzzy Hash: 12225D2260EAC185E671EB14E4603EFA7A2EBC5784F400035E6CD97B9BDFAED504CB54

Function 00007FFDA348D550 Relevance: 49.3, APIs: 5, Strings: 23, Instructions: 293COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D5B2
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D63D
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D695
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA348D9DC
HandleT.LIBCPMTD ref: 00007FFDA348D9EE

Part of subcall function 00007FFDA348F9E0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA348FA02

Part of subcall function 00007FFDA348FA30: char_traits.LIBCPMTD ref: 00007FFDA348FA4E

Strings

i, xrefs: 00007FFDA348D56B
F, xrefs: 00007FFDA348D566
e, xrefs: 00007FFDA348D575
a, xrefs: 00007FFDA348D589
i, xrefs: 00007FFDA348D60F
e, xrefs: 00007FFDA348D5FB
r, xrefs: 00007FFDA348D60A
t, xrefs: 00007FFDA348D600
r, xrefs: 00007FFDA348D61E
D, xrefs: 00007FFDA348D605
a, xrefs: 00007FFDA348D57F
n, xrefs: 00007FFDA348D584
r, xrefs: 00007FFDA348D598
e, xrefs: 00007FFDA348D593
FrG, xrefs: 00007FFDA348D5A5
G, xrefs: 00007FFDA348D5F6
==>, xrefs: 00007FFDA348DA47
e, xrefs: 00007FFDA348D619
v, xrefs: 00007FFDA348D614
g, xrefs: 00007FFDA348D58E
l, xrefs: 00007FFDA348D570
M, xrefs: 00007FFDA348D57A
s, xrefs: 00007FFDA348D623

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::details::Concurrency::details::_CriticalEmptyHandleLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWorkchar_traits
String ID: ==>$D$F$FrG$G$M$a$a$e$e$e$e$g$i$i$l$n$r$r$r$s$t$v
API String ID: 420779418-205225161
Opcode ID: 5f69955f3368b046341811d0c46d426a07e9c4799963500704bcf638db78bb77
Instruction ID: ae5b7953c8aa0988c3d2b014d2c3ad62327ffa047248264e22004ebd9954d29d
Opcode Fuzzy Hash: 5f69955f3368b046341811d0c46d426a07e9c4799963500704bcf638db78bb77
Instruction Fuzzy Hash: 0DE1192260EAC195DA60DB14F4A13EEA7A2FBC5384F400035E6CD97B9BEFADD544CB44

Function 00007FFDA34A2CD0 Relevance: 49.2, APIs: 9, Strings: 19, Instructions: 233processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34A61D0: _WChar_traits.LIBCPMTD ref: 00007FFDA34A61F6

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A2E3E
CreateProcessW.KERNEL32 ref: 00007FFDA34A2E87
CloseHandle.KERNEL32 ref: 00007FFDA34A2E97
CloseHandle.KERNEL32 ref: 00007FFDA34A2EA5
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A2F65
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A3074
CreateProcessW.KERNEL32 ref: 00007FFDA34A30BD
CloseHandle.KERNEL32 ref: 00007FFDA34A30CD
CloseHandle.KERNEL32 ref: 00007FFDA34A30DB

Strings

m, xrefs: 00007FFDA34A2EEE
, xrefs: 00007FFDA34A2F1B
, xrefs: 00007FFDA34A2F0C
e, xrefs: 00007FFDA34A2F07
/, xrefs: 00007FFDA34A2F11
r, xrefs: 00007FFDA34A2F2F
a, xrefs: 00007FFDA34A2F2A
c, xrefs: 00007FFDA34A2F16
t, xrefs: 00007FFDA34A2F25
., xrefs: 00007FFDA34A2EF8
h, xrefs: 00007FFDA34A2D73
.exe, xrefs: 00007FFDA34A2D7E
s, xrefs: 00007FFDA34A2F20
d, xrefs: 00007FFDA34A2EF3
x, xrefs: 00007FFDA34A2F02
c, xrefs: 00007FFDA34A2EE9
t, xrefs: 00007FFDA34A2F34
, xrefs: 00007FFDA34A2F39
e, xrefs: 00007FFDA34A2EFD

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CloseHandle$Concurrency::details::CreateEmptyProcessQueue::StructuredWork$Char_traitsFac_nodeFac_node::_std::_
String ID: $ $ $.$.exe$/$a$c$c$d$e$e$h$m$r$s$t$t$x
API String ID: 4010672392-1850887160
Opcode ID: d31621a2d32b0a3b1949a119d43f2289199d1e78f584f337a88e1aafb8d2bd3e
Instruction ID: 6bbc61d5e874f108afc1563d9817e542c1d2906baaa381c8b08c48bbb60bd78c
Opcode Fuzzy Hash: d31621a2d32b0a3b1949a119d43f2289199d1e78f584f337a88e1aafb8d2bd3e
Instruction Fuzzy Hash: F8C1293260DAC195EA21DB64E4643EFB762FBD5340F404036E6CD92BAADFADD548CB04

Function 00007FFDA34B6A50 Relevance: 42.2, APIs: 3, Strings: 21, Instructions: 228COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6AC0
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6B4F
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6BB7

Part of subcall function 00007FFDA348D550: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D5B2
Part of subcall function 00007FFDA348D550: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D63D
Part of subcall function 00007FFDA348D550: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D695

Strings

C, xrefs: 00007FFDA34B6B0A
e, xrefs: 00007FFDA34B6B19
a, xrefs: 00007FFDA34B6A7B
l, xrefs: 00007FFDA34B6B0F
M, xrefs: 00007FFDA34B6A76
n, xrefs: 00007FFDA34B6B1E
l, xrefs: 00007FFDA34B6A6C
e, xrefs: 00007FFDA34B6B00
a, xrefs: 00007FFDA34B6A85
i, xrefs: 00007FFDA34B6B14
S, xrefs: 00007FFDA34B6AFB
e, xrefs: 00007FFDA34B6A8F
r, xrefs: 00007FFDA34B6A94
t, xrefs: 00007FFDA34B6B23
g, xrefs: 00007FFDA34B6A8A
e, xrefs: 00007FFDA34B6A71
i, xrefs: 00007FFDA34B6A67
n, xrefs: 00007FFDA34B6A80
t, xrefs: 00007FFDA34B6B05
FtS, xrefs: 00007FFDA34B6AB3
F, xrefs: 00007FFDA34B6A62

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: C$F$FtS$M$S$a$a$e$e$e$e$g$i$i$l$l$n$n$r$t$t
API String ID: 1114552684-2189465758
Opcode ID: 50ee1b1b17ded2a8e62f603e76cff047e39b5a6fc7cd7a71ca88179335fa07c3
Instruction ID: 57d526d2c3261e92e89344a5bbc577ceb02c6eca75b3d088ec9be5ce17f3b3bd
Opcode Fuzzy Hash: 50ee1b1b17ded2a8e62f603e76cff047e39b5a6fc7cd7a71ca88179335fa07c3
Instruction Fuzzy Hash: B8B16D2260EAC191E660DB14F4603EFA7A2EBD5384F400035E6CD93B9BDEAED548CB44

Function 00007FFDA34B6420 Relevance: 42.2, APIs: 4, Strings: 20, Instructions: 226COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B65DA
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6660

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B66B8

Part of subcall function 00007FFDA34B16D0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1756
Part of subcall function 00007FFDA34B16D0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1819
Part of subcall function 00007FFDA34B16D0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B18A0

Part of subcall function 00007FFDA34917F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491803

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B67B4

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA3488768
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34887CE
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA3488834
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348889F
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348890A

Strings

e, xrefs: 00007FFDA34B659D
i, xrefs: 00007FFDA34B6593
l, xrefs: 00007FFDA34B6598
r, xrefs: 00007FFDA34B65C0
t, xrefs: 00007FFDA34B6628
i, xrefs: 00007FFDA34B6637
e, xrefs: 00007FFDA34B663C
n, xrefs: 00007FFDA34B6641
M, xrefs: 00007FFDA34B65A2
e, xrefs: 00007FFDA34B65BB
g, xrefs: 00007FFDA34B65B6
t, xrefs: 00007FFDA34B6646
C, xrefs: 00007FFDA34B662D
a, xrefs: 00007FFDA34B65B1
l, xrefs: 00007FFDA34B6632
e, xrefs: 00007FFDA34B6623
F, xrefs: 00007FFDA34B658E
S, xrefs: 00007FFDA34B661E
n, xrefs: 00007FFDA34B65AC
a, xrefs: 00007FFDA34B65A7

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::cancel_current_task$Concurrency::details::Decorator::getEmptyQueue::StructuredTableTypeWorkchar_traitstype_info::_name_internal_method
String ID: C$F$M$S$a$a$e$e$e$e$g$i$i$l$l$n$n$r$t$t
API String ID: 924362910-1541419571
Opcode ID: 668c1e3e51d0e2fc71ca83dd5b96e6bb9e73db51f41fd73b4946feff3da2304a
Instruction ID: c36e450e6d229dc3e29b116c8ab6a8a9d5e6cde4e61a2c7427bac41dd08c3518
Opcode Fuzzy Hash: 668c1e3e51d0e2fc71ca83dd5b96e6bb9e73db51f41fd73b4946feff3da2304a
Instruction Fuzzy Hash: 12C14C3260EAC191E660DB14F4643EBA7A2FBC5784F400135E6CD97BAADFAED544CB04

Function 00007FFDA348F460 Relevance: 42.2, APIs: 4, Strings: 20, Instructions: 206COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F4D9
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F563
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F5CB
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA348F7A8

Strings

R, xrefs: 00007FFDA348F514
M, xrefs: 00007FFDA348F48F
i, xrefs: 00007FFDA348F52D
e, xrefs: 00007FFDA348F4A8
U, xrefs: 00007FFDA348F51E
F, xrefs: 00007FFDA348F528
a, xrefs: 00007FFDA348F494
g, xrefs: 00007FFDA348F4A3
p, xrefs: 00007FFDA348F523
r, xrefs: 00007FFDA348F4AD
e, xrefs: 00007FFDA348F537
l, xrefs: 00007FFDA348F485
error, xrefs: 00007FFDA348F79E
e, xrefs: 00007FFDA348F519
n, xrefs: 00007FFDA348F499
a, xrefs: 00007FFDA348F49E
e, xrefs: 00007FFDA348F48A
l, xrefs: 00007FFDA348F532
i, xrefs: 00007FFDA348F480
F, xrefs: 00007FFDA348F47B

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$type_info::_name_internal_method
String ID: F$F$M$R$U$a$a$e$e$e$e$error$g$i$i$l$l$n$p$r
API String ID: 3843115320-2728630413
Opcode ID: 208c863bfba058f04b787a8e2d474442b0a7e4e4432c1749738c198f21529a3d
Instruction ID: dfaa64e9c8e6dbe79a8119eebedc4ecf6299cf5e3697663d558f15dffa001574
Opcode Fuzzy Hash: 208c863bfba058f04b787a8e2d474442b0a7e4e4432c1749738c198f21529a3d
Instruction Fuzzy Hash: B6A13D2260EAC191EA60DB14F4613EEA7A2FBD5784F400035E6CD93BABDFADD544CB04

Function 00007FFDA348EF30 Relevance: 38.7, APIs: 3, Strings: 19, Instructions: 247COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348EFEB
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F06C
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F0C4

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Strings

e, xrefs: 00007FFDA348F034
M, xrefs: 00007FFDA348EFB3
a, xrefs: 00007FFDA348EFB8
l, xrefs: 00007FFDA348EFA9
p, xrefs: 00007FFDA348F03E
F, xrefs: 00007FFDA348EF9F
i, xrefs: 00007FFDA348F048
a, xrefs: 00007FFDA348EFC2
g, xrefs: 00007FFDA348EFC7
U, xrefs: 00007FFDA348F039
e, xrefs: 00007FFDA348EFCC
F, xrefs: 00007FFDA348F043
e, xrefs: 00007FFDA348EFAE
n, xrefs: 00007FFDA348EFBD
r, xrefs: 00007FFDA348EFD1
l, xrefs: 00007FFDA348F04D
e, xrefs: 00007FFDA348F052
R, xrefs: 00007FFDA348F02F
i, xrefs: 00007FFDA348EFA4

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::cancel_current_task$Decorator::getTableType
String ID: F$F$M$R$U$a$a$e$e$e$e$g$i$i$l$l$n$p$r
API String ID: 3873182351-3194299963
Opcode ID: 5b2bb602d22b333214d04523e346fc123c1330c8c3198e5e6a9d8e78296e0be3
Instruction ID: d66c83b1620eb9859f6a8b87dcde15b69bd925534c16ae2adce8f9c483d0e5fd
Opcode Fuzzy Hash: 5b2bb602d22b333214d04523e346fc123c1330c8c3198e5e6a9d8e78296e0be3
Instruction Fuzzy Hash: 5AC13D2260EAC191DA60DB14F4603EFA7A2EBD5784F400035E6CD97BABDFAED544CB44

Function 00007FFDA348E7E0 Relevance: 35.4, APIs: 4, Strings: 16, Instructions: 356COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348E8AF

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA348EB37
Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FFDA348EBA3

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA348ED9B

Strings

o, xrefs: 00007FFDA348E859
n, xrefs: 00007FFDA348E881
D, xrefs: 00007FFDA348E872
pre, xrefs: 00007FFDA348EB2D
a, xrefs: 00007FFDA348E890
c, xrefs: 00007FFDA348E85E
w, xrefs: 00007FFDA348E87C
S, xrefs: 00007FFDA348E854
t, xrefs: 00007FFDA348E86D
save, xrefs: 00007FFDA348ED91
o, xrefs: 00007FFDA348E88B
d, xrefs: 00007FFDA348E895
l, xrefs: 00007FFDA348E886
o, xrefs: 00007FFDA348E877
e, xrefs: 00007FFDA348E868
k, xrefs: 00007FFDA348E863

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::cancel_current_tasktype_info::_name_internal_method$Concurrency::cancellation_token::_Decorator::getFac_nodeFac_node::_FromImplTableTypestd::_
String ID: D$S$a$c$d$e$k$l$n$o$o$o$pre$save$t$w
API String ID: 1666591369-2572745379
Opcode ID: 7e0b7a93bf49bcff58548c04f9da16580aed8d903afd20bd23106dfcea5c502d
Instruction ID: b51f3c88255bce89a3b41855eac629b0a4a19f5bdea01ca44feb700b149359bf
Opcode Fuzzy Hash: 7e0b7a93bf49bcff58548c04f9da16580aed8d903afd20bd23106dfcea5c502d
Instruction Fuzzy Hash: B4021D3260EAC292DA60EB14F4653EEA3A2FBC5744F400035E68D97B9BDFADD544CB44

Function 00007FFDA34B72B0 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 190COMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS ref: 00007FFDA34B72F7
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B7384

Part of subcall function 00007FFDA34B7EC0: EnumDisplayMonitors.USER32 ref: 00007FFDA34B7EEC

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Strings

t, xrefs: 00007FFDA34B7351
e, xrefs: 00007FFDA34B7338
t, xrefs: 00007FFDA34B7333
k, xrefs: 00007FFDA34B734C
e, xrefs: 00007FFDA34B7342
R, xrefs: 00007FFDA34B731F
D, xrefs: 00007FFDA34B733D
o, xrefs: 00007FFDA34B732E
s, xrefs: 00007FFDA34B7347
e, xrefs: 00007FFDA34B7324
o, xrefs: 00007FFDA34B7356
m, xrefs: 00007FFDA34B7329
jpg, xrefs: 00007FFDA34B750E
p, xrefs: 00007FFDA34B735B

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Decorator::getDisplayEnumFac_nodeFac_node::_GdiplusMonitorsStartupTableTypestd::_
String ID: D$R$e$e$e$jpg$k$m$o$o$p$s$t$t
API String ID: 1258987360-2495397863
Opcode ID: 76332751ae7abdf6e6b080960cc59d2a6e1d6b7111230b08185894483d4d3adf
Instruction ID: ae9e5e0eb199f89e05a15b33a5face2aac0620664ea47566aa633ab4ff510046
Opcode Fuzzy Hash: 76332751ae7abdf6e6b080960cc59d2a6e1d6b7111230b08185894483d4d3adf
Instruction Fuzzy Hash: 39913C3260EAC181DB20DB14F4613EAA761EBC5784F404136E68D93BAADEBDD545CB04

Function 00007FFDA34B7670 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 361COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34A78F0: char_traits.LIBCPMTD ref: 00007FFDA34A7908

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7731
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B780E
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B78F1
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B79D4
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7AB7
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7B9A
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7C7D
GdiplusShutdown.GDIPLUS ref: 00007FFDA34B7D5F

Strings

.jpeg, xrefs: 00007FFDA34B7B8B
.gif, xrefs: 00007FFDA34B7C6E
.bmp, xrefs: 00007FFDA34B79C5
.ico, xrefs: 00007FFDA34B78E2
.jpg, xrefs: 00007FFDA34B77FF
.png, xrefs: 00007FFDA34B7722
.jfif, xrefs: 00007FFDA34B7AA8

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: type_info::_name_internal_method$GdiplusShutdownchar_traits
String ID: .bmp$.gif$.ico$.jfif$.jpeg$.jpg$.png
API String ID: 3499204208-3397763088
Opcode ID: 0f246cb72e55f54a7b693d8fc228ba5af8b2ca5bc0172a7175d6b3f4dadf06c9
Instruction ID: 055b2b49758ceef26ec1d510ed49680d680db5d55032ec5b7e70eed569846898
Opcode Fuzzy Hash: 0f246cb72e55f54a7b693d8fc228ba5af8b2ca5bc0172a7175d6b3f4dadf06c9
Instruction Fuzzy Hash: 36124C3261D6C286D6709B14E4613EABB61FB85364F000332E6EDD6BDADFADD504CB44

Function 00007FFDA34B8380 Relevance: 26.3, APIs: 5, Strings: 10, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34B9C90: char_traits.LIBCPMTD ref: 00007FFDA34B9CA3

CLSIDFromString.OLE32 ref: 00007FFDA34B83C7
CLSIDFromString.OLE32 ref: 00007FFDA34B83F4

Strings

{557cf402-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B8417
gif, xrefs: 00007FFDA34B83FD
{557cf400-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B83C0
jpg, xrefs: 00007FFDA34B83D3
{557cf406-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B846B
bmp, xrefs: 00007FFDA34B83A6
{557cf405-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B8441
png, xrefs: 00007FFDA34B8451
tif, xrefs: 00007FFDA34B8427
{557cf401-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B83ED

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: FromString$char_traits
String ID: bmp$gif$jpg$png$tif${557cf400-1a04-11d3-9a73-0000f81ef32e}${557cf401-1a04-11d3-9a73-0000f81ef32e}${557cf402-1a04-11d3-9a73-0000f81ef32e}${557cf405-1a04-11d3-9a73-0000f81ef32e}${557cf406-1a04-11d3-9a73-0000f81ef32e}
API String ID: 3612880244-2938333857
Opcode ID: 27bbbdadbdfd53492e3170faa8fbfabf8b77fc76d5c273dd4bfb8bd4d69b80a3
Instruction ID: 96bff651e858fc6a439859c84ed8da83094533fef66b6fe1b8c59c397e9e0d0e
Opcode Fuzzy Hash: 27bbbdadbdfd53492e3170faa8fbfabf8b77fc76d5c273dd4bfb8bd4d69b80a3
Instruction Fuzzy Hash: 5F319021B0EA8691EA50CF41EC600B96763FBD5788F804031D98DD2766FFEEE948C708

Function 00007FFDA34B88C0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 262windowCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B8938
SHGetFileInfoW.SHELL32 ref: 00007FFDA34B8958
CreateStreamOnHGlobal.OLE32 ref: 00007FFDA34B8A4C
DestroyIcon.USER32 ref: 00007FFDA34B8A62
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8A7F

Part of subcall function 00007FFDA34BE7C0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FFDA34BE949

DestroyIcon.USER32 ref: 00007FFDA34B8BD1
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8BEE
DestroyIcon.USER32 ref: 00007FFDA34B8D0A
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8D27

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34B8380: CLSIDFromString.OLE32 ref: 00007FFDA34B83C7

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8DB3

Strings

png, xrefs: 00007FFDA34B8994

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$DestroyIcon$Concurrency::details::Concurrency::task_continuation_context::task_continuation_contextCreateEmptyFileFromGlobalInfoQueue::StreamStringStructuredWorkchar_traits
String ID: png
API String ID: 2892423481-2199389072
Opcode ID: fae29a7a72ba1a9e499f6e2f45cbe4b808135d9687a933d283217be40005f67f
Instruction ID: 690273f433c0cd20b7fd657da7c0ad17b7372567541d35a875085d6b530a5398
Opcode Fuzzy Hash: fae29a7a72ba1a9e499f6e2f45cbe4b808135d9687a933d283217be40005f67f
Instruction Fuzzy Hash: 47D12E32719A8192DB60DB15E4A13EAA761FBC4780F405036E78ED3BAADF7DD544CB04

Function 00007FFDA34B7EC0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32 ref: 00007FFDA34B7EEC

Strings

, xrefs: 00007FFDA34B8060
DISPLAY, xrefs: 00007FFDA34B800D
h, xrefs: 00007FFDA34B7FA0

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: DisplayEnumMonitors
String ID: $DISPLAY$h
API String ID: 2950131505-1878358626
Opcode ID: 672e0ac83053d01c40282062667c1306d9c30b7dde12ecaa6dd10ab88f712e8c
Instruction ID: 5f405c24616ee6e8026f08b215bead3528441278ab6bce29ed57b1fcf7cccea5
Opcode Fuzzy Hash: 672e0ac83053d01c40282062667c1306d9c30b7dde12ecaa6dd10ab88f712e8c
Instruction Fuzzy Hash: 0251D832609AC186E760DF25E4A07AAB7A2FBC4750F504136E68D93B69DFBDD448CF04

Function 00007FFDA34A9D10 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 119timefileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34A9CA0: GetModuleFileNameA.KERNEL32 ref: 00007FFDA34A9CD3

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A9D4E
CreateFileA.KERNEL32 ref: 00007FFDA34A9D7D
GetFileTime.KERNEL32 ref: 00007FFDA34A9DEB
FileTimeToSystemTime.KERNEL32 ref: 00007FFDA34A9E06
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FFDA34A9E1B
CloseHandle.KERNEL32 ref: 00007FFDA34A9EE8

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

a.m., xrefs: 00007FFDA34A9ED3
p.m., xrefs: 00007FFDA34A9EB9

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Time$File$System$CloseConcurrency::details::CreateEmptyHandleLocalModuleNameQueue::SpecificStructuredWorkchar_traits
String ID: a.m.$ p.m.
API String ID: 4253720429-1173636248
Opcode ID: f9f23eb8ed0bd049b82b5f7093e0345eed192e55972dcacb3ddd51adc77cf471
Instruction ID: eab9a159336264a0cbca4b1f4cfb924c4e515939e7e4f095a562ae0271acceb3
Opcode Fuzzy Hash: f9f23eb8ed0bd049b82b5f7093e0345eed192e55972dcacb3ddd51adc77cf471
Instruction Fuzzy Hash: 64514021B1E68682EA10DB14E4603FAA362FBC1750F804132E68D977ABDFBED444CB44

Function 00007FFDA3492230 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA3492248
_Yarn.LIBCPMTD ref: 00007FFDA349225A
_Yarn.LIBCPMTD ref: 00007FFDA349226C
_Yarn.LIBCPMTD ref: 00007FFDA349227E
_Yarn.LIBCPMTD ref: 00007FFDA3492290
_Yarn.LIBCPMTD ref: 00007FFDA34922A2
_Yarn.LIBCPMTD ref: 00007FFDA34922B4
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDA34922CC

Part of subcall function 00007FFDA34C12E4: _Yarn.LIBCPMT ref: 00007FFDA34C1312

Strings

bad locale name, xrefs: 00007FFDA34922D4

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: 21b6dde102e949537a358dabb7938f436e8824ef52250dd78e5f134c6afc748f
Instruction ID: df1214acbd0239aaa38a2b4d7f621c37f948e02d2052c2a5cd4b981cdc1dad1e
Opcode Fuzzy Hash: 21b6dde102e949537a358dabb7938f436e8824ef52250dd78e5f134c6afc748f
Instruction Fuzzy Hash: 82115E11F6B78641EE54E72AA4A566E6361EFC6BC0F802431F94EB7B57CE6DD0108708

Function 00007FFDA34C2F00 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D021C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D0230

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F35
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F48
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F5F
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F76

Strings

GetCurrentPackageId, xrefs: 00007FFDA34C2F3E
GetSystemTimePreciseAsFileTime, xrefs: 00007FFDA34C2F4E
GetTempPath2W, xrefs: 00007FFDA34C2F65
invalid random_device value, xrefs: 00007FFDA34C2F1B
kernel32.dll, xrefs: 00007FFDA34C2F2E

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: AddressProc$HandleModule_invalid_parameter_noinfo
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$invalid random_device value$kernel32.dll
API String ID: 2104222004-861830008
Opcode ID: c7c081bedf470f973e2b56519931470c3a7a7f8b38c7d7fbc461ff9d9a2692fe
Instruction ID: 373b8eb87b54e6f21c61bcc4b8c355fc409d797d984f4b9f3bed9c8b98202cd5
Opcode Fuzzy Hash: c7c081bedf470f973e2b56519931470c3a7a7f8b38c7d7fbc461ff9d9a2692fe
Instruction Fuzzy Hash: 8C01EC64F1BA07C1FA04DB65F8644B46362BF46B41F941034D80EE6367EFAEE1D98318

Function 00007FFDA34BB2C0 Relevance: 15.4, APIs: 10, Instructions: 416COMMON

Download Yara Rule

APIs

std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB342
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB421
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB4BF
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34BB622
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB6CC

Part of subcall function 00007FFDA349E180: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA349E1AA

Part of subcall function 00007FFDA349B800: _Byte_length.LIBCPMTD ref: 00007FFDA349B894

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34BB82A

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BB897

Part of subcall function 00007FFDA34BE4A0: std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4C1
Part of subcall function 00007FFDA34BE4A0: GetCurrentThreadId.KERNEL32 ref: 00007FFDA34BE4C7
Part of subcall function 00007FFDA34BE4A0: std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4DB
Part of subcall function 00007FFDA34BE4A0: std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE50A

Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349352B
Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349353A

UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BBAF1

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: std::runtime_error::runtime_error$Cpp_errorDecorator::getTableThrow_Typestd::_$Concurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork$Byte_lengthCurrentThreadchar_traits
String ID:
API String ID: 2867615695-0
Opcode ID: cd33df9d3d40b1a4144104433d8dc30451c8ce45da51524e28e90d1d2dbb93f0
Instruction ID: 0b8789f58acf24df720fbc5ecb20da72999c14f49729a0b9aad29a0a6e9a335a
Opcode Fuzzy Hash: cd33df9d3d40b1a4144104433d8dc30451c8ce45da51524e28e90d1d2dbb93f0
Instruction Fuzzy Hash: B432F67260EAC586DA70DB15E4A43EAB3A1FBC4744F404036DB8D93BAADF79D445CB04

Function 00007FFDA3497A40 Relevance: 13.9, APIs: 9, Instructions: 402COMMON

Download Yara Rule

APIs

std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497AD7
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497BBA
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497C56
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA3497D92
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497E20

Part of subcall function 00007FFDA349E180: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA349E1AA

Part of subcall function 00007FFDA349B800: _Byte_length.LIBCPMTD ref: 00007FFDA349B894

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA3497F72

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34B6420: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B65DA

Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349352B
Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349353A

UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34981D1

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: std::runtime_error::runtime_error$Concurrency::details::Concurrency::details::_CriticalDecorator::getEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredTableTypeWork$Byte_lengthFac_nodeFac_node::_char_traitsstd::_
String ID:
API String ID: 2648250531-0
Opcode ID: a9944911c49198297e702856b03420b9597a7d3ae06585ae7b6ef4a972edc2d1
Instruction ID: d449539a51437c592bf442dca94f818596124f7359a25c30d51ac15aa5c23d76
Opcode Fuzzy Hash: a9944911c49198297e702856b03420b9597a7d3ae06585ae7b6ef4a972edc2d1
Instruction Fuzzy Hash: 4F22277261AAC586DA70DB14E4A03EEB761FBC4744F401122DB8D93BAADF7DD504CB48

Function 00007FFDA34D4154 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FFDA34D499C,?,?,?,?,00007FFDA34CF629,?,?,?,?,00007FFDA34C0F10), ref: 00007FFDA34D42D0
GetProcAddress.KERNEL32(?,?,?,00007FFDA34D499C,?,?,?,?,00007FFDA34CF629,?,?,?,?,00007FFDA34C0F10), ref: 00007FFDA34D42DC

Strings

ext-ms-, xrefs: 00007FFDA34D422D
api-ms-, xrefs: 00007FFDA34D421A

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 37ca3048070be1c70536f5ec53a0aedc04f3e76b26da52ce0f72c4a8bfec6647
Instruction ID: 57adce8e48d86a5194dd33c54ff195ea26fae5abd9c8132601c7b7c886b73920
Opcode Fuzzy Hash: 37ca3048070be1c70536f5ec53a0aedc04f3e76b26da52ce0f72c4a8bfec6647
Instruction Fuzzy Hash: 46413B32B1BA0281FA16CB16A8245B56393BF46BE0F084136DD0DE7796DFBEE441C308

Function 00007FFDA34CC7B8 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CC7FB
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CCBE8
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CCE84

Strings

f, xrefs: 00007FFDA34CC91D
p, xrefs: 00007FFDA34CC925
p, xrefs: 00007FFDA34CC8AD

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: b0d905913f178a05850a904996d5be31d3cd629aea336fc8d1d384171e8fe448
Instruction ID: 6b8d3b3da5b270fdbbb518082a6d350b0ecf515d0cb9fab5a63c444184b593a2
Opcode Fuzzy Hash: b0d905913f178a05850a904996d5be31d3cd629aea336fc8d1d384171e8fe448
Instruction Fuzzy Hash: 0912A562F0E14395FB209B18E1742B97653FB40750F844135D689A77CADFBEEC829B18

Function 00007FFDA34AAB70 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 375COMMON

Download Yara Rule

APIs

ctype.LIBCPMTD ref: 00007FFDA34AADB0
_Mpunct.LIBCPMTD ref: 00007FFDA34AAE10
_Mpunct.LIBCPMTD ref: 00007FFDA34AAE1B
_Mpunct.LIBCPMTD ref: 00007FFDA34AAE38
std::ios_base::width.LIBCPMTD ref: 00007FFDA34AB284

Strings

@, xrefs: 00007FFDA34AAFCD

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Mpunct$ctypestd::ios_base::width
String ID: @
API String ID: 3075750325-2766056989
Opcode ID: e67de69f98cff780475ac0c8084deb56d29bcf2359572f96fc364d3a03f4861c
Instruction ID: 3513d65cf9ec6b230d435534ee324ee6089313796b0688a9808c6093470dcaa5
Opcode Fuzzy Hash: e67de69f98cff780475ac0c8084deb56d29bcf2359572f96fc364d3a03f4861c
Instruction Fuzzy Hash: CA121B3260EBC585DA70DB55E4A43EBA7A2F7C8780F404432EA8D93B6ADE7DD544CB04

Function 00007FFDA34C6458 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFDA34C64B5

Part of subcall function 00007FFDA34C87BC: __GetUnwindTryBlock.LIBCMT ref: 00007FFDA34C87FF
Part of subcall function 00007FFDA34C87BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFDA34C8824

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDA34C658D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFDA34C67DB

Strings

csm, xrefs: 00007FFDA34C64CF
csm, xrefs: 00007FFDA34C65B0
csm, xrefs: 00007FFDA34C6536

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchState
String ID: csm$csm$csm
API String ID: 1826822863-393685449
Opcode ID: 18fba9449cf909bf85d974a39e9706e64e3fa71afd28f0598ebf155c87009170
Instruction ID: fae176c7073d47f947abdcc6007a810f52fa0f400f3940dc722b33a5b40b392b
Opcode Fuzzy Hash: 18fba9449cf909bf85d974a39e9706e64e3fa71afd28f0598ebf155c87009170
Instruction Fuzzy Hash: D7D1AE32A0A6418AFB608B69D4503BD77A2FB45798F144135EE8DA7B9BCF7EE050C704

Function 00007FFDA34D8EF8 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D9325

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b2c7bc130197246b40956ba66cd1257bddcb4cdd4c992c93ddc331ef8c3a997e
Instruction ID: f3aa70331b8a675160f8b798394a3419714276503c69db6882c0cdc777f545da
Opcode Fuzzy Hash: b2c7bc130197246b40956ba66cd1257bddcb4cdd4c992c93ddc331ef8c3a997e
Instruction Fuzzy Hash: AEC1E223B0E78651F6659B1594242BD7BA3EB82BC0F150135DA4DE3397EEBEE8458308

Function 00007FFDA34A4180 Relevance: 10.6, APIs: 7, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A41A3
CreateFileA.KERNEL32 ref: 00007FFDA34A41D2
GetFileSize.KERNEL32 ref: 00007FFDA34A4211
CloseHandle.KERNEL32 ref: 00007FFDA34A4227

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: File$CloseConcurrency::details::CreateEmptyHandleQueue::SizeStructuredWork
String ID:
API String ID: 2285079412-0
Opcode ID: e155523a2607a2c161b7ce0223fbcfffcf75895e662939dd0c3e66526e39bfe8
Instruction ID: 5ac2bb8d7d5762a7f4849a66d55f66c2c059eb9739cfd3df0656686419d47f8b
Opcode Fuzzy Hash: e155523a2607a2c161b7ce0223fbcfffcf75895e662939dd0c3e66526e39bfe8
Instruction Fuzzy Hash: 82411932A0958187E720DB20E4613AEB7A1FBC1794F504531E6DDD7BAADFBED8448B04

Function 00007FFDA34C8D0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8D91
GetLastError.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8D9F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8DC9
FreeLibrary.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8E37
GetProcAddress.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8E43

Strings

api-ms-, xrefs: 00007FFDA34C8DB1

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 492e68bbb1773d240888386dda676b62b4bbe1757f3f4df5f2fd3b7df8b2a67b
Instruction ID: 9302599013c2b91ad236b93324d72a6eccc3d9e0b481aa3324bb456f224e348a
Opcode Fuzzy Hash: 492e68bbb1773d240888386dda676b62b4bbe1757f3f4df5f2fd3b7df8b2a67b
Instruction Fuzzy Hash: 9731F632B1B74292FE52AB0AA8205B56396FF44BA0F590535ED1DE7742DFBDE4408318

Function 00007FFDA34D2408 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D244D
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D247A
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D248B
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D249C
SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 59373f8d53b31bb45b24a81f44cc7f7f763d6d1bbe38ce609f55f8ea00006115
Instruction ID: c954fb03d22b116783e1fdaa7f31d57722f3683f182ac726092c5bdbedce1144
Opcode Fuzzy Hash: 59373f8d53b31bb45b24a81f44cc7f7f763d6d1bbe38ce609f55f8ea00006115
Instruction Fuzzy Hash: 1321C522B0F20242FA959775667513852435F447F0F140738DD3EF67DBDEAFA8418608

Function 00007FFDA34E44E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFDA34E4515
GetLastError.KERNEL32 ref: 00007FFDA34E4521
CloseHandle.KERNEL32 ref: 00007FFDA34E4539
CreateFileW.KERNEL32 ref: 00007FFDA34E4564
WriteConsoleW.KERNEL32 ref: 00007FFDA34E4583

Strings

CONOUT$, xrefs: 00007FFDA34E4545

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: aaa7478a30f227f436a7fdc7f67f6462c4936cde7976a00747b319838b7bad40
Instruction ID: 2ce2b9f69c00bdb9b413e3cef57d249a5780974cd53b703332349dcffc4df795
Opcode Fuzzy Hash: aaa7478a30f227f436a7fdc7f67f6462c4936cde7976a00747b319838b7bad40
Instruction Fuzzy Hash: 5511E931B19B418AE3508B06E864369B3A5FB48FE0F140234EA6DD3799CF7ED8848748

Function 00007FFDA34A4360 Relevance: 10.5, APIs: 7, Instructions: 33fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4373
CreateFileA.KERNEL32 ref: 00007FFDA34A43A2
GetLastError.KERNEL32 ref: 00007FFDA34A43B5
GetFileSize.KERNEL32 ref: 00007FFDA34A43C4
CloseHandle.KERNEL32 ref: 00007FFDA34A43DA
GetLastError.KERNEL32 ref: 00007FFDA34A43E0

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorFileLast$CloseConcurrency::details::CreateEmptyHandleQueue::SizeStructuredWork
String ID:
API String ID: 1161490322-0
Opcode ID: 1dea7533e81207ac8a784632e534d43140b698bbcad88c187d8879aa26368a2d
Instruction ID: 33f30d142d2e5ac23c422a689420c7e0e305e5ec8a8530734b391c8f8492169f
Opcode Fuzzy Hash: 1dea7533e81207ac8a784632e534d43140b698bbcad88c187d8879aa26368a2d
Instruction Fuzzy Hash: B8013031A09A4182E310DB14F46836EB6B1FBC1765F600234D6AD96BE5CF7ED4858B04

Function 00007FFDA3488620 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA348863F
GetLastError.KERNEL32 ref: 00007FFDA3488652
GetProcAddress.KERNEL32 ref: 00007FFDA3488666
FreeLibrary.KERNEL32 ref: 00007FFDA348867E

Strings

getaddrinfo, xrefs: 00007FFDA348865A
ws2_32.dll, xrefs: 00007FFDA3488638

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: getaddrinfo$ws2_32.dll
API String ID: 2540614322-1292075177
Opcode ID: 2e17c17b20e4e39118e914fa3b5e4c7575d2cbd19b87fa64c5de521b5d5e2b13
Instruction ID: 3f8879cbec2e4bb6bf7ec74c88f53948ce18af5539835a4c72ae5642c8a1ce4f
Opcode Fuzzy Hash: 2e17c17b20e4e39118e914fa3b5e4c7575d2cbd19b87fa64c5de521b5d5e2b13
Instruction Fuzzy Hash: 88015E36A1DB45C6E620CF10F46426AB7A1FBC8794F500535EA8DA2B29CF7CD594CB04

Function 00007FFDA34880D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34880E9
GetProcAddress.KERNEL32 ref: 00007FFDA348810F
FreeLibrary.KERNEL32 ref: 00007FFDA3488127
GetLastError.KERNEL32 ref: 00007FFDA348812D

Strings

ws2_32.dll, xrefs: 00007FFDA34880E2
inet_pton, xrefs: 00007FFDA3488103

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: inet_pton$ws2_32.dll
API String ID: 2540614322-1244057378
Opcode ID: f72124b0816627394e4800e943be552c9ae965a8f5f9275f8fed54044a445383
Instruction ID: 2064b371c2a89ee47a058e48933568aff7f6052962a11a528ce5254470eed8de
Opcode Fuzzy Hash: f72124b0816627394e4800e943be552c9ae965a8f5f9275f8fed54044a445383
Instruction Fuzzy Hash: 5F014C76A1DB41C7E620DF10F85436AB772FB847A4F600235E68E92B69CFBDD5848B04

Function 00007FFDA34882C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34882D4
GetProcAddress.KERNEL32 ref: 00007FFDA34882FA
FreeLibrary.KERNEL32 ref: 00007FFDA3488312
GetLastError.KERNEL32 ref: 00007FFDA3488318

Strings

ws2_32.dll, xrefs: 00007FFDA34882CD
shutdown, xrefs: 00007FFDA34882EE

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: shutdown$ws2_32.dll
API String ID: 2540614322-1549006702
Opcode ID: 04e719e17db4c40d27fc3eeb3ad78a178e066fcb23fb87a825b186b968d0ada3
Instruction ID: e8219428754a71e768801f46f07bd975903fcc31ae302ff990890fe0a9745f3f
Opcode Fuzzy Hash: 04e719e17db4c40d27fc3eeb3ad78a178e066fcb23fb87a825b186b968d0ada3
Instruction Fuzzy Hash: 4E015A36A1DA41C7E620DB10F46432AB361FBC47A4F500231E58E92B69CFBDD5848B08

Function 00007FFDA3488040 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BBDAB,?,?,?,?,?,?,00007FFDA34BA88D), ref: 00007FFDA3488055
GetProcAddress.KERNEL32 ref: 00007FFDA348807B
FreeLibrary.KERNEL32 ref: 00007FFDA3488093
GetLastError.KERNEL32 ref: 00007FFDA3488099

Strings

ws2_32.dll, xrefs: 00007FFDA348804E
WSAStartup, xrefs: 00007FFDA348806F

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: WSAStartup$ws2_32.dll
API String ID: 2540614322-1976915905
Opcode ID: b09a82c92f7f546557ada2d47e9566cf0baec7d7ecfa32dff5c5a9a1503d013e
Instruction ID: 1e6ff8d7c1dfb03db69305caacb9ead5e0509f0b8e7b9582ac3ebb133cb7185e
Opcode Fuzzy Hash: b09a82c92f7f546557ada2d47e9566cf0baec7d7ecfa32dff5c5a9a1503d013e
Instruction Fuzzy Hash: 55015E31A1DB41C2E620DB10F854329B361FB847A4F101235E58E92B69CFBDD5C48B04

Function 00007FFDA3488240 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BB073,?,?,?,?,00007FFDA34BAB83), ref: 00007FFDA3488250
GetProcAddress.KERNEL32 ref: 00007FFDA3488276
FreeLibrary.KERNEL32 ref: 00007FFDA348828E
GetLastError.KERNEL32 ref: 00007FFDA3488294

Strings

closesocket, xrefs: 00007FFDA348826A
ws2_32.dll, xrefs: 00007FFDA3488249

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: closesocket$ws2_32.dll
API String ID: 2540614322-181964208
Opcode ID: 3fefd687c93cc16ac5c0f73265be1874ef04f7f879d6f0608bedc8a6b0f68dc9
Instruction ID: 538bc9062aff60cd4fb7deaf7a51fa41b909b1ba243f59384fba7106b50417ba
Opcode Fuzzy Hash: 3fefd687c93cc16ac5c0f73265be1874ef04f7f879d6f0608bedc8a6b0f68dc9
Instruction Fuzzy Hash: 1D011D35A1EE42C6E620DB10F864369B371FBC4764F501231E58E92BA5CFBDD5C58B08

Function 00007FFDA34881D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BB079,?,?,?,?,00007FFDA34BAB83), ref: 00007FFDA34881DB
GetProcAddress.KERNEL32 ref: 00007FFDA3488201
FreeLibrary.KERNEL32 ref: 00007FFDA3488219
GetLastError.KERNEL32 ref: 00007FFDA348821F

Strings

WSACleanup, xrefs: 00007FFDA34881F5
ws2_32.dll, xrefs: 00007FFDA34881D4

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: WSACleanup$ws2_32.dll
API String ID: 2540614322-2677834364
Opcode ID: d4c9f652633523056b2cb113cf7c70b1b34af1ea84f87650ba350b30f5e514b2
Instruction ID: 0d6da7741c9b1baac1a856370659a99ac193668b81c80da1d03c09a86eb0045a
Opcode Fuzzy Hash: d4c9f652633523056b2cb113cf7c70b1b34af1ea84f87650ba350b30f5e514b2
Instruction Fuzzy Hash: 25F0AF35B1EE42C7F2209B14F864369B371FB847A4F501231E58E92B65CFBDD5848B08

Function 00007FFDA3488160 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BAD2F), ref: 00007FFDA348816B
GetProcAddress.KERNEL32 ref: 00007FFDA3488191
FreeLibrary.KERNEL32 ref: 00007FFDA34881A9
GetLastError.KERNEL32 ref: 00007FFDA34881AF

Strings

WSAGetLastError, xrefs: 00007FFDA3488185
ws2_32.dll, xrefs: 00007FFDA3488164

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: WSAGetLastError$ws2_32.dll
API String ID: 2540614322-1955703101
Opcode ID: fe3d982a96a16abdc97643669944ad9cefe5dc86cd7eec1d1c0fa1a680c5434b
Instruction ID: 73852047d22b292504767087b4ee06243a3562d9ceb91f45c2e8af054d6c7416
Opcode Fuzzy Hash: fe3d982a96a16abdc97643669944ad9cefe5dc86cd7eec1d1c0fa1a680c5434b
Instruction Fuzzy Hash: 4EF04F35A1EA42C7E620DB10F864369B362FB94764F501231E58E92B65CFBDD5848B08

Function 00007FFDA34C3018 Relevance: 9.2, APIs: 6, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDA34C3088
MultiByteToWideChar.KERNEL32 ref: 00007FFDA34C3126
LCMapStringEx.KERNEL32 ref: 00007FFDA34C318F
LCMapStringEx.KERNEL32 ref: 00007FFDA34C31E1
LCMapStringEx.KERNEL32 ref: 00007FFDA34C3286
WideCharToMultiByte.KERNEL32 ref: 00007FFDA34C32E0

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e599737eeba393ba2e7364258460f95dd52f47ec3c249f4a66a619b501052b22
Instruction ID: 57b604d832e6cd2e07de15317683424662ac96d48666ad83ba4cc5063f548e8b
Opcode Fuzzy Hash: e599737eeba393ba2e7364258460f95dd52f47ec3c249f4a66a619b501052b22
Instruction Fuzzy Hash: 0E81D472B0A74186EB208F19E46027A7292FF44BE4F144631FA5D93BDADFBDD4418708

Function 00007FFDA34BACA0 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 00007FFDA34BACEE

Part of subcall function 00007FFDA34C4720: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C4770
Part of subcall function 00007FFDA34C4720: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C47B1

std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BAD60
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34BADB5
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BAE2F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34BAECD
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BAF92

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: std::runtime_error::runtime_error$Concurrency::details::EmptyQueue::StructuredWork$ExceptionFileHeaderRaisestd::bad_exception::bad_exception
String ID:
API String ID: 3965443834-0
Opcode ID: 0d4e2dfe6f9cec561199eb6ced0db4a94df36823f4d8a24ec355e669d2707ef8
Instruction ID: 4c9d1476c32bb0f28531e2666e2a71eb9dabca8acbd7e83f2657a869e231c97a
Opcode Fuzzy Hash: 0d4e2dfe6f9cec561199eb6ced0db4a94df36823f4d8a24ec355e669d2707ef8
Instruction Fuzzy Hash: 21911A3270E6828AD760DB24E4A17AAB7A1EBC4744F404131E68DD3BAADF7DD945CF04

Function 00007FFDA34A8530 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 00007FFDA34A85E4

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: 7474813165e588f6f20f2e4cb041319f60019012d1210d351f19dbeef243aec6
Instruction ID: 3a492a1cde922309f3757b63f993385fcfdb975213dcd4df2fa957dfaa3e7e55
Opcode Fuzzy Hash: 7474813165e588f6f20f2e4cb041319f60019012d1210d351f19dbeef243aec6
Instruction Fuzzy Hash: 24810032A0E6C186E620DB65E4603BEB7A2FBC5740F504436E68DA7B9BDE7DD404CB44

Function 00007FFDA34ADBC0 Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FFDA34ADCD7
shared_ptr.LIBCMTD ref: 00007FFDA34ADCEE
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34ADE45
std::ios_base::width.LIBCPMTD ref: 00007FFDA34ADEAA

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::EmptyMpunctQueue::StructuredWorkshared_ptrstd::ios_base::width
String ID:
API String ID: 2515095778-0
Opcode ID: cc37aa2f08600195c4d40083c9100ee5bb4f7a66da4c1f895df5384b038f517e
Instruction ID: 41cab85c1b613af2349174f4a9d6c7e6431f1ea8b54436af76e22767d49cf53c
Opcode Fuzzy Hash: cc37aa2f08600195c4d40083c9100ee5bb4f7a66da4c1f895df5384b038f517e
Instruction Fuzzy Hash: FB81E63261DAC595DA70EB11E4603EBA762FBC8780F804432EACD93B9ADE6DD544CB44

Function 00007FFDA34C246C Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFDA34C24BD
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C24DC
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C24FE
sys_get_time.LIBCPMT ref: 00007FFDA34C2519
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C253F
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C2557

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
String ID:
API String ID: 184115430-0
Opcode ID: 2419752cfd1b9c9900042bb42ff48b6b6b5b9f09afe652682e084dd5a96abbf7
Instruction ID: 323aa0451d4b418a93e99a982619acf066312a287c271b9094cd17ea20c1ad2a
Opcode Fuzzy Hash: 2419752cfd1b9c9900042bb42ff48b6b6b5b9f09afe652682e084dd5a96abbf7
Instruction Fuzzy Hash: B0411F32B1A64286EFA48F18E47027A7362EB54B44F504031DA4DA6797DFFEE891C708

Function 00007FFDA349FBB0 Relevance: 9.1, APIs: 6, Instructions: 90threadCOMMON

Download Yara Rule

APIs

List.LIBCMTD ref: 00007FFDA349FBE6
std::_Atomic_long::operator=.LIBCONCRTD ref: 00007FFDA349FC19
atomic_compare_exchange.LIBCONCRTD ref: 00007FFDA349FC5C
GetCurrentThreadId.KERNEL32 ref: 00007FFDA349FC8F

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Atomic_long::operator=CurrentListThreadatomic_compare_exchangestd::_
String ID:
API String ID: 2550250828-0
Opcode ID: 932c88e282ccbfc92ed9550ae828c613280df863858bfd3a7e06f2706118e393
Instruction ID: 757baa7aae590ca319647eb91a65f4a8ccfb14a559e47c9a50d459118ca6bc19
Opcode Fuzzy Hash: 932c88e282ccbfc92ed9550ae828c613280df863858bfd3a7e06f2706118e393
Instruction Fuzzy Hash: 5731B931F0E74282EA20DB15E42527F6791FF81784F404136EA8D97B5BCE6DD500CB48

Function 00007FFDA34AC850 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

ctype.LIBCPMTD ref: 00007FFDA34AC9E1
_Mpunct.LIBCPMTD ref: 00007FFDA34ACA41
_Mpunct.LIBCPMTD ref: 00007FFDA34ACA81
std::ios_base::width.LIBCPMTD ref: 00007FFDA34ACE53

Strings

@, xrefs: 00007FFDA34ACBA8

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Mpunct$ctypestd::ios_base::width
String ID: @
API String ID: 3075750325-2766056989
Opcode ID: 79372846ecdc4f70b43a1b702baf31c287688e89bcffe4d267ae24acf13d0921
Instruction ID: 3e30d4ba706c94579cdc57728a214d199d24f6fb756e1d98dc784a16a37ddb1a
Opcode Fuzzy Hash: 79372846ecdc4f70b43a1b702baf31c287688e89bcffe4d267ae24acf13d0921
Instruction Fuzzy Hash: DDF10B32A0DAC585DA70DB15E4A43EFA762F7C8780F440432EACD93B6ADEADD541CB44

Function 00007FFDA34D2580 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D258F
FlsSetValue.KERNEL32(?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D25C5
FlsSetValue.KERNEL32(?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D25F2
FlsSetValue.KERNEL32(?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D2603
FlsSetValue.KERNEL32(?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D2614
SetLastError.KERNEL32(?,?,00000157727F97BC,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D262F

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 99c4fb7652d9ce38ef6bb4778c86f62a3b987b83f4fa8d24ff062a7d41f119d4
Instruction ID: d783be70ca006d625c2137e3a50fe9af34465ff1e23c5790b059aceac87eb0a1
Opcode Fuzzy Hash: 99c4fb7652d9ce38ef6bb4778c86f62a3b987b83f4fa8d24ff062a7d41f119d4
Instruction Fuzzy Hash: 3A118122B0F24242FA955375A67213962935F447F0F044738E93EB67DBDEAFE8408608

Function 00007FFDA34B84A0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B853C
CreateStreamOnHGlobal.OLE32(00000018,00000018), ref: 00007FFDA34B86B9
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8848

Strings

png, xrefs: 00007FFDA34B866C
&, xrefs: 00007FFDA34B8610

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::Concurrency::details::_CreateCriticalEmptyGlobalLock::_Queue::ReentrantScoped_lockScoped_lock::~_StreamStructuredWork
String ID: &$png
API String ID: 937857008-590921033
Opcode ID: 469256df4940998a6b6a9f97b8e87e3b9809380934d3a3bbe8bc8221eaec6767
Instruction ID: 8bf7175d463f3b2287746c48db01fb5e2121847fcc3efae83609bbb38fc1d759
Opcode Fuzzy Hash: 469256df4940998a6b6a9f97b8e87e3b9809380934d3a3bbe8bc8221eaec6767
Instruction Fuzzy Hash: 16B1F93261AA8186D760DF25E4A07AFB761FBC5784F505022E68E93B6ADF7DD844CF00

Function 00007FFDA34A9650 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FFDA34A9665
GetWindowTextW.USER32 ref: 00007FFDA34A96B7

Part of subcall function 00007FFDA34A61D0: _WChar_traits.LIBCPMTD ref: 00007FFDA34A61F6

Part of subcall function 00007FFDA34A4410: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4448
Part of subcall function 00007FFDA34A4410: WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4482
Part of subcall function 00007FFDA34A4410: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A44B5
Part of subcall function 00007FFDA34A4410: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A44D9
Part of subcall function 00007FFDA34A4410: WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4514

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A9703

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

GetLastError.KERNEL32 ref: 00007FFDA34A9743

Strings

W e: , xrefs: 00007FFDA34A976C

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ByteCharConcurrency::details::Concurrency::details::_CriticalEmptyLock::_MultiQueue::ReentrantScoped_lockScoped_lock::~_StructuredWideWindowWork$Char_traitsErrorForegroundLastTextchar_traits
String ID: W e:
API String ID: 3735979991-3170417794
Opcode ID: f1407232e072fda95da15e61cd8e4a8da2bd02a319f69da54a8653bc12c24653
Instruction ID: 4ec4733c558f5c55dfda6c2d5a00264270f2f6300ce5dc847b0538fc89c7a407
Opcode Fuzzy Hash: f1407232e072fda95da15e61cd8e4a8da2bd02a319f69da54a8653bc12c24653
Instruction Fuzzy Hash: C531493261AAC186E7209B14E4903AAB7A2FBC4780F400032E6CD93B6ADF7DC544CF44

Function 00007FFDA34B7190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57processCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B7234
CreateProcessW.KERNEL32 ref: 00007FFDA34B727D
CloseHandle.KERNEL32 ref: 00007FFDA34B7288
CloseHandle.KERNEL32 ref: 00007FFDA34B7293

Strings

h, xrefs: 00007FFDA34B7221

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CloseHandle$Concurrency::details::CreateEmptyProcessQueue::StructuredWork
String ID: h
API String ID: 4039953145-2439710439
Opcode ID: 1fb3b1661452321f49f255d9558171575636aca6ab531ad18d52b59ca12d7b4b
Instruction ID: 3af31c94ba3a3b64fc5195f6be8886fe07902abe9e0b2099e74f2e92e9340643
Opcode Fuzzy Hash: 1fb3b1661452321f49f255d9558171575636aca6ab531ad18d52b59ca12d7b4b
Instruction Fuzzy Hash: AB210C32619BC596DB20DB50F4A43AAB7A2F7C4784F504135E68D83BA9DF7DD158CB00

Function 00007FFDA3495840 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00007FFDA34958F8
std::ios_base::failure::failure.LIBCPMTD ref: 00007FFDA349590A

Part of subcall function 00007FFDA34C4720: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C4770
Part of subcall function 00007FFDA34C4720: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C47B1

Strings

ios_base::badbit set, xrefs: 00007FFDA34958BB
ios_base::failbit set, xrefs: 00007FFDA34958D4
ios_base::eofbit set, xrefs: 00007FFDA34958E2

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ExceptionFileHeaderRaisestd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1846417002-1866435925
Opcode ID: b43a7e3578587d706e7b548345c629502e0c54278e9975b3f49c218492a832f3
Instruction ID: 48fec6a405866ab8586c6b613013d6e188dd958ea6267f4e967d955b7c75f1e0
Opcode Fuzzy Hash: b43a7e3578587d706e7b548345c629502e0c54278e9975b3f49c218492a832f3
Instruction Fuzzy Hash: 7D216D32B0E6858AE770DB14E4613AA77A5FB88380F604075E6CDD3B5ADF6DD514CB08

Function 00007FFDA3488340 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA348835F
GetProcAddress.KERNEL32 ref: 00007FFDA3488385
FreeLibrary.KERNEL32 ref: 00007FFDA348839D

Strings

recv, xrefs: 00007FFDA3488379
ws2_32.dll, xrefs: 00007FFDA3488358

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: recv$ws2_32.dll
API String ID: 145871493-734160684
Opcode ID: 121e80b15e865c187d828cee44cba9d0fed0f36d3c849a73d0b7ed05107ab776
Instruction ID: c399aeb4a116ce890aac8dec93d0b915e09262ec30843d176553683bf652d8dd
Opcode Fuzzy Hash: 121e80b15e865c187d828cee44cba9d0fed0f36d3c849a73d0b7ed05107ab776
Instruction Fuzzy Hash: FD015B76A1DB81C7D720CB10F85422EB761FB887A4F501235EA8D93BA9CFBDD5948B04

Function 00007FFDA3488590 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34885AE
GetProcAddress.KERNEL32 ref: 00007FFDA34885D1
FreeLibrary.KERNEL32 ref: 00007FFDA34885E9

Strings

inet_ntop, xrefs: 00007FFDA34885C5
ws2_32.dll, xrefs: 00007FFDA34885A7

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: inet_ntop$ws2_32.dll
API String ID: 145871493-102659834
Opcode ID: c59f4af2208141b044d29c11331e9f013cc3aa828399f6e03293c1c1ef900ac2
Instruction ID: a7d6cec058aa267a12e1d150763dcbe2c94f47d826ef170c2ae8775ea521b95f
Opcode Fuzzy Hash: c59f4af2208141b044d29c11331e9f013cc3aa828399f6e03293c1c1ef900ac2
Instruction Fuzzy Hash: 66010576A1DB85C2D660CF10F45436AB3A2FB98794F500535EA8E92B29CFBCD1948B08

Function 00007FFDA3488480 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA348849A
GetProcAddress.KERNEL32 ref: 00007FFDA34884C0
FreeLibrary.KERNEL32 ref: 00007FFDA34884D8

Strings

ws2_32.dll, xrefs: 00007FFDA3488493
connect, xrefs: 00007FFDA34884B4

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: connect$ws2_32.dll
API String ID: 145871493-3612281207
Opcode ID: f5f71e3294bcdaee4bc318451acc9ebf704ca82ba944e65828b1c7f76f833850
Instruction ID: 7e8a198b0c658dcbd9332d1eb6801cc1abb2b525ca932df5771e8e700bc2a7d7
Opcode Fuzzy Hash: f5f71e3294bcdaee4bc318451acc9ebf704ca82ba944e65828b1c7f76f833850
Instruction Fuzzy Hash: 70014C76A1DB41C2D660DF14F85032AB761FBC47A4F500235E68E82BA9DFBDD584CB04

Function 00007FFDA3487FB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDA34BA88D), ref: 00007FFDA3487FC8
GetProcAddress.KERNEL32 ref: 00007FFDA3487FF0
FreeLibrary.KERNEL32 ref: 00007FFDA3488008

Strings

ws2_32.dll, xrefs: 00007FFDA3487FC1
socket, xrefs: 00007FFDA3487FE4

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: socket$ws2_32.dll
API String ID: 145871493-3483875929
Opcode ID: cb9d8312e756911d49cd4f51c7db7d5e4ea26f9f0e7ec16d753f30e905b98c22
Instruction ID: a603addd9121d924a5cbc9dde7251501221e431f493f6a3e2efe0e2168524ad8
Opcode Fuzzy Hash: cb9d8312e756911d49cd4f51c7db7d5e4ea26f9f0e7ec16d753f30e905b98c22
Instruction Fuzzy Hash: AB011736A1AB8186D620CB15E45022AB761FB897B4F500335E6AD82BE9CFBDD5848F04

Function 00007FFDA34D1248 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFDA34D126D
GetProcAddress.KERNEL32 ref: 00007FFDA34D1283
FreeLibrary.KERNEL32 ref: 00007FFDA34D12AA

Strings

CorExitProcess, xrefs: 00007FFDA34D127C
mscoree.dll, xrefs: 00007FFDA34D1264

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72ebaf5c356ca3ee2904821ff4c5dd1cd3c14096ca2d9aba3ba6fdd35b476235
Instruction ID: dc1c5aa2cf0f5af80a3cda695bb1508729a0fef86102d5be660a1833360dfe4a
Opcode Fuzzy Hash: 72ebaf5c356ca3ee2904821ff4c5dd1cd3c14096ca2d9aba3ba6fdd35b476235
Instruction Fuzzy Hash: 7BF0C265B1A60281FA108B64E4653796362AF85BA0F580335CA6DE53F5CFAED0888308

Function 00007FFDA3488510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA3488520
GetProcAddress.KERNEL32 ref: 00007FFDA3488546
FreeLibrary.KERNEL32 ref: 00007FFDA348855E

Strings

ws2_32.dll, xrefs: 00007FFDA3488519
htons, xrefs: 00007FFDA348853A

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: htons$ws2_32.dll
API String ID: 145871493-1975133265
Opcode ID: 439baf8cef27b03b02ca0dfe2403df779e1052c0166b6725c54574d1b49bfcac
Instruction ID: c293985f83628798d86825107d7b6ec9e8bcbca862b6098210f10b1c52ebb9f5
Opcode Fuzzy Hash: 439baf8cef27b03b02ca0dfe2403df779e1052c0166b6725c54574d1b49bfcac
Instruction Fuzzy Hash: FC016D36A1EA42C2E7609B10E46433AB3A1FF84794F500136E58ED2BA5DFBDD5859B08

Function 00007FFDA34886C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34886D0
GetProcAddress.KERNEL32 ref: 00007FFDA34886F1
FreeLibrary.KERNEL32 ref: 00007FFDA3488709

Strings

freeaddrinfo, xrefs: 00007FFDA34886E5
ws2_32.dll, xrefs: 00007FFDA34886C9

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: freeaddrinfo$ws2_32.dll
API String ID: 145871493-447766333
Opcode ID: 6b8569ae28fb1e528403060c51b49f1547483ef8ef8edf79f62fa932a7e04958
Instruction ID: 366389cc99fa89df905d79cbcd552a668f9bb3cb7fa9c382576d09a6d8a16406
Opcode Fuzzy Hash: 6b8569ae28fb1e528403060c51b49f1547483ef8ef8edf79f62fa932a7e04958
Instruction Fuzzy Hash: E1F0F93AA1EA41C2E6209B10F864369B371FBC9798F600131D58E92B65CFBDD584C708

Function 00007FFDA34C5D28 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFDA34C5E4B
__AdjustPointer.LIBCMT ref: 00007FFDA34C5E96

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2c4cd24dc23d04e538900412c8b76dc8e884207eadeb2926ca5d18de86a86aa6
Instruction ID: 18b97a368eae33db430366af634a8d02ba42a898df0e96af639b23772748bd3a
Opcode Fuzzy Hash: 2c4cd24dc23d04e538900412c8b76dc8e884207eadeb2926ca5d18de86a86aa6
Instruction Fuzzy Hash: FEB1D431B0F74281FA65DB1A906417D6392EF44B86F098476DE8DA7787DFAEE4428308

Function 00007FFDA3496740 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 00007FFDA34967E3
fpos.LIBCPMTD ref: 00007FFDA349696B
fpos.LIBCPMTD ref: 00007FFDA34969A6
fpos.LIBCPMTD ref: 00007FFDA3496A19

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: f351de1dbd54376754315496ebcd0fc187e74d0cf5171b4e2e2ccbca7ab9123b
Instruction ID: 27b67b834ee511a65b5adf130fed4193d7b314309f4b59458245827c4df1681e
Opcode Fuzzy Hash: f351de1dbd54376754315496ebcd0fc187e74d0cf5171b4e2e2ccbca7ab9123b
Instruction Fuzzy Hash: 42A18D2270EB8585EAB0CB15E46036AB7A1F7C57A4F100235EAEDD3B9ACF6DD440CB04

Function 00007FFDA34D9800 Relevance: 7.7, APIs: 5, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDA34D983F
_set_statfp.LIBCMT ref: 00007FFDA34D985D
_set_statfp.LIBCMT ref: 00007FFDA34D9886
_set_statfp.LIBCMT ref: 00007FFDA34D9AC2

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c355139fb5d490f5a378c13f74b27d4e88c3ad045c11d9cfe0408108ad209acf
Instruction ID: 097c70b41600db91b15a9690c97e0ddc7b9cd53caada28e0764ebbb3ce5d71cc
Opcode Fuzzy Hash: c355139fb5d490f5a378c13f74b27d4e88c3ad045c11d9cfe0408108ad209acf
Instruction Fuzzy Hash: 1A812B13B0EA8645F2328B35A42037B6252FF457D4F084331E94EF6796EFBEE4818608

Function 00007FFDA34977C0 Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630393fca0c67851686c251f707a3871fec54fb42ba9ee963f6652eefca2e4fa
Instruction ID: 60d5b64152aaff84b319ac6b3d5a2ddd0ea2ca5b4fac1f9c04017846a3479dfd
Opcode Fuzzy Hash: 630393fca0c67851686c251f707a3871fec54fb42ba9ee963f6652eefca2e4fa
Instruction Fuzzy Hash: AC613A3260E6828AD760DB25E4613AEB7A1FBC4744F004135E68DD3BAADE7DD941CF04

Function 00007FFDA349F070 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

Concurrency::details::_Task_impl_base::_IsCompleted.LIBCPMTD ref: 00007FFDA349F10A
Concurrency::details::_Task_impl_base::_IsCanceled.LIBCPMTD ref: 00007FFDA349F11E
Concurrency::details::_Task_impl_base::_IsPendingCancel.LIBCPMTD ref: 00007FFDA349F132

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::_Task_impl_base::_$CancelCanceledCompletedPending
String ID:
API String ID: 253852663-0
Opcode ID: 96f5ec8156682c59687e470b00a6f89af41b73d4884fafaf8d6d2f3c44f2daaa
Instruction ID: ee2e4d35468fd926b2ab8facb3e7f462ce54b9dbd14011b4bc0025f0e1c4a410
Opcode Fuzzy Hash: 96f5ec8156682c59687e470b00a6f89af41b73d4884fafaf8d6d2f3c44f2daaa
Instruction Fuzzy Hash: 4F516061B1E6C285EA30D725E8613BB6792FF81745F400036E6CD9779BCEAED8048B48

Function 00007FFDA34A4A90 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3487D30: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3487D3E
Part of subcall function 00007FFDA3487D30: _Max_value.LIBCPMTD ref: 00007FFDA3487D63
Part of subcall function 00007FFDA3487D30: _Min_value.LIBCPMTD ref: 00007FFDA3487D91

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4AC9
char_traits.LIBCPMTD ref: 00007FFDA34A4B2A
char_traits.LIBCPMTD ref: 00007FFDA34A4B4D
char_traits.LIBCPMTD ref: 00007FFDA34A4BDE

Part of subcall function 00007FFDA34A73D0: wmemset.LIBCMTD ref: 00007FFDA34A73F3

char_traits.LIBCPMTD ref: 00007FFDA34A4C06

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valuewmemset
String ID:
API String ID: 1140703174-0
Opcode ID: 28118e790413db02ba06dbb63724687c31dc690438f373b7df5c7ec3ffc14a31
Instruction ID: 9ef2c867029fe50854c9977d040ea11fe87003b8e2a44625901e0db3244c27ea
Opcode Fuzzy Hash: 28118e790413db02ba06dbb63724687c31dc690438f373b7df5c7ec3ffc14a31
Instruction Fuzzy Hash: 8B413126A1EB8182CA10EB15F0A116EB7A1FBC9B84F101531FB8D93B6ADF7DD500CB44

Function 00007FFDA34A4410 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4448
WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4482
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A44B5
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A44D9
WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4514

Part of subcall function 00007FFDA34A6340: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A63C7

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$ByteCharMultiWide$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 3668445282-0
Opcode ID: feb59e4277cd1bc07c5903275af858b3bdc952d6bc7b52214309763333dbf615
Instruction ID: 148e54ef1d137c384dd82f00ca59e1c73079700ae36ce34984c1f5a433e7678a
Opcode Fuzzy Hash: feb59e4277cd1bc07c5903275af858b3bdc952d6bc7b52214309763333dbf615
Instruction Fuzzy Hash: D531D532609B8086E710DB11F4A03ABB7A2FBC5780F504035E6CD97BAADF7DD5448B84

Function 00007FFDA34CF278 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CF2A3
CreateThread.KERNEL32 ref: 00007FFDA34CF2E4
GetLastError.KERNEL32 ref: 00007FFDA34CF2F2
CloseHandle.KERNEL32 ref: 00007FFDA34CF308
FreeLibrary.KERNEL32 ref: 00007FFDA34CF317

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 48142ec23890b9d666768e3bec8b18f94dd262d1b6a98ec5d17004b6353bfdbe
Instruction ID: 254c642c4378a44b0e57ebfe056d6db493a3d2d98aa59e9c2528dc2f1d39313d
Opcode Fuzzy Hash: 48142ec23890b9d666768e3bec8b18f94dd262d1b6a98ec5d17004b6353bfdbe
Instruction Fuzzy Hash: C221B03AB0A74295EE15DF69A420079A3A2BF84BC4F044432DE4DA3766DFBEE441C708

Function 00007FFDA34E4D88 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDA34E4DB0
_set_statfp.LIBCMT ref: 00007FFDA34E4DCB
_set_statfp.LIBCMT ref: 00007FFDA34E4DE7
_set_statfp.LIBCMT ref: 00007FFDA34E4E23

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: 66fee999b0592df2276595fe66a59b1db24af4072010bedc5a1abc6515b6ab52
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: F6118222F59A0309F6641168D4773FA12436F54370F290634E96EE6BD78E9EAC518308

Function 00007FFDA34D2648 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D2667
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D2686
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D26AE
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D26BF
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D26D0

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f392ead5c2402b695ac5974281e609e0a9cbbdca401f54ec29472a1a5a69b6c8
Instruction ID: 263300780ad994cb19b689362772da8c6fa7b1b33902d77bc116acc892dd37fe
Opcode Fuzzy Hash: f392ead5c2402b695ac5974281e609e0a9cbbdca401f54ec29472a1a5a69b6c8
Instruction Fuzzy Hash: B8117222F0F34241FA995365B97217952836F447E0F044339E43DB67EBDEAEE8418608

Function 00007FFDA34D24DC Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24ED
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D250C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2534
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2545
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2556

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8179554ecb27d0102576b7f0af1687fec2ab00c2ce3b392d2b49e69ec44a7df3
Instruction ID: 73f195dba91e885b7d225ef88e2a485c946daccf568d39822391a88dabd31b12
Opcode Fuzzy Hash: 8179554ecb27d0102576b7f0af1687fec2ab00c2ce3b392d2b49e69ec44a7df3
Instruction Fuzzy Hash: 01111C22F0B20245FAD9A275687257912834F417E0F044738D93EFA3D7EDAFB841820C

Function 00007FFDA34C6928 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDA34C6AC6

Strings

csm, xrefs: 00007FFDA34C6A6F
csm, xrefs: 00007FFDA34C6A0D
csm, xrefs: 00007FFDA34C6AED

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Is_bad_exception_allowed
String ID: csm$csm$csm
API String ID: 2758241748-393685449
Opcode ID: 13a2de92f2e39b7531bb161bb28b9f9a2f294045cf3d54dfe874a6e248b54c91
Instruction ID: 400167111d7e6fcf41a49bd264c26420e8dc39d9566970f91772a8370a440b95
Opcode Fuzzy Hash: 13a2de92f2e39b7531bb161bb28b9f9a2f294045cf3d54dfe874a6e248b54c91
Instruction Fuzzy Hash: 39E1D132A096828AF7509F29D4A03BC7BA2FB45758F148135DA8CA7757DF7EE481CB04

Function 00007FFDA34D82D4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D85B3

Part of subcall function 00007FFDA34E19F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E1A11

Strings

UTF-8, xrefs: 00007FFDA34D8532
ccs, xrefs: 00007FFDA34D84EE
UTF-16LEUNICODE, xrefs: 00007FFDA34D8551

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 9c074e74fd5dc6cc1806d2faeca8c8f3fc210e7cbb7ac2085ce62ec2b0afb228
Instruction ID: c604ce50e62b96c3f53bedc4e81ad57baaab2e9ca0e0e0c578fc6822dfaceae4
Opcode Fuzzy Hash: 9c074e74fd5dc6cc1806d2faeca8c8f3fc210e7cbb7ac2085ce62ec2b0afb228
Instruction Fuzzy Hash: 0A816773F0A20285F7B59F19C57027826A2AB11BC4F558035CA0DF7796DBBFE9019709

Function 00007FFDA34D8010 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D82B9

Part of subcall function 00007FFDA34E1BDC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E1BF9

Strings

UTF-16LEUNICODE, xrefs: 00007FFDA34D825D
UTF-8, xrefs: 00007FFDA34D823C
ccs, xrefs: 00007FFDA34D8205

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 74bdf59a1e8fe539b158b1a802dc5fae1fa075619af3bed7d04690940e11275d
Instruction ID: 1e51e34258711ca08ad0645a83ef05663ff4a1a995e471e5c88d977ff588d175
Opcode Fuzzy Hash: 74bdf59a1e8fe539b158b1a802dc5fae1fa075619af3bed7d04690940e11275d
Instruction Fuzzy Hash: F7819333F0E64289F7754B29D67437C2B92AF527C4F595035CA0AF6397CAAFA8058309

Function 00007FFDA34D8B10 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 204fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00008000), ref: 00007FFDA34D8BDE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00008000), ref: 00007FFDA34D8D85

Strings

SRCR, xrefs: 00007FFDA34D8DBF
RCR, xrefs: 00007FFDA34D8BCE

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: RCR$SRCR
API String ID: 1948546556-2591298178
Opcode ID: 586b136ce8644c6ec137099a25725316719ca72ae6105a32eec3cfa5507b0a73
Instruction ID: 0584371971fc0c9718a2ee63405feb2b4f86bba77c86d9aea0ee2b04ae4c0808
Opcode Fuzzy Hash: 586b136ce8644c6ec137099a25725316719ca72ae6105a32eec3cfa5507b0a73
Instruction Fuzzy Hash: 47911513B1E6C585FB615A2494643B86BC2BB52FD4F184232D69DA73D7CABEE440C309

Function 00007FFDA34C709C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDA34C710C
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDA34C7157

Strings

RCC, xrefs: 00007FFDA34C7128
MOC, xrefs: 00007FFDA34C7120

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8cd02e8cba5055ee867d26c7a08f41aabd6380dba5d3ecf13f2aaed9126bfb2d
Instruction ID: 1f3dc11fd7dc7c4bb468a4d6b680a15e62813feeb65c7b64a277bdef36ef8989
Opcode Fuzzy Hash: 8cd02e8cba5055ee867d26c7a08f41aabd6380dba5d3ecf13f2aaed9126bfb2d
Instruction Fuzzy Hash: 4791A173B097818AE710CB69E8A02AD7BB1F744788F104126EF8C67B56DF79D195CB04

Function 00007FFDA34C56B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C56E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFDA34C577A
RtlUnwindEx.KERNEL32 ref: 00007FFDA34C57D4

Strings

csm, xrefs: 00007FFDA34C5761

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 265ea48305644b817d5518f26b2426f1599f0e92365fc373ba274e768d46161f
Instruction ID: df08a0ac18de3e59eaeb04b984e0238da87328ff5e3b8ba29df3d687dbbfd1b3
Opcode Fuzzy Hash: 265ea48305644b817d5518f26b2426f1599f0e92365fc373ba274e768d46161f
Instruction Fuzzy Hash: 0651E531B1B6068AEB54CF1AE464A7C3392FB40B99F144171DA4E93746DFBEE891C704

Function 00007FFDA34C6E2C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDA34C6E8B
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDA34C6ED7

Strings

RCC, xrefs: 00007FFDA34C6EA7
MOC, xrefs: 00007FFDA34C6E9F

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5857cf24f1b6541e0db60816518d10e6407131af82c64cb5755d45eb63a1e946
Instruction ID: 0bfd5a214d38eae89f962c306427fe785f033ed5f0ff3b262873c436e4335c11
Opcode Fuzzy Hash: 5857cf24f1b6541e0db60816518d10e6407131af82c64cb5755d45eb63a1e946
Instruction Fuzzy Hash: CF61C332A09BC586E761CB19E4503AEB7A1FB85B94F044235EB9C57B96CFBDD090CB04

Function 00007FFDA34C761C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C7644
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFDA34C772C

Strings

csm, xrefs: 00007FFDA34C777E
csm, xrefs: 00007FFDA34C7666

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 48025d63aa6b6047f6d04173f3c05d04317f6c028d3daaca8f8c7585a31a2b89
Instruction ID: 95482aed25bfdf5dd95e0219d9a1519d4dcd92b4341f3df494dfb3d0a8c0b278
Opcode Fuzzy Hash: 48025d63aa6b6047f6d04173f3c05d04317f6c028d3daaca8f8c7585a31a2b89
Instruction Fuzzy Hash: F451B432B0A2458FDB748B1990642787BA2FB50B94F144135DB5C97B97CFBDE450CB09

Function 00007FFDA34A7CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDA34A7DD8

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 36a5356689fcb8d2607656b835cc6e0f026fc37f9764631d1787b7af226b8ab8
Instruction ID: 69d9576d81460c621d15ffae99958a1ac6f79ec52a4772ea0ae79957e17500e3
Opcode Fuzzy Hash: 36a5356689fcb8d2607656b835cc6e0f026fc37f9764631d1787b7af226b8ab8
Instruction Fuzzy Hash: C6611D32A0E7C185E6709B55E0603BBBBA2FB81380F504435E68D97B9BDF6ED844CB05

Function 00007FFDA34B8110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32 ref: 00007FFDA34B8179
DeleteObject.GDI32 ref: 00007FFDA34B82F2
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B831C

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34B8380: CLSIDFromString.OLE32 ref: 00007FFDA34B83C7

Strings

jpg, xrefs: 00007FFDA34B818E

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::_CreateCriticalDeleteFromGlobalLock::_ObjectReentrantScoped_lockScoped_lock::~_StreamStringchar_traits
String ID: jpg
API String ID: 3472419032-1189616361
Opcode ID: 86eb31eb1de19e8a03d488835b784c104c0a7202ed47adf5df59e174cf309532
Instruction ID: 41cca05c6ecc892be8a0c469063ad88e18f218866f0dc94959207a7ba4bbfb19
Opcode Fuzzy Hash: 86eb31eb1de19e8a03d488835b784c104c0a7202ed47adf5df59e174cf309532
Instruction Fuzzy Hash: 0E51F932619A8582EB20DB15E4903AEB7A1F7C8B84F504522EBCD93B6ADF7DC544CF44

Function 00007FFDA3487DA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34C0E18: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FFDA3487DB1), ref: 00007FFDA34C0E2D

Part of subcall function 00007FFDA34C0DFC: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FFDA3487DBB), ref: 00007FFDA34C0E05

_Subatomic.LIBCONCRTD ref: 00007FFDA3487E0E
_Subatomic.LIBCONCRTD ref: 00007FFDA3487EAA

Strings

d, xrefs: 00007FFDA3487DDD

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: PerformanceQuerySubatomic$CounterFrequency
String ID: d
API String ID: 3831891851-2564639436
Opcode ID: f36356522a71dbb2b4534055f319af7a92a399f18409b5c24a9dfa018923f8ec
Instruction ID: b68f48fd0c2a9cf5de71f5b443b1563df2bbbfd792e2a03fef1c48e129b789e0
Opcode Fuzzy Hash: f36356522a71dbb2b4534055f319af7a92a399f18409b5c24a9dfa018923f8ec
Instruction Fuzzy Hash: C231FB2270AB8582DA709B19F4A136BB7A2F7C4794F005126E6CD87B6ADF7DD1148F04

Function 00007FFDA34A9030 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34A904B
GetProcAddress.KERNEL32 ref: 00007FFDA34A9096

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

GetUserNameW, xrefs: 00007FFDA34A908A
advapi32.dll, xrefs: 00007FFDA34A9044

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: AddressLibraryLoadProcchar_traits
String ID: GetUserNameW$advapi32.dll
API String ID: 1097116792-1952898584
Opcode ID: 80e5af94b1a02d1872650a55446e3730342baa81daa6dd7ec9b8264fd25396e9
Instruction ID: 342b447f57705063547d8c2b28e1503ff03fc80b05d1dbb5e48060ff441f339f
Opcode Fuzzy Hash: 80e5af94b1a02d1872650a55446e3730342baa81daa6dd7ec9b8264fd25396e9
Instruction Fuzzy Hash: D3412B32A1DAC582E620DB14E4A53AAB361FBC4784F401132E68DD7B6ADFBDD504CB04

Function 00007FFDA34D6C48 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFDA34D6CC7
WriteFile.KERNEL32 ref: 00007FFDA34D6F8F
WriteFile.KERNEL32 ref: 00007FFDA34D6FD5
GetLastError.KERNEL32 ref: 00007FFDA34D708B

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: cf44275678ca85f22590a109bd29db2bd094186d180eb530ce0a86cdfa5a6ae4
Instruction ID: 64fd509a1ce2147b9a8c2c896a155d1ce1e373244972b347b23eb7b311bb2a59
Opcode Fuzzy Hash: cf44275678ca85f22590a109bd29db2bd094186d180eb530ce0a86cdfa5a6ae4
Instruction Fuzzy Hash: E7D11133B09A8089EB11CF79D4502AC3BB2FB457D8B544236DE5DA7B9ADE7AD006C704

Function 00007FFDA34D7608 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDA34D75F3), ref: 00007FFDA34D7724
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDA34D75F3), ref: 00007FFDA34D77AF

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c7cbed1778484a4bb857a9e1385c60b8b35516ef06df28283499c270390ff4ad
Instruction ID: d82fd284eca5c5625f1ec2129aa6a13db3f46b30d5652651ff5020f143155bcd
Opcode Fuzzy Hash: c7cbed1778484a4bb857a9e1385c60b8b35516ef06df28283499c270390ff4ad
Instruction Fuzzy Hash: 5691F523F0965185F7508F2984A06BD7FA2AB01BD8F544139DE0EB3796DE7EE481C704

Function 00007FFDA3491940 Relevance: 6.2, APIs: 4, Instructions: 203COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491962
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491B0D
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491B22

Part of subcall function 00007FFDA3485970: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA348597E
Part of subcall function 00007FFDA3485970: _Max_value.LIBCPMTD ref: 00007FFDA34859A3
Part of subcall function 00007FFDA3485970: _Min_value.LIBCPMTD ref: 00007FFDA34859D1

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491C57

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
String ID:
API String ID: 348937374-0
Opcode ID: 9f84a68244e8d41638f94a4cdbedc62e82daed3d618e4f6bfc3aedd44e4120fa
Instruction ID: 3b939e59ba2f10dfa8fbb1577bce5a9823a0918f13f384a2f10cf24e796a8d75
Opcode Fuzzy Hash: 9f84a68244e8d41638f94a4cdbedc62e82daed3d618e4f6bfc3aedd44e4120fa
Instruction Fuzzy Hash: 47A1FE2660EB8585DA60DB56F49036FA7A1FBC9BC0F004136EACD93B6ADF6DD4408B04

Function 00007FFDA3496AE0 Relevance: 6.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 00007FFDA3496B7A
fpos.LIBCPMTD ref: 00007FFDA3496C40
fpos.LIBCPMTD ref: 00007FFDA3496C8F
fpos.LIBCPMTD ref: 00007FFDA3496D29

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: c457bf72074166e4b9cef871bf0dead07cf29958fd0af09302adcdb228af5cb4
Instruction ID: a96a88a624f2ddc6a83958fc435b50e13e8648e466b56cacd85428d8225a9a74
Opcode Fuzzy Hash: c457bf72074166e4b9cef871bf0dead07cf29958fd0af09302adcdb228af5cb4
Instruction Fuzzy Hash: 3361352261DA8186E6609B19E45136B67A1F7C47A4F140231FBEDD7BAACF6DD440CF04

Function 00007FFDA34A4570 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A45E1
MultiByteToWideChar.KERNEL32 ref: 00007FFDA34A4609

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ByteCharConcurrency::details::EmptyMultiQueue::StructuredWideWork
String ID:
API String ID: 729679527-0
Opcode ID: 4236cccfa5501a5c365e13e92fafc250830b1abf4ab8d273c8a49ddbe665ecc1
Instruction ID: e31c9561b05c2c7f1b10926c576c27e169fd5605640129dc4468c87dbe8cb680
Opcode Fuzzy Hash: 4236cccfa5501a5c365e13e92fafc250830b1abf4ab8d273c8a49ddbe665ecc1
Instruction Fuzzy Hash: 29413D32A1E68186E760DB21E4A136EB7A2FBC5780F405435EACE97B5ACF7DD444CB04

Function 00007FFDA34A3E50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34A3E9A
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34A3EBF
SHGetSpecialFolderPathW.SHELL32 ref: 00007FFDA34A3F13
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A3F72

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::_CriticalFolderLock::_PathReentrantScoped_lockScoped_lock::~_Special
String ID:
API String ID: 622896846-0
Opcode ID: dc0c5afa361903b5724841c68451c963996150cd95b8e63c5463ebf210f231a9
Instruction ID: 36751dd0e7eea17e03f892a871aad2aaffcf5ad9ec5a6d4152a903782051464a
Opcode Fuzzy Hash: dc0c5afa361903b5724841c68451c963996150cd95b8e63c5463ebf210f231a9
Instruction Fuzzy Hash: 2D417E32B1E68186EA70DB14E4A03AAB7A1FBC4384F400132E68DD7B6ADF7DD504CB04

Function 00007FFDA34A1040 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::_Task_impl_base::_IsCanceled.LIBCPMTD ref: 00007FFDA34A1069
Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FFDA34A1087

Part of subcall function 00007FFDA34A04D0: Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00007FFDA34A04E5

Concurrency::details::_Task_impl_base::_CancelWithExceptionHolder.LIBCPMTD ref: 00007FFDA34A10BA
Concurrency::details::_Task_impl_base::_Cancel.LIBCPMTD ref: 00007FFDA34A10D1

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::_Task_impl_base::_$CancelConcurrency::details::$Base::CanceledChoresExceptionGroupHolderProcessorProxyRoot::ScheduleSchedulerSegmentUnrealizedVirtualWith
String ID:
API String ID: 2137011280-0
Opcode ID: a2aa80b478cab4208770f9a38a893281dc2bd3f109e1b87810c811e64ecfc72b
Instruction ID: 25229929a398f45fae63592b796de00ed5c3fc17502dc44641f0821f722c9555
Opcode Fuzzy Hash: a2aa80b478cab4208770f9a38a893281dc2bd3f109e1b87810c811e64ecfc72b
Instruction Fuzzy Hash: F8214331B1EB8681DA50EB12E46027E7766FBC5784F401431FA8E97BABDF6DE0019B04

Function 00007FFDA34C2B88 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34C2AAC: GetModuleHandleExW.KERNEL32 ref: 00007FFDA34C2ABA

GetModuleHandleExW.KERNEL32 ref: 00007FFDA34C2BF0
FreeLibraryWhenCallbackReturns.KERNEL32 ref: 00007FFDA34C2C07

Part of subcall function 00007FFDA34C246C: GetCurrentThreadId.KERNEL32 ref: 00007FFDA34C24BD
Part of subcall function 00007FFDA34C246C: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C24DC

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34C2C8A

Part of subcall function 00007FFDA34C2474: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FFDA34C26B0,?,?,?,?,?,?,?,00007FFDA34C2A71), ref: 00007FFDA34C2486

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34C2C95

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Cpp_errorExclusiveHandleLockModuleThrow_std::_$AcquireCallbackCurrentFreeLibraryReleaseReturnsThreadWhen
String ID:
API String ID: 4220897459-0
Opcode ID: 553434353efcc6843571242b5b56ed9f1eb399787c4b19caa6d2ccb4c657e4b2
Instruction ID: 5633054462f24b053d6f473ad2b99fa862611ee2cbfb1f12205d6e1cc9e1edca
Opcode Fuzzy Hash: 553434353efcc6843571242b5b56ed9f1eb399787c4b19caa6d2ccb4c657e4b2
Instruction Fuzzy Hash: ED21FB20B0A60385FF559B29E8701B92263AF52740F140131D92DA63FBDEEFE894C61C

Function 00007FFDA3491240 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA3491250

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA349127D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA3491333

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: 822cb25b02a99ae88a5306ef9a32b2b0c088c945457889bc584b9dc35bc811c1
Instruction ID: 8dcbbdeaed186739bc1277ff98fb6cb9ed19be5c02430767567366bdb77d450c
Opcode Fuzzy Hash: 822cb25b02a99ae88a5306ef9a32b2b0c088c945457889bc584b9dc35bc811c1
Instruction Fuzzy Hash: B8214422A1EA4581DA60EB14F49126AB7A1FBC57A4F501132F68E93BBACE7DD540CB04

Function 00007FFDA34AB9C0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA34AB9D0

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA34AB9FD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34ABAB3

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: 18fd428ba416f35e6fa1d95c6dec4eb2c0224e670d38428d6e6994fa79728931
Instruction ID: 93503dadd02d048846ad43fefa8b252e781e4e1dc3c02b9870e65b608759acc1
Opcode Fuzzy Hash: 18fd428ba416f35e6fa1d95c6dec4eb2c0224e670d38428d6e6994fa79728931
Instruction Fuzzy Hash: 38215222B1EE8181DA50DB14F49126AB7A1FBC47A0F501132F6CE93BBACE7DD540CB04

Function 00007FFDA34AB8B0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA34AB8C0

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA34AB8ED
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34AB9A3

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: 793ac7056e05846943ffed5844e50566047ceb616486e047a5a9b9241643f175
Instruction ID: 7779539e5d19eaaeed6f8a12a878305519988e3052e6b93c5f6190cbba296080
Opcode Fuzzy Hash: 793ac7056e05846943ffed5844e50566047ceb616486e047a5a9b9241643f175
Instruction Fuzzy Hash: F8218422A1EE8581DA50DB14F49026EB3A1FBC47A0F501131F6CE93BBADE7DD540CB04

Function 00007FFDA34A5CD0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA34A5CE0

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA34A5D0D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34A5DC3

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: bf104d3b9130944ff705ff286039ef5e45dc00399c4ecc11af451a56ddf4ff63
Instruction ID: 1169f65ac18eca313bd4971e7dd75416c571b2187de510240ed915e7a8bb8273
Opcode Fuzzy Hash: bf104d3b9130944ff705ff286039ef5e45dc00399c4ecc11af451a56ddf4ff63
Instruction Fuzzy Hash: 5F214122A1EA8581DA50DB14F4912AAB7B1FBC47A0F501132F6DE93BBACE7DD540CB04

Function 00007FFDA34BE4A0 Relevance: 6.0, APIs: 4, Instructions: 46threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4C1
GetCurrentThreadId.KERNEL32 ref: 00007FFDA34BE4C7
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4DB
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE50A

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 27d73551e55d5d03b2179b481ebe71ff2a700cb18187dbb0179742bbf1b013cb
Instruction ID: a85b1261508b23a994f29778fa6721dcead41c1db702aba95c778e54d533f2f6
Opcode Fuzzy Hash: 27d73551e55d5d03b2179b481ebe71ff2a700cb18187dbb0179742bbf1b013cb
Instruction Fuzzy Hash: E601D82170A68957EB84A626F4613BA5293FBC4380F444435EF4DE37D7EDADE841DB04

Function 00007FFDA34B7140 Relevance: 6.0, APIs: 4, Instructions: 16COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFDA34B7144
OpenProcess.KERNEL32 ref: 00007FFDA34B715A
TerminateProcess.KERNEL32 ref: 00007FFDA34B716C
CloseHandle.KERNEL32 ref: 00007FFDA34B7177

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenTerminate
String ID:
API String ID: 983841585-0
Opcode ID: 597751426ef9b9c2102fe0f833c27338a46b029254865beae2c2f583087e8297
Instruction ID: b1e03702a3917c5451dd932c5a2b9f9ae72637c6dc530ef937e35ed6b43e9812
Opcode Fuzzy Hash: 597751426ef9b9c2102fe0f833c27338a46b029254865beae2c2f583087e8297
Instruction Fuzzy Hash: 73E0BF36B0994186E320DB26E814059F7B2FBCC755F544134DA8D92739DF7DD5C68B08

Function 00007FFDA34C7854 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C787E

Strings

csm, xrefs: 00007FFDA34C7A12
csm, xrefs: 00007FFDA34C78A3

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: f0672875b56e3e91f7387c99e9e7c8de2a70e4d1654d6aa75e53c9bd2162311b
Instruction ID: bed0bcdb7fd9ffc13307a1ebc512d8d5d8d9a1575459bc9aa65b01c37d89ff1a
Opcode Fuzzy Hash: f0672875b56e3e91f7387c99e9e7c8de2a70e4d1654d6aa75e53c9bd2162311b
Instruction Fuzzy Hash: 5D71B372B0A6818BD7608F29946077DBFA2FB40B84F148131DB8DA7B86DB7ED551C704

Function 00007FFDA34C7E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C7F3A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFDA34C7F63

Strings

csm, xrefs: 00007FFDA34C8063

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 241ff751386006dba430cfcaa452f65ea43404882c006d28022b8e43daf6fe6c
Instruction ID: 121359c83763e1817b2b8e676ec1d8986047a4d156e2bb88f155f8dab3efc516
Opcode Fuzzy Hash: 241ff751386006dba430cfcaa452f65ea43404882c006d28022b8e43daf6fe6c
Instruction Fuzzy Hash: 6751523271A74186D660DF2AE05026EB7B5F788BA1F100175EB8D9BB56CF7EE450CB08

Function 00007FFDA34D72E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDA34D73F7
GetLastError.KERNEL32 ref: 00007FFDA34D7419

Strings

U, xrefs: 00007FFDA34D73A3

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c00cc46764e3aacfe03c88eaead441a28a811676fc4d65fc1849a78bc9b4c519
Instruction ID: 92973f8b5a22be92648e85483cb4ed5fb197650bc7d921acc4721330612559f5
Opcode Fuzzy Hash: c00cc46764e3aacfe03c88eaead441a28a811676fc4d65fc1849a78bc9b4c519
Instruction Fuzzy Hash: EC41B433B19A8186EB108F25E4643AA6BA1FB887C4F444131EE4DD7799EF7DD441C744

Function 00007FFDA34C4720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C4770
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C47B1

Strings

csm, xrefs: 00007FFDA34C479E

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: dba6bd1a0ac2c8d099696e94e8611ae08bcb42e179612d15905ba0ed57ddee6c
Instruction ID: e45b2546f2e14a51f4caa16b0d5fa17e00e5bd7abc18eefdf9385d900e31c6db
Opcode Fuzzy Hash: dba6bd1a0ac2c8d099696e94e8611ae08bcb42e179612d15905ba0ed57ddee6c
Instruction Fuzzy Hash: 4D116D3260AB4082EB218F29F51026977E6FB88B94F584231DECC57759EF7DC551CB04

Function 00007FFDA34A12B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Concurrency::details::_Schedule_chore.LIBCPMT ref: 00007FFDA34A12C1

Part of subcall function 00007FFDA34C2B48: GetModuleHandleExW.KERNEL32 ref: 00007FFDA34C2B30
Part of subcall function 00007FFDA34C2B48: SubmitThreadpoolWork.KERNEL32 ref: 00007FFDA34C2B39
Part of subcall function 00007FFDA34C2B48: CreateThreadpoolWork.KERNEL32 ref: 00007FFDA34C2B5E

std::bad_exception::bad_exception.LIBCMTD ref: 00007FFDA34A1307

Strings

Fail to schedule the chore!, xrefs: 00007FFDA34A12FB

Memory Dump Source

Source File: 00000000.00000002.2185326672.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000000.00000002.2185313493.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185365820.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185383568.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185399378.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185411701.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185424642.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffda3480000_loaddll64.jbxd

Similarity

API ID: ThreadpoolWork$Concurrency::details::_CreateHandleModuleSchedule_choreSubmitstd::bad_exception::bad_exception
String ID: Fail to schedule the chore!
API String ID: 2088802962-3313369819
Opcode ID: 67acc1bff8d18671174b847d0d84192052f8b113a35ee0c6946b2bbfbef70b53
Instruction ID: 5b9a93ddb6eda0ec62e966f92071ef68a7b1cebc4894853bdf1154529ceb2133
Opcode Fuzzy Hash: 67acc1bff8d18671174b847d0d84192052f8b113a35ee0c6946b2bbfbef70b53
Instruction Fuzzy Hash: 7EF04422B1EB8681EA20EB14F4653697366FB85744F400530E58D977AADFBED144C708

Analysis Process: regsvr32.exePID: 5724, Parent PID: 3196COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFDA3485C20 Relevance: 75.5, APIs: 5, Strings: 38, Instructions: 235
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA3485CFD
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3485DD5
CreateMutexExW.KERNELBASE ref: 00007FFDA3485DE4
GetLastError.KERNEL32 ref: 00007FFDA3485DFD
std::bad_exception::bad_exception.LIBCMTD ref: 00007FFDA3485E53

Strings

D, xrefs: 00007FFDA3485C84
4, xrefs: 00007FFDA3485C75
3, xrefs: 00007FFDA3485C5C
2, xrefs: 00007FFDA3485C43
6, xrefs: 00007FFDA3485CA7
C, xrefs: 00007FFDA3485C98
6, xrefs: 00007FFDA3485C93
7, xrefs: 00007FFDA3485C3E
-, xrefs: 00007FFDA3485CA2
B, xrefs: 00007FFDA3485CDE
7, xrefs: 00007FFDA3485C48
B, xrefs: 00007FFDA3485C52
0, xrefs: 00007FFDA3485CB6
6, xrefs: 00007FFDA3485C9D
F, xrefs: 00007FFDA3485CD4
6, xrefs: 00007FFDA3485CC0
7, xrefs: 00007FFDA3485C39
9, xrefs: 00007FFDA3485C7F
E, xrefs: 00007FFDA3485C2F
}, xrefs: 00007FFDA3485CE3
-, xrefs: 00007FFDA3485C89
2, xrefs: 00007FFDA3485CB1
{, xrefs: 00007FFDA3485C2A
0, xrefs: 00007FFDA3485CC5
E, xrefs: 00007FFDA3485C4D
9, xrefs: 00007FFDA3485C8E
1, xrefs: 00007FFDA3485CBB
-, xrefs: 00007FFDA3485C70
-, xrefs: 00007FFDA3485C57
C, xrefs: 00007FFDA3485C6B
9, xrefs: 00007FFDA3485CD9
2, xrefs: 00007FFDA3485C34
6, xrefs: 00007FFDA3485C61
5, xrefs: 00007FFDA3485CAC
D, xrefs: 00007FFDA3485CCF
A, xrefs: 00007FFDA3485CCA
7, xrefs: 00007FFDA3485C66
A, xrefs: 00007FFDA3485C7A

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::CreateEmptyErrorFac_nodeFac_node::_LastMutexQueue::StructuredWorkstd::_std::bad_exception::bad_exception
String ID: -$-$-$-$0$0$1$2$2$2$3$4$5$6$6$6$6$6$7$7$7$7$9$9$9$A$A$B$B$C$C$D$D$E$E$F${$}
API String ID: 1149196539-2202459216
Opcode ID: c23fd9ccd435e09b8d6fabbe867b38cfc7cb505c9ffd75c4aa2e92c9946ef1c7
Instruction ID: 1a739cb218d9d2e1fcb8d4c306d2c1ff18591819e4ce9bc390a783d896db3949
Opcode Fuzzy Hash: c23fd9ccd435e09b8d6fabbe867b38cfc7cb505c9ffd75c4aa2e92c9946ef1c7
Instruction Fuzzy Hash: EBC1862160E6C185E7A1DB14E4643AEBB92EB92344F400035E3CD97BDBDFAED548CB09

Function 00007FFDA34860D0 Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFDA34860D9
OpenProcess.KERNEL32 ref: 00007FFDA34860EF
TerminateProcess.KERNELBASE ref: 00007FFDA3486101

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Process$CurrentOpenTerminate
String ID:
API String ID: 1665377759-0
Opcode ID: f438164aa293f679cc8d685dac6f048bff96706690f7a88d4d1aeed23efbc951
Instruction ID: 56cbdb1cfcec7b89421891b8137fec777f84d9df6e62d1323c4323657ac38337
Opcode Fuzzy Hash: f438164aa293f679cc8d685dac6f048bff96706690f7a88d4d1aeed23efbc951
Instruction Fuzzy Hash: 36E0BF36A09A4186D320DB65A814059F7A2FBCC745F548134D68D92729DF7DD1968B08

Non-executed Functions

Function 00007FFDA34E2500 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34E20E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E2125
Part of subcall function 00007FFDA34E20E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E21A3
Part of subcall function 00007FFDA34E20E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E21F4

CreateFileW.KERNEL32 ref: 00007FFDA34E2606
CreateFileW.KERNEL32 ref: 00007FFDA34E2656
GetLastError.KERNEL32 ref: 00007FFDA34E2686
GetFileType.KERNEL32 ref: 00007FFDA34E269B
GetLastError.KERNEL32 ref: 00007FFDA34E26A5
CloseHandle.KERNEL32 ref: 00007FFDA34E26D8
CloseHandle.KERNEL32 ref: 00007FFDA34E283B
CreateFileW.KERNEL32 ref: 00007FFDA34E2870
GetLastError.KERNEL32 ref: 00007FFDA34E287F

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 31f4d597e0a6cc1620dd34189c80ad889813dc24754eb01cce36e0114bd77507
Instruction ID: 4221a4fea999383377a046d333ddebf60b0cd00c7a3885456d6450d76875bae3
Opcode Fuzzy Hash: 31f4d597e0a6cc1620dd34189c80ad889813dc24754eb01cce36e0114bd77507
Instruction Fuzzy Hash: E2C1C137B25A4286EB10DF68D4A06AC3762FB49B98B104335DE2EA7396CF7AD455C304

Function 00007FFDA34DEE88 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

TranslateName.LIBCMT ref: 00007FFDA34DEEF2
TranslateName.LIBCMT ref: 00007FFDA34DEF2D
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FFDA34D2F90), ref: 00007FFDA34DEF74
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FFDA34D2F90), ref: 00007FFDA34DEFAC
GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DF169

Strings

utf8, xrefs: 00007FFDA34DF090

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 464451e8a7c017b7fe8d594a29d962222612a71da5a0740ad1618ad19dd93d6f
Instruction ID: f63726a5c05bc061a5d7a741b026dc9ff6778441b2271cbb144d738fd2239159
Opcode Fuzzy Hash: 464451e8a7c017b7fe8d594a29d962222612a71da5a0740ad1618ad19dd93d6f
Instruction Fuzzy Hash: 22919E33B0A74281EB649F21E5612B923A6FB44BC0F444536DA5CA7787DFBEE591C308

Function 00007FFDA34DF8D0 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D2408: GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
Part of subcall function 00007FFDA34D2408: FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
Part of subcall function 00007FFDA34D2408: SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D244D

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FFDA34DFA40

Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D247A
Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D248B
Part of subcall function 00007FFDA34D2408: FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D249C

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FFDA34D2F89), ref: 00007FFDA34DFA27
ProcessCodePage.LIBCMT ref: 00007FFDA34DFA6A
IsValidCodePage.KERNEL32 ref: 00007FFDA34DFA7C
IsValidLocale.KERNEL32 ref: 00007FFDA34DFA92
GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DFAEE
GetLocaleInfoW.KERNEL32 ref: 00007FFDA34DFB0A

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 6e470d9f2d7b73803100a9a2eb3339135561f8c11b01556d55fef5b7594b0bfb
Instruction ID: 6ee3bfcdb73d0751c8431ec58efa84f2f78fe03293a3893ef0f57d35b238935f
Opcode Fuzzy Hash: 6e470d9f2d7b73803100a9a2eb3339135561f8c11b01556d55fef5b7594b0bfb
Instruction Fuzzy Hash: 00716E33F0660299FB609B60D4617BC33A6AF44B84F444036CE0DA7796DFBEA945C718

Function 00007FFDA34A3530 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A35B8
FindFirstFileW.KERNEL32 ref: 00007FFDA34A35C8
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A372D
FindNextFileW.KERNEL32 ref: 00007FFDA34A37A9
FindClose.KERNEL32 ref: 00007FFDA34A37BC

Strings

/*.*, xrefs: 00007FFDA34A3588

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Find$File$CloseConcurrency::details::Concurrency::details::_CriticalEmptyFirstLock::_NextQueue::ReentrantScoped_lockScoped_lock::~_StructuredWork
String ID: /*.*
API String ID: 669816757-1014195128
Opcode ID: cce196c4780de0ee261d72a6a8be92af0337c90a253831200769ab8a909ca2ff
Instruction ID: 08be2c281efaeb016c0f70ba6d802a29832d52335b9c1b4b6de4709e80864360
Opcode Fuzzy Hash: cce196c4780de0ee261d72a6a8be92af0337c90a253831200769ab8a909ca2ff
Instruction Fuzzy Hash: AF715032A0EAC291DA70DB14E4613EEA361FBC4780F405532E68DD3BAAEF6DD545CB04

Function 00007FFDA34A3250 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A32D8
FindFirstFileW.KERNEL32 ref: 00007FFDA34A32E8
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A343A
FindNextFileW.KERNEL32 ref: 00007FFDA34A34B6
FindClose.KERNEL32 ref: 00007FFDA34A34C9

Part of subcall function 00007FFDA34A6340: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A63C7

Strings

/*.*, xrefs: 00007FFDA34A32A8

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Find$Concurrency::details::EmptyFileQueue::StructuredWork$CloseConcurrency::details::_CriticalFirstLock::_NextReentrantScoped_lockScoped_lock::~_
String ID: /*.*
API String ID: 771618737-1014195128
Opcode ID: 417e3439b01502627f2c3f68e797be1636a0383c23f555452f6b9c8aeea56bb4
Instruction ID: 00a23e70e961c213e6a81e284e3da387f936b41a65222caa9d02446540fcc48f
Opcode Fuzzy Hash: 417e3439b01502627f2c3f68e797be1636a0383c23f555452f6b9c8aeea56bb4
Instruction Fuzzy Hash: 74612C32A0EAC292D660DB14F4A13EEA361FBC4780F405532E69D93BAADF6DD544CB04

Function 00007FFDA34C40A0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA34C40BC
RtlCaptureContext.KERNEL32 ref: 00007FFDA34C40E9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA34C4103
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA34C4144
IsDebuggerPresent.KERNEL32 ref: 00007FFDA34C4198
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C41B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C41C0

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1fdbbc56d82b575a71ab0e7532a7e43e535db65f2d0fd3c01a85fe32ae7de389
Instruction ID: 759ffcdb70b4b0b041a7811beb8b14c3bb9d5dbccc326112a1b5b4c923f59785
Opcode Fuzzy Hash: 1fdbbc56d82b575a71ab0e7532a7e43e535db65f2d0fd3c01a85fe32ae7de389
Instruction Fuzzy Hash: 4E318F7270AB8186EB608F65E8503ED3361FB84744F50443ADB4E97B9ADF79C548CB04

Function 00007FFDA34C9238 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDA34C92B1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA34C92C9
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA34C9304
IsDebuggerPresent.KERNEL32 ref: 00007FFDA34C933D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C9347
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA34C9352

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 1300e7eb66910485c596afe65c521b45d2f063167b9c5b78a57fe06e37c487e2
Instruction ID: b3f8b129a9e9693b672e705a40e0b37200984a6e1010ce5c5b052f232f991c69
Opcode Fuzzy Hash: 1300e7eb66910485c596afe65c521b45d2f063167b9c5b78a57fe06e37c487e2
Instruction Fuzzy Hash: 77318032719B8186EB60CF29E8502EE33A5FB88754F500135EA9D93BAADF7DC545CB04

Function 00007FFDA34B9EF0 Relevance: 189.3, APIs: 3, Strings: 105, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34BA10D
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34BA275
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34BA3C9

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Part of subcall function 00007FFDA34BEE30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEE90

Part of subcall function 00007FFDA34920D0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34920E3

Part of subcall function 00007FFDA34831C0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 00007FFDA34831F3
Part of subcall function 00007FFDA34831C0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 00007FFDA348320D
Part of subcall function 00007FFDA34831C0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 00007FFDA3483239

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34917F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491803

Strings

d, xrefs: 00007FFDA34BA2EB
k, xrefs: 00007FFDA34BA2CD
n, xrefs: 00007FFDA34BA34A
6, xrefs: 00007FFDA34BA322
2, xrefs: 00007FFDA34BA2FF
N, xrefs: 00007FFDA34B9FB5
E, xrefs: 00007FFDA34BA309
X, xrefs: 00007FFDA34B9F85
1, xrefs: 00007FFDA34BA37C
q, xrefs: 00007FFDA34BA214
a, xrefs: 00007FFDA34BA0BD
J, xrefs: 00007FFDA34BA0B5
m, xrefs: 00007FFDA34BA025
q, xrefs: 00007FFDA34B9F95
3, xrefs: 00007FFDA34BA2E1
U, xrefs: 00007FFDA34BA045
e, xrefs: 00007FFDA34BA03D
H, xrefs: 00007FFDA34BA005
W, xrefs: 00007FFDA34BA2F5
V, xrefs: 00007FFDA34BA01D
,, xrefs: 00007FFDA34BA237
c, xrefs: 00007FFDA34BA05D
Z, xrefs: 00007FFDA34BA2DC
k, xrefs: 00007FFDA34BA2D2
S, xrefs: 00007FFDA34B9FDD
B, xrefs: 00007FFDA34BA1FB
3, xrefs: 00007FFDA34BA2F0
x, xrefs: 00007FFDA34BA205
e, xrefs: 00007FFDA34BA381
s, xrefs: 00007FFDA34BA2C3
N, xrefs: 00007FFDA34BA390
R, xrefs: 00007FFDA34BA35E
L, xrefs: 00007FFDA34BA075
0, xrefs: 00007FFDA34BA2E6
Z, xrefs: 00007FFDA34BA241
6, xrefs: 00007FFDA34BA359
c, xrefs: 00007FFDA34BA30E
N, xrefs: 00007FFDA34B9FCD
a, xrefs: 00007FFDA34BA21E
Z, xrefs: 00007FFDA34BA368
i, xrefs: 00007FFDA34BA2FA
R, xrefs: 00007FFDA34B9FFD
Z, xrefs: 00007FFDA34B9F8D
1, xrefs: 00007FFDA34BA095
4, xrefs: 00007FFDA34BA23C
R, xrefs: 00007FFDA34BA219
6, xrefs: 00007FFDA34BA377
=, xrefs: 00007FFDA34BA39A
V, xrefs: 00007FFDA34B9FBD
T, xrefs: 00007FFDA34BA09D
7, xrefs: 00007FFDA34BA340
Z, xrefs: 00007FFDA34BA07D
5, xrefs: 00007FFDA34BA34F
g, xrefs: 00007FFDA34BA22D
U, xrefs: 00007FFDA34BA228
J, xrefs: 00007FFDA34BA372
M, xrefs: 00007FFDA34BA246
=, xrefs: 00007FFDA34BA0D5
N, xrefs: 00007FFDA34BA035
I, xrefs: 00007FFDA34BA223
9, xrefs: 00007FFDA34BA20F
e, xrefs: 00007FFDA34BA386
z, xrefs: 00007FFDA34BA232
k, xrefs: 00007FFDA34BA33B
5, xrefs: 00007FFDA34BA36D
m, xrefs: 00007FFDA34BA318
2, xrefs: 00007FFDA34BA0C5
o, xrefs: 00007FFDA34BA015
T, xrefs: 00007FFDA34BA065
N, xrefs: 00007FFDA34BA00D
J, xrefs: 00007FFDA34BA04D
0, xrefs: 00007FFDA34B9FE5
n, xrefs: 00007FFDA34B9FC5
V, xrefs: 00007FFDA34BA085
t, xrefs: 00007FFDA34BA313
R, xrefs: 00007FFDA34B9F7D
n, xrefs: 00007FFDA34BA336
e, xrefs: 00007FFDA34BA2C8
R, xrefs: 00007FFDA34B9FAD
Q, xrefs: 00007FFDA34BA38B
F, xrefs: 00007FFDA34BA2D7
2, xrefs: 00007FFDA34B9FF5
E, xrefs: 00007FFDA34BA32C
D, xrefs: 00007FFDA34BA304
a, xrefs: 00007FFDA34BA327
U, xrefs: 00007FFDA34BA395
j, xrefs: 00007FFDA34B9FA5
A, xrefs: 00007FFDA34BA331
V, xrefs: 00007FFDA34BA06D
m, xrefs: 00007FFDA34BA363
k, xrefs: 00007FFDA34BA20A
N, xrefs: 00007FFDA34BA354
t, xrefs: 00007FFDA34B9FED
V, xrefs: 00007FFDA34B9F9D
h, xrefs: 00007FFDA34BA0AD
U, xrefs: 00007FFDA34BA345
n, xrefs: 00007FFDA34BA0A5
O, xrefs: 00007FFDA34BA200
I, xrefs: 00007FFDA34B9FD5
0, xrefs: 00007FFDA34BA0CD
Z, xrefs: 00007FFDA34BA02D
D, xrefs: 00007FFDA34BA31D
/**/, xrefs: 00007FFDA34BA591
Z, xrefs: 00007FFDA34BA08D
Z, xrefs: 00007FFDA34BA055

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::$Fac_nodeFac_node::_Factory::FreeProxyRetireThreadstd::_$Decorator::getEmptyQueue::StructuredTableTypeWork$char_traits
String ID: ,$/**/$0$0$0$1$1$2$2$2$3$3$4$5$5$6$6$6$7$9$=$=$A$B$D$D$E$E$F$H$I$I$J$J$J$L$M$N$N$N$N$N$N$O$Q$R$R$R$R$R$S$T$T$U$U$U$U$V$V$V$V$V$W$X$Z$Z$Z$Z$Z$Z$Z$Z$a$a$a$c$c$d$e$e$e$e$g$h$i$j$k$k$k$k$m$m$m$n$n$n$n$o$q$q$s$t$t$x$z
API String ID: 1768506830-3784889792
Opcode ID: ed4ddddc12d98e72ae5fe04b24863b89c5ffce575c5e63bf3c35c8c8b54d9598
Instruction ID: c7cb5f27a96057ffed64e1ef74c154076ba60fb9e3280debfa0dc3e272d0ffef
Opcode Fuzzy Hash: ed4ddddc12d98e72ae5fe04b24863b89c5ffce575c5e63bf3c35c8c8b54d9598
Instruction Fuzzy Hash: 4412122220EBC185E772D728E4643DBABA1E7D2744F444026E2CC47B9BDFAEC548CB15

Function 00007FFDA34A97B0 Relevance: 98.2, APIs: 9, Strings: 47, Instructions: 229
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A98E1
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A998F
RegOpenKeyExA.ADVAPI32 ref: 00007FFDA34A99B4
RegEnumKeyExA.ADVAPI32 ref: 00007FFDA34A9A6D
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A9AE3
RegOpenKeyExA.ADVAPI32 ref: 00007FFDA34A9B08
RegQueryValueExA.ADVAPI32 ref: 00007FFDA34A9B5C
RegCloseKey.ADVAPI32 ref: 00007FFDA34A9BF5
RegCloseKey.ADVAPI32 ref: 00007FFDA34A9C2C

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

C, xrefs: 00007FFDA34A9860
e, xrefs: 00007FFDA34A9874
\, xrefs: 00007FFDA34A982E
r, xrefs: 00007FFDA34A9888
s, xrefs: 00007FFDA34A981A
v, xrefs: 00007FFDA34A9892
\, xrefs: 00007FFDA34A97FC
E, xrefs: 00007FFDA34A97F7
, xrefs: 00007FFDA34A985B
displayName, xrefs: 00007FFDA34A9B4D
f, xrefs: 00007FFDA34A9824
T, xrefs: 00007FFDA34A97E3
r, xrefs: 00007FFDA34A98A6
e, xrefs: 00007FFDA34A9838
\, xrefs: 00007FFDA34A98AB
v, xrefs: 00007FFDA34A98B5
A, xrefs: 00007FFDA34A97ED
S, xrefs: 00007FFDA34A97D4
r, xrefs: 00007FFDA34A9879
t, xrefs: 00007FFDA34A9829
\, xrefs: 00007FFDA34A987E
o, xrefs: 00007FFDA34A981F
d, xrefs: 00007FFDA34A989C
M, xrefs: 00007FFDA34A9801
e, xrefs: 00007FFDA34A9865
W, xrefs: 00007FFDA34A97E8
i, xrefs: 00007FFDA34A9897
i, xrefs: 00007FFDA34A9806
O, xrefs: 00007FFDA34A97D9
A, xrefs: 00007FFDA34A98B0
n, xrefs: 00007FFDA34A986A
y, xrefs: 00007FFDA34A9856
t, xrefs: 00007FFDA34A986F
P, xrefs: 00007FFDA34A9883
u, xrefs: 00007FFDA34A9842
c, xrefs: 00007FFDA34A983D
r, xrefs: 00007FFDA34A9847
o, xrefs: 00007FFDA34A9815
c, xrefs: 00007FFDA34A980B
S, xrefs: 00007FFDA34A9833
R, xrefs: 00007FFDA34A97F2
r, xrefs: 00007FFDA34A9810
o, xrefs: 00007FFDA34A988D
t, xrefs: 00007FFDA34A9851
e, xrefs: 00007FFDA34A98A1
F, xrefs: 00007FFDA34A97DE
i, xrefs: 00007FFDA34A984C

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CloseConcurrency::details::EmptyOpenQueue::StructuredWork$EnumFac_nodeFac_node::_QueryValuechar_traitsstd::_
String ID: $A$A$C$E$F$M$O$P$R$S$S$T$W$\$\$\$\$c$c$d$displayName$e$e$e$e$f$i$i$i$n$o$o$o$r$r$r$r$r$s$t$t$t$u$v$v$y
API String ID: 1441156695-1915070847
Opcode ID: e4361326d0e3c8bc700f733f902279f19f363e10ede73ef7b9bac91b2170a774
Instruction ID: 35055f7304c524a11153f64fb0df9d43a3b9e9906e3402091b716a6fe59b230b
Opcode Fuzzy Hash: e4361326d0e3c8bc700f733f902279f19f363e10ede73ef7b9bac91b2170a774
Instruction Fuzzy Hash: 6BC1282260DAC186E721DB24E4543EBBBA1E7D1344F404126E3CC97BAADFBED548CB54

Function 00007FFDA34A91E0 Relevance: 94.7, APIs: 8, Strings: 46, Instructions: 217
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A9348

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A93BE
RegOpenKeyA.ADVAPI32 ref: 00007FFDA34A93D2
RegQueryValueExA.ADVAPI32 ref: 00007FFDA34A943C
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34A945A
RegQueryValueExA.ADVAPI32 ref: 00007FFDA34A948B
RegCloseKey.ADVAPI32 ref: 00007FFDA34A949E
RegCloseKey.ADVAPI32 ref: 00007FFDA34A954B

Part of subcall function 00007FFDA348FE90: char_traits.LIBCPMTD ref: 00007FFDA348FEC2
Part of subcall function 00007FFDA348FE90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA348FEFE

Strings

r, xrefs: 00007FFDA34A9308
S, xrefs: 00007FFDA34A9245
CurrentBuild, xrefs: 00007FFDA34A947F
e, xrefs: 00007FFDA34A92EF
i, xrefs: 00007FFDA34A92A9
T, xrefs: 00007FFDA34A9254
, xrefs: 00007FFDA34A92C7
r, xrefs: 00007FFDA34A92E5
n, xrefs: 00007FFDA34A92AE
C, xrefs: 00007FFDA34A92DB
W, xrefs: 00007FFDA34A92A4
O, xrefs: 00007FFDA34A924A
W, xrefs: 00007FFDA34A9259
c, xrefs: 00007FFDA34A927C
\, xrefs: 00007FFDA34A926D
R, xrefs: 00007FFDA34A9263
T, xrefs: 00007FFDA34A92D1
\, xrefs: 00007FFDA34A929F
w, xrefs: 00007FFDA34A92BD
A, xrefs: 00007FFDA34A925E
ProductName, xrefs: 00007FFDA34A9430
F, xrefs: 00007FFDA34A924F
t, xrefs: 00007FFDA34A929A
s, xrefs: 00007FFDA34A92C2
o, xrefs: 00007FFDA34A9290
e, xrefs: 00007FFDA34A9303
s, xrefs: 00007FFDA34A930D
r, xrefs: 00007FFDA34A92EA
f, xrefs: 00007FFDA34A9295
i, xrefs: 00007FFDA34A9277
i, xrefs: 00007FFDA34A9312
t, xrefs: 00007FFDA34A92F9
o, xrefs: 00007FFDA34A92B8
n, xrefs: 00007FFDA34A92F4
r, xrefs: 00007FFDA34A9281
o, xrefs: 00007FFDA34A9286
V, xrefs: 00007FFDA34A92FE
u, xrefs: 00007FFDA34A92E0
o, xrefs: 00007FFDA34A9317
s, xrefs: 00007FFDA34A928B
M, xrefs: 00007FFDA34A9272
d, xrefs: 00007FFDA34A92B3
n, xrefs: 00007FFDA34A931C
N, xrefs: 00007FFDA34A92CC
E, xrefs: 00007FFDA34A9268
\, xrefs: 00007FFDA34A92D6

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CloseConcurrency::details::EmptyQueryQueue::StructuredValueWork$Decorator::getFac_nodeFac_node::_OpenTableTypechar_traitsstd::_type_info::_name_internal_method
String ID: $A$C$CurrentBuild$E$F$M$N$O$ProductName$R$S$T$T$V$W$W$\$\$\$c$d$e$e$f$i$i$i$n$n$n$o$o$o$o$r$r$r$r$s$s$s$t$t$u$w
API String ID: 1239499685-786305380
Opcode ID: 13569eeb28de908d15b91c27bdb5b0d39f4d3520f413788c1801af54ad5c7272
Instruction ID: 6062cc7aa62aef948d616e0c52b71a61e3e8cb3c7e956702011da25b0a491166
Opcode Fuzzy Hash: 13569eeb28de908d15b91c27bdb5b0d39f4d3520f413788c1801af54ad5c7272
Instruction Fuzzy Hash: B7C15B2261D6C185E721DB24E4643DBBBA2EBD1744F400026E3CD97BAADFBED508CB14

Function 00007FFDA34B5B00 Relevance: 86.2, APIs: 11, Strings: 38, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5D30

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5DC0
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5E2D
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5EB8
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B5F10

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B5FC8
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B6008
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B6039

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B6187

Strings

k, xrefs: 00007FFDA34B5D07
t, xrefs: 00007FFDA34B5E9E
p, xrefs: 00007FFDA34B5D16
D, xrefs: 00007FFDA34B5E71
R, xrefs: 00007FFDA34B5CDA
a, xrefs: 00007FFDA34B5D97
K, xrefs: 00007FFDA34B5E04
o, xrefs: 00007FFDA34B5D11
t, xrefs: 00007FFDA34B5D0C
D, xrefs: 00007FFDA34B5CF8
n, xrefs: 00007FFDA34B5D92
o, xrefs: 00007FFDA34B5E85
m, xrefs: 00007FFDA34B5CE4
l, xrefs: 00007FFDA34B5E13
o, xrefs: 00007FFDA34B5CE9
e, xrefs: 00007FFDA34B5D83
n, xrefs: 00007FFDA34B5E8F
e, xrefs: 00007FFDA34B5E94
a, xrefs: 00007FFDA34B5D8D
g, xrefs: 00007FFDA34B5D9C
c, xrefs: 00007FFDA34B5E99
i, xrefs: 00007FFDA34B5E76
s, xrefs: 00007FFDA34B5E7B
t, xrefs: 00007FFDA34B5CEE
M, xrefs: 00007FFDA34B5D88
l, xrefs: 00007FFDA34B5E0E
F, xrefs: 00007FFDA34B5D74
c, xrefs: 00007FFDA34B5E80
n, xrefs: 00007FFDA34B5E8A
e, xrefs: 00007FFDA34B5CF3
e, xrefs: 00007FFDA34B5DA1
i, xrefs: 00007FFDA34B5D79
l, xrefs: 00007FFDA34B5D7E
s, xrefs: 00007FFDA34B5D02
i, xrefs: 00007FFDA34B5E09
e, xrefs: 00007FFDA34B5CFD
e, xrefs: 00007FFDA34B5CDF
r, xrefs: 00007FFDA34B5DA6

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::cancel_current_taskConcurrency::details::EmptyQueue::StructuredWorktype_info::_name_internal_method$Decorator::getTableTypechar_traits
String ID: D$D$F$K$M$R$a$a$c$c$e$e$e$e$e$e$g$i$i$i$k$l$l$l$m$n$n$n$o$o$o$p$r$s$s$t$t$t
API String ID: 2028585780-760767060
Opcode ID: 59bd2d8ec4de32a4ecc2802f7587c4c348fb0e6e645ba743dd23d46785d07151
Instruction ID: 24d59dacae956527ea0718e7a1306d1fd5afed3d53277119a22a71d1fe655a5a
Opcode Fuzzy Hash: 59bd2d8ec4de32a4ecc2802f7587c4c348fb0e6e645ba743dd23d46785d07151
Instruction Fuzzy Hash: 12225D2260EAC185E671EB14E4603EFA7A2EBC5784F400035E6CD97B9BDFAED504CB54

Function 00007FFDA348D550 Relevance: 49.3, APIs: 5, Strings: 23, Instructions: 293COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D5B2
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D63D
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D695
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA348D9DC
HandleT.LIBCPMTD ref: 00007FFDA348D9EE

Part of subcall function 00007FFDA348F9E0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA348FA02

Part of subcall function 00007FFDA348FA30: char_traits.LIBCPMTD ref: 00007FFDA348FA4E

Strings

e, xrefs: 00007FFDA348D619
s, xrefs: 00007FFDA348D623
==>, xrefs: 00007FFDA348DA47
M, xrefs: 00007FFDA348D57A
t, xrefs: 00007FFDA348D600
a, xrefs: 00007FFDA348D57F
F, xrefs: 00007FFDA348D566
n, xrefs: 00007FFDA348D584
e, xrefs: 00007FFDA348D593
G, xrefs: 00007FFDA348D5F6
a, xrefs: 00007FFDA348D589
e, xrefs: 00007FFDA348D5FB
g, xrefs: 00007FFDA348D58E
v, xrefs: 00007FFDA348D614
r, xrefs: 00007FFDA348D61E
i, xrefs: 00007FFDA348D56B
e, xrefs: 00007FFDA348D575
r, xrefs: 00007FFDA348D60A
l, xrefs: 00007FFDA348D570
D, xrefs: 00007FFDA348D605
FrG, xrefs: 00007FFDA348D5A5
i, xrefs: 00007FFDA348D60F
r, xrefs: 00007FFDA348D598

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::details::Concurrency::details::_CriticalEmptyHandleLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWorkchar_traits
String ID: ==>$D$F$FrG$G$M$a$a$e$e$e$e$g$i$i$l$n$r$r$r$s$t$v
API String ID: 420779418-205225161
Opcode ID: 5f69955f3368b046341811d0c46d426a07e9c4799963500704bcf638db78bb77
Instruction ID: ae5b7953c8aa0988c3d2b014d2c3ad62327ffa047248264e22004ebd9954d29d
Opcode Fuzzy Hash: 5f69955f3368b046341811d0c46d426a07e9c4799963500704bcf638db78bb77
Instruction Fuzzy Hash: 0DE1192260EAC195DA60DB14F4A13EEA7A2FBC5384F400035E6CD97B9BEFADD544CB44

Function 00007FFDA34A2CD0 Relevance: 49.2, APIs: 9, Strings: 19, Instructions: 233processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34A61D0: _WChar_traits.LIBCPMTD ref: 00007FFDA34A61F6

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A2E3E
CreateProcessW.KERNEL32 ref: 00007FFDA34A2E87
CloseHandle.KERNEL32 ref: 00007FFDA34A2E97
CloseHandle.KERNEL32 ref: 00007FFDA34A2EA5
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A2F65
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A3074
CreateProcessW.KERNEL32 ref: 00007FFDA34A30BD
CloseHandle.KERNEL32 ref: 00007FFDA34A30CD
CloseHandle.KERNEL32 ref: 00007FFDA34A30DB

Strings

c, xrefs: 00007FFDA34A2EE9
s, xrefs: 00007FFDA34A2F20
t, xrefs: 00007FFDA34A2F25
.exe, xrefs: 00007FFDA34A2D7E
x, xrefs: 00007FFDA34A2F02
a, xrefs: 00007FFDA34A2F2A
, xrefs: 00007FFDA34A2F39
e, xrefs: 00007FFDA34A2F07
., xrefs: 00007FFDA34A2EF8
/, xrefs: 00007FFDA34A2F11
d, xrefs: 00007FFDA34A2EF3
m, xrefs: 00007FFDA34A2EEE
, xrefs: 00007FFDA34A2F0C
r, xrefs: 00007FFDA34A2F2F
c, xrefs: 00007FFDA34A2F16
e, xrefs: 00007FFDA34A2EFD
t, xrefs: 00007FFDA34A2F34
, xrefs: 00007FFDA34A2F1B
h, xrefs: 00007FFDA34A2D73

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CloseHandle$Concurrency::details::CreateEmptyProcessQueue::StructuredWork$Char_traitsFac_nodeFac_node::_std::_
String ID: $ $ $.$.exe$/$a$c$c$d$e$e$h$m$r$s$t$t$x
API String ID: 4010672392-1850887160
Opcode ID: d31621a2d32b0a3b1949a119d43f2289199d1e78f584f337a88e1aafb8d2bd3e
Instruction ID: 6bbc61d5e874f108afc1563d9817e542c1d2906baaa381c8b08c48bbb60bd78c
Opcode Fuzzy Hash: d31621a2d32b0a3b1949a119d43f2289199d1e78f584f337a88e1aafb8d2bd3e
Instruction Fuzzy Hash: F8C1293260DAC195EA21DB64E4643EFB762FBD5340F404036E6CD92BAADFADD548CB04

Function 00007FFDA34B6A50 Relevance: 42.2, APIs: 3, Strings: 21, Instructions: 228COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6AC0
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6B4F
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6BB7

Part of subcall function 00007FFDA348D550: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D5B2
Part of subcall function 00007FFDA348D550: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D63D
Part of subcall function 00007FFDA348D550: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348D695

Strings

i, xrefs: 00007FFDA34B6A67
n, xrefs: 00007FFDA34B6B1E
e, xrefs: 00007FFDA34B6B19
e, xrefs: 00007FFDA34B6B00
a, xrefs: 00007FFDA34B6A7B
C, xrefs: 00007FFDA34B6B0A
n, xrefs: 00007FFDA34B6A80
t, xrefs: 00007FFDA34B6B05
a, xrefs: 00007FFDA34B6A85
l, xrefs: 00007FFDA34B6A6C
FtS, xrefs: 00007FFDA34B6AB3
e, xrefs: 00007FFDA34B6A8F
e, xrefs: 00007FFDA34B6A71
t, xrefs: 00007FFDA34B6B23
r, xrefs: 00007FFDA34B6A94
S, xrefs: 00007FFDA34B6AFB
l, xrefs: 00007FFDA34B6B0F
g, xrefs: 00007FFDA34B6A8A
F, xrefs: 00007FFDA34B6A62
M, xrefs: 00007FFDA34B6A76
i, xrefs: 00007FFDA34B6B14

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: C$F$FtS$M$S$a$a$e$e$e$e$g$i$i$l$l$n$n$r$t$t
API String ID: 1114552684-2189465758
Opcode ID: 50ee1b1b17ded2a8e62f603e76cff047e39b5a6fc7cd7a71ca88179335fa07c3
Instruction ID: 57d526d2c3261e92e89344a5bbc577ceb02c6eca75b3d088ec9be5ce17f3b3bd
Opcode Fuzzy Hash: 50ee1b1b17ded2a8e62f603e76cff047e39b5a6fc7cd7a71ca88179335fa07c3
Instruction Fuzzy Hash: B8B16D2260EAC191E660DB14F4603EFA7A2EBD5384F400035E6CD93B9BDEAED548CB44

Function 00007FFDA34B6420 Relevance: 42.2, APIs: 4, Strings: 20, Instructions: 226COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B65DA
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B6660

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B66B8

Part of subcall function 00007FFDA34B16D0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1756
Part of subcall function 00007FFDA34B16D0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B1819
Part of subcall function 00007FFDA34B16D0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B18A0

Part of subcall function 00007FFDA34917F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491803

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B67B4

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA3488768
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34887CE
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA3488834
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348889F
Part of subcall function 00007FFDA3488730: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348890A

Strings

e, xrefs: 00007FFDA34B65BB
t, xrefs: 00007FFDA34B6628
a, xrefs: 00007FFDA34B65B1
S, xrefs: 00007FFDA34B661E
t, xrefs: 00007FFDA34B6646
F, xrefs: 00007FFDA34B658E
l, xrefs: 00007FFDA34B6598
r, xrefs: 00007FFDA34B65C0
C, xrefs: 00007FFDA34B662D
i, xrefs: 00007FFDA34B6593
e, xrefs: 00007FFDA34B663C
l, xrefs: 00007FFDA34B6632
a, xrefs: 00007FFDA34B65A7
M, xrefs: 00007FFDA34B65A2
n, xrefs: 00007FFDA34B6641
g, xrefs: 00007FFDA34B65B6
e, xrefs: 00007FFDA34B659D
i, xrefs: 00007FFDA34B6637
e, xrefs: 00007FFDA34B6623
n, xrefs: 00007FFDA34B65AC

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::cancel_current_task$Concurrency::details::Decorator::getEmptyQueue::StructuredTableTypeWorkchar_traitstype_info::_name_internal_method
String ID: C$F$M$S$a$a$e$e$e$e$g$i$i$l$l$n$n$r$t$t
API String ID: 924362910-1541419571
Opcode ID: 668c1e3e51d0e2fc71ca83dd5b96e6bb9e73db51f41fd73b4946feff3da2304a
Instruction ID: c36e450e6d229dc3e29b116c8ab6a8a9d5e6cde4e61a2c7427bac41dd08c3518
Opcode Fuzzy Hash: 668c1e3e51d0e2fc71ca83dd5b96e6bb9e73db51f41fd73b4946feff3da2304a
Instruction Fuzzy Hash: 12C14C3260EAC191E660DB14F4643EBA7A2FBC5784F400135E6CD97BAADFAED544CB04

Function 00007FFDA348F460 Relevance: 42.2, APIs: 4, Strings: 20, Instructions: 206COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F4D9
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F563
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F5CB
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA348F7A8

Strings

g, xrefs: 00007FFDA348F4A3
r, xrefs: 00007FFDA348F4AD
e, xrefs: 00007FFDA348F48A
a, xrefs: 00007FFDA348F49E
U, xrefs: 00007FFDA348F51E
M, xrefs: 00007FFDA348F48F
F, xrefs: 00007FFDA348F47B
F, xrefs: 00007FFDA348F528
e, xrefs: 00007FFDA348F537
a, xrefs: 00007FFDA348F494
n, xrefs: 00007FFDA348F499
i, xrefs: 00007FFDA348F480
e, xrefs: 00007FFDA348F4A8
l, xrefs: 00007FFDA348F532
error, xrefs: 00007FFDA348F79E
i, xrefs: 00007FFDA348F52D
p, xrefs: 00007FFDA348F523
e, xrefs: 00007FFDA348F519
R, xrefs: 00007FFDA348F514
l, xrefs: 00007FFDA348F485

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$type_info::_name_internal_method
String ID: F$F$M$R$U$a$a$e$e$e$e$error$g$i$i$l$l$n$p$r
API String ID: 3843115320-2728630413
Opcode ID: 208c863bfba058f04b787a8e2d474442b0a7e4e4432c1749738c198f21529a3d
Instruction ID: dfaa64e9c8e6dbe79a8119eebedc4ecf6299cf5e3697663d558f15dffa001574
Opcode Fuzzy Hash: 208c863bfba058f04b787a8e2d474442b0a7e4e4432c1749738c198f21529a3d
Instruction Fuzzy Hash: B6A13D2260EAC191EA60DB14F4613EEA7A2FBD5784F400035E6CD93BABDFADD544CB04

Function 00007FFDA348EF30 Relevance: 38.7, APIs: 3, Strings: 19, Instructions: 247COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348EFEB
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F06C
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348F0C4

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Strings

R, xrefs: 00007FFDA348F02F
n, xrefs: 00007FFDA348EFBD
M, xrefs: 00007FFDA348EFB3
l, xrefs: 00007FFDA348F04D
a, xrefs: 00007FFDA348EFC2
e, xrefs: 00007FFDA348F052
i, xrefs: 00007FFDA348F048
F, xrefs: 00007FFDA348EF9F
l, xrefs: 00007FFDA348EFA9
U, xrefs: 00007FFDA348F039
e, xrefs: 00007FFDA348EFAE
g, xrefs: 00007FFDA348EFC7
e, xrefs: 00007FFDA348F034
i, xrefs: 00007FFDA348EFA4
p, xrefs: 00007FFDA348F03E
r, xrefs: 00007FFDA348EFD1
e, xrefs: 00007FFDA348EFCC
a, xrefs: 00007FFDA348EFB8
F, xrefs: 00007FFDA348F043

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Concurrency::cancel_current_task$Decorator::getTableType
String ID: F$F$M$R$U$a$a$e$e$e$e$g$i$i$l$l$n$p$r
API String ID: 3873182351-3194299963
Opcode ID: 5b2bb602d22b333214d04523e346fc123c1330c8c3198e5e6a9d8e78296e0be3
Instruction ID: d66c83b1620eb9859f6a8b87dcde15b69bd925534c16ae2adce8f9c483d0e5fd
Opcode Fuzzy Hash: 5b2bb602d22b333214d04523e346fc123c1330c8c3198e5e6a9d8e78296e0be3
Instruction Fuzzy Hash: 5AC13D2260EAC191DA60DB14F4603EFA7A2EBD5784F400035E6CD97BABDFAED544CB44

Function 00007FFDA34A3830 Relevance: 37.0, APIs: 5, Strings: 16, Instructions: 257COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A3899
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A3925
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34A3987
GetLogicalDriveStringsA.KERNEL32 ref: 00007FFDA34A39EC
GetDriveTypeA.KERNEL32 ref: 00007FFDA34A3A7B

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

v, xrefs: 00007FFDA34A38E8
==>, xrefs: 00007FFDA34A3C56
e, xrefs: 00007FFDA34A38D9
m, xrefs: 00007FFDA34A38DE
l, xrefs: 00007FFDA34A38F7
o, xrefs: 00007FFDA34A38E3
i, xrefs: 00007FFDA34A385E
==>, xrefs: 00007FFDA34A3B0E
R, xrefs: 00007FFDA34A38D4
e, xrefs: 00007FFDA34A3868
a, xrefs: 00007FFDA34A38ED
d, xrefs: 00007FFDA34A386D
F, xrefs: 00007FFDA34A3859
x, xrefs: 00007FFDA34A3863
b, xrefs: 00007FFDA34A38F2
e, xrefs: 00007FFDA34A38FC

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_$Drive$LogicalStringsTypechar_traits
String ID: ==>$==>$F$R$a$b$d$e$e$e$i$l$m$o$v$x
API String ID: 3293995294-766430890
Opcode ID: 490619949d2f79f6bcc13f69530309b5a26baaa1be1e3715154f21850153d81e
Instruction ID: a781bb84484166f94cf314473b81a85a83a2f94d70868b4233237ba23f029205
Opcode Fuzzy Hash: 490619949d2f79f6bcc13f69530309b5a26baaa1be1e3715154f21850153d81e
Instruction Fuzzy Hash: 06D1283260EAC591DA70DB14E4603EBA762FBC5784F400136E6CD93BAAEEBDC545CB44

Function 00007FFDA348E7E0 Relevance: 35.4, APIs: 4, Strings: 16, Instructions: 356COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA348E8AF

Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C3344
Part of subcall function 00007FFDA34C3314: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDA34C334A

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA348EB37
Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FFDA348EBA3

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA348ED9B

Strings

D, xrefs: 00007FFDA348E872
o, xrefs: 00007FFDA348E877
w, xrefs: 00007FFDA348E87C
pre, xrefs: 00007FFDA348EB2D
c, xrefs: 00007FFDA348E85E
l, xrefs: 00007FFDA348E886
a, xrefs: 00007FFDA348E890
save, xrefs: 00007FFDA348ED91
k, xrefs: 00007FFDA348E863
o, xrefs: 00007FFDA348E88B
d, xrefs: 00007FFDA348E895
n, xrefs: 00007FFDA348E881
S, xrefs: 00007FFDA348E854
e, xrefs: 00007FFDA348E868
o, xrefs: 00007FFDA348E859
t, xrefs: 00007FFDA348E86D

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::cancel_current_tasktype_info::_name_internal_method$Concurrency::cancellation_token::_Decorator::getFac_nodeFac_node::_FromImplTableTypestd::_
String ID: D$S$a$c$d$e$k$l$n$o$o$o$pre$save$t$w
API String ID: 1666591369-2572745379
Opcode ID: 7e0b7a93bf49bcff58548c04f9da16580aed8d903afd20bd23106dfcea5c502d
Instruction ID: b51f3c88255bce89a3b41855eac629b0a4a19f5bdea01ca44feb700b149359bf
Opcode Fuzzy Hash: 7e0b7a93bf49bcff58548c04f9da16580aed8d903afd20bd23106dfcea5c502d
Instruction Fuzzy Hash: B4021D3260EAC292DA60EB14F4653EEA3A2FBC5744F400035E68D97B9BDFADD544CB44

Function 00007FFDA34B72B0 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 190COMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS ref: 00007FFDA34B72F7
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B7384

Part of subcall function 00007FFDA34B7EC0: EnumDisplayMonitors.USER32 ref: 00007FFDA34B7EEC

Part of subcall function 00007FFDA34BEF30: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BEF75

Strings

s, xrefs: 00007FFDA34B7347
jpg, xrefs: 00007FFDA34B750E
e, xrefs: 00007FFDA34B7338
k, xrefs: 00007FFDA34B734C
e, xrefs: 00007FFDA34B7342
p, xrefs: 00007FFDA34B735B
t, xrefs: 00007FFDA34B7333
R, xrefs: 00007FFDA34B731F
t, xrefs: 00007FFDA34B7351
o, xrefs: 00007FFDA34B7356
m, xrefs: 00007FFDA34B7329
D, xrefs: 00007FFDA34B733D
e, xrefs: 00007FFDA34B7324
o, xrefs: 00007FFDA34B732E

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Decorator::getDisplayEnumFac_nodeFac_node::_GdiplusMonitorsStartupTableTypestd::_
String ID: D$R$e$e$e$jpg$k$m$o$o$p$s$t$t
API String ID: 1258987360-2495397863
Opcode ID: 76332751ae7abdf6e6b080960cc59d2a6e1d6b7111230b08185894483d4d3adf
Instruction ID: ae9e5e0eb199f89e05a15b33a5face2aac0620664ea47566aa633ab4ff510046
Opcode Fuzzy Hash: 76332751ae7abdf6e6b080960cc59d2a6e1d6b7111230b08185894483d4d3adf
Instruction Fuzzy Hash: 39913C3260EAC181DB20DB14F4613EAA761EBC5784F404136E68D93BAADEBDD545CB04

Function 00007FFDA34B7670 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 361COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34A78F0: char_traits.LIBCPMTD ref: 00007FFDA34A7908

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7731
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B780E
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B78F1
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B79D4
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7AB7
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7B9A
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34B7C7D
GdiplusShutdown.GDIPLUS ref: 00007FFDA34B7D5F

Strings

.gif, xrefs: 00007FFDA34B7C6E
.jpeg, xrefs: 00007FFDA34B7B8B
.jfif, xrefs: 00007FFDA34B7AA8
.ico, xrefs: 00007FFDA34B78E2
.bmp, xrefs: 00007FFDA34B79C5
.jpg, xrefs: 00007FFDA34B77FF
.png, xrefs: 00007FFDA34B7722

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: type_info::_name_internal_method$GdiplusShutdownchar_traits
String ID: .bmp$.gif$.ico$.jfif$.jpeg$.jpg$.png
API String ID: 3499204208-3397763088
Opcode ID: 0f246cb72e55f54a7b693d8fc228ba5af8b2ca5bc0172a7175d6b3f4dadf06c9
Instruction ID: 055b2b49758ceef26ec1d510ed49680d680db5d55032ec5b7e70eed569846898
Opcode Fuzzy Hash: 0f246cb72e55f54a7b693d8fc228ba5af8b2ca5bc0172a7175d6b3f4dadf06c9
Instruction Fuzzy Hash: 36124C3261D6C286D6709B14E4613EABB61FB85364F000332E6EDD6BDADFADD504CB44

Function 00007FFDA34B8380 Relevance: 26.3, APIs: 5, Strings: 10, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34B9C90: char_traits.LIBCPMTD ref: 00007FFDA34B9CA3

CLSIDFromString.OLE32 ref: 00007FFDA34B83C7
CLSIDFromString.OLE32 ref: 00007FFDA34B83F4

Strings

{557cf401-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B83ED
{557cf406-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B846B
{557cf405-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B8441
png, xrefs: 00007FFDA34B8451
gif, xrefs: 00007FFDA34B83FD
{557cf400-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B83C0
{557cf402-1a04-11d3-9a73-0000f81ef32e}, xrefs: 00007FFDA34B8417
jpg, xrefs: 00007FFDA34B83D3
bmp, xrefs: 00007FFDA34B83A6
tif, xrefs: 00007FFDA34B8427

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: FromString$char_traits
String ID: bmp$gif$jpg$png$tif${557cf400-1a04-11d3-9a73-0000f81ef32e}${557cf401-1a04-11d3-9a73-0000f81ef32e}${557cf402-1a04-11d3-9a73-0000f81ef32e}${557cf405-1a04-11d3-9a73-0000f81ef32e}${557cf406-1a04-11d3-9a73-0000f81ef32e}
API String ID: 3612880244-2938333857
Opcode ID: 27bbbdadbdfd53492e3170faa8fbfabf8b77fc76d5c273dd4bfb8bd4d69b80a3
Instruction ID: 96bff651e858fc6a439859c84ed8da83094533fef66b6fe1b8c59c397e9e0d0e
Opcode Fuzzy Hash: 27bbbdadbdfd53492e3170faa8fbfabf8b77fc76d5c273dd4bfb8bd4d69b80a3
Instruction Fuzzy Hash: 5F319021B0EA8691EA50CF41EC600B96763FBD5788F804031D98DD2766FFEEE948C708

Function 00007FFDA34B88C0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 262windowCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B8938
SHGetFileInfoW.SHELL32 ref: 00007FFDA34B8958
CreateStreamOnHGlobal.OLE32 ref: 00007FFDA34B8A4C
DestroyIcon.USER32 ref: 00007FFDA34B8A62
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8A7F

Part of subcall function 00007FFDA34BE7C0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FFDA34BE949

DestroyIcon.USER32 ref: 00007FFDA34B8BD1
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8BEE
DestroyIcon.USER32 ref: 00007FFDA34B8D0A
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8D27

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34B8380: CLSIDFromString.OLE32 ref: 00007FFDA34B83C7

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8DB3

Strings

png, xrefs: 00007FFDA34B8994

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$DestroyIcon$Concurrency::details::Concurrency::task_continuation_context::task_continuation_contextCreateEmptyFileFromGlobalInfoQueue::StreamStringStructuredWorkchar_traits
String ID: png
API String ID: 2892423481-2199389072
Opcode ID: fae29a7a72ba1a9e499f6e2f45cbe4b808135d9687a933d283217be40005f67f
Instruction ID: 690273f433c0cd20b7fd657da7c0ad17b7372567541d35a875085d6b530a5398
Opcode Fuzzy Hash: fae29a7a72ba1a9e499f6e2f45cbe4b808135d9687a933d283217be40005f67f
Instruction Fuzzy Hash: 47D12E32719A8192DB60DB15E4A13EAA761FBC4780F405036E78ED3BAADF7DD544CB04

Function 00007FFDA34B7EC0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32 ref: 00007FFDA34B7EEC

Strings

h, xrefs: 00007FFDA34B7FA0
, xrefs: 00007FFDA34B8060
DISPLAY, xrefs: 00007FFDA34B800D

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: DisplayEnumMonitors
String ID: $DISPLAY$h
API String ID: 2950131505-1878358626
Opcode ID: 672e0ac83053d01c40282062667c1306d9c30b7dde12ecaa6dd10ab88f712e8c
Instruction ID: 5f405c24616ee6e8026f08b215bead3528441278ab6bce29ed57b1fcf7cccea5
Opcode Fuzzy Hash: 672e0ac83053d01c40282062667c1306d9c30b7dde12ecaa6dd10ab88f712e8c
Instruction Fuzzy Hash: 0251D832609AC186E760DF25E4A07AAB7A2FBC4750F504136E68D93B69DFBDD448CF04

Function 00007FFDA34A9D10 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 119timefileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34A9CA0: GetModuleFileNameA.KERNEL32 ref: 00007FFDA34A9CD3

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A9D4E
CreateFileA.KERNEL32 ref: 00007FFDA34A9D7D
GetFileTime.KERNEL32 ref: 00007FFDA34A9DEB
FileTimeToSystemTime.KERNEL32 ref: 00007FFDA34A9E06
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FFDA34A9E1B
CloseHandle.KERNEL32 ref: 00007FFDA34A9EE8

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

p.m., xrefs: 00007FFDA34A9EB9
a.m., xrefs: 00007FFDA34A9ED3

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Time$File$System$CloseConcurrency::details::CreateEmptyHandleLocalModuleNameQueue::SpecificStructuredWorkchar_traits
String ID: a.m.$ p.m.
API String ID: 4253720429-1173636248
Opcode ID: f9f23eb8ed0bd049b82b5f7093e0345eed192e55972dcacb3ddd51adc77cf471
Instruction ID: eab9a159336264a0cbca4b1f4cfb924c4e515939e7e4f095a562ae0271acceb3
Opcode Fuzzy Hash: f9f23eb8ed0bd049b82b5f7093e0345eed192e55972dcacb3ddd51adc77cf471
Instruction Fuzzy Hash: 64514021B1E68682EA10DB14E4603FAA362FBC1750F804132E68D977ABDFBED444CB44

Function 00007FFDA3492230 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA3492248
_Yarn.LIBCPMTD ref: 00007FFDA349225A
_Yarn.LIBCPMTD ref: 00007FFDA349226C
_Yarn.LIBCPMTD ref: 00007FFDA349227E
_Yarn.LIBCPMTD ref: 00007FFDA3492290
_Yarn.LIBCPMTD ref: 00007FFDA34922A2
_Yarn.LIBCPMTD ref: 00007FFDA34922B4
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDA34922CC

Part of subcall function 00007FFDA34C12E4: _Yarn.LIBCPMT ref: 00007FFDA34C1312

Strings

bad locale name, xrefs: 00007FFDA34922D4

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: 21b6dde102e949537a358dabb7938f436e8824ef52250dd78e5f134c6afc748f
Instruction ID: df1214acbd0239aaa38a2b4d7f621c37f948e02d2052c2a5cd4b981cdc1dad1e
Opcode Fuzzy Hash: 21b6dde102e949537a358dabb7938f436e8824ef52250dd78e5f134c6afc748f
Instruction Fuzzy Hash: 82115E11F6B78641EE54E72AA4A566E6361EFC6BC0F802431F94EB7B57CE6DD0108708

Function 00007FFDA34C2F00 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34D021C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D0230

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F35
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F48
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F5F
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34C05AE), ref: 00007FFDA34C2F76

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FFDA34C2F4E
invalid random_device value, xrefs: 00007FFDA34C2F1B
GetCurrentPackageId, xrefs: 00007FFDA34C2F3E
kernel32.dll, xrefs: 00007FFDA34C2F2E
GetTempPath2W, xrefs: 00007FFDA34C2F65

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule_invalid_parameter_noinfo
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$invalid random_device value$kernel32.dll
API String ID: 2104222004-861830008
Opcode ID: c7c081bedf470f973e2b56519931470c3a7a7f8b38c7d7fbc461ff9d9a2692fe
Instruction ID: 373b8eb87b54e6f21c61bcc4b8c355fc409d797d984f4b9f3bed9c8b98202cd5
Opcode Fuzzy Hash: c7c081bedf470f973e2b56519931470c3a7a7f8b38c7d7fbc461ff9d9a2692fe
Instruction Fuzzy Hash: 8C01EC64F1BA07C1FA04DB65F8644B46362BF46B41F941034D80EE6367EFAEE1D98318

Function 00007FFDA34BB2C0 Relevance: 15.4, APIs: 10, Instructions: 416COMMON

Download Yara Rule

APIs

std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB342
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB421
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB4BF
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34BB622
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BB6CC

Part of subcall function 00007FFDA349E180: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA349E1AA

Part of subcall function 00007FFDA349B800: _Byte_length.LIBCPMTD ref: 00007FFDA349B894

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34BB82A

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BB897

Part of subcall function 00007FFDA34BE4A0: std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4C1
Part of subcall function 00007FFDA34BE4A0: GetCurrentThreadId.KERNEL32 ref: 00007FFDA34BE4C7
Part of subcall function 00007FFDA34BE4A0: std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4DB
Part of subcall function 00007FFDA34BE4A0: std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE50A

Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349352B
Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349353A

UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34BBAF1

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: std::runtime_error::runtime_error$Cpp_errorDecorator::getTableThrow_Typestd::_$Concurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork$Byte_lengthCurrentThreadchar_traits
String ID:
API String ID: 2867615695-0
Opcode ID: cd33df9d3d40b1a4144104433d8dc30451c8ce45da51524e28e90d1d2dbb93f0
Instruction ID: 0b8789f58acf24df720fbc5ecb20da72999c14f49729a0b9aad29a0a6e9a335a
Opcode Fuzzy Hash: cd33df9d3d40b1a4144104433d8dc30451c8ce45da51524e28e90d1d2dbb93f0
Instruction Fuzzy Hash: B432F67260EAC586DA70DB15E4A43EAB3A1FBC4744F404036DB8D93BAADF79D445CB04

Function 00007FFDA3497A40 Relevance: 13.9, APIs: 9, Instructions: 402COMMON

Download Yara Rule

APIs

std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497AD7
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497BBA
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497C56
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA3497D92
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA3497E20

Part of subcall function 00007FFDA349E180: UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA349E1AA

Part of subcall function 00007FFDA349B800: _Byte_length.LIBCPMTD ref: 00007FFDA349B894

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA3497F72

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34B6420: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FFDA34B65DA

Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349352B
Part of subcall function 00007FFDA3493500: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA349353A

UnDecorator::getVbTableType.LIBCMTD ref: 00007FFDA34981D1

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: std::runtime_error::runtime_error$Concurrency::details::Concurrency::details::_CriticalDecorator::getEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredTableTypeWork$Byte_lengthFac_nodeFac_node::_char_traitsstd::_
String ID:
API String ID: 2648250531-0
Opcode ID: a9944911c49198297e702856b03420b9597a7d3ae06585ae7b6ef4a972edc2d1
Instruction ID: d449539a51437c592bf442dca94f818596124f7359a25c30d51ac15aa5c23d76
Opcode Fuzzy Hash: a9944911c49198297e702856b03420b9597a7d3ae06585ae7b6ef4a972edc2d1
Instruction Fuzzy Hash: 4F22277261AAC586DA70DB14E4A03EEB761FBC4744F401122DB8D93BAADF7DD504CB48

Function 00007FFDA34D4154 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FFDA34D499C,?,?,?,?,00007FFDA34CF629,?,?,?,?,00007FFDA34C0F10), ref: 00007FFDA34D42D0
GetProcAddress.KERNEL32(?,?,?,00007FFDA34D499C,?,?,?,?,00007FFDA34CF629,?,?,?,?,00007FFDA34C0F10), ref: 00007FFDA34D42DC

Strings

ext-ms-, xrefs: 00007FFDA34D422D
api-ms-, xrefs: 00007FFDA34D421A

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 37ca3048070be1c70536f5ec53a0aedc04f3e76b26da52ce0f72c4a8bfec6647
Instruction ID: 57adce8e48d86a5194dd33c54ff195ea26fae5abd9c8132601c7b7c886b73920
Opcode Fuzzy Hash: 37ca3048070be1c70536f5ec53a0aedc04f3e76b26da52ce0f72c4a8bfec6647
Instruction Fuzzy Hash: 46413B32B1BA0281FA16CB16A8245B56393BF46BE0F084136DD0DE7796DFBEE441C308

Function 00007FFDA34C3914 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA34C393C
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA34C398E
_RTC_Initialize.LIBCMT ref: 00007FFDA34C39BC
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA34C39E2
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA34C3A0D

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7e358743e0567f6d86e92bc6aeba5c5afe67e0b303d4bd1a9350515b2ab7424b
Instruction ID: a43f2535a819569e9d976f8f0fc38704da9e9645581593b4f479050693ffa25e
Opcode Fuzzy Hash: 7e358743e0567f6d86e92bc6aeba5c5afe67e0b303d4bd1a9350515b2ab7424b
Instruction Fuzzy Hash: E581D421F0F64345FA60AB6E94612BA6693AF86780F544035F90CE7397DEBFE851870C

Function 00007FFDA34CC7B8 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CC7FB
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CCBE8
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CCE84

Strings

p, xrefs: 00007FFDA34CC925
f, xrefs: 00007FFDA34CC91D
p, xrefs: 00007FFDA34CC8AD

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: b0d905913f178a05850a904996d5be31d3cd629aea336fc8d1d384171e8fe448
Instruction ID: 6b8d3b3da5b270fdbbb518082a6d350b0ecf515d0cb9fab5a63c444184b593a2
Opcode Fuzzy Hash: b0d905913f178a05850a904996d5be31d3cd629aea336fc8d1d384171e8fe448
Instruction Fuzzy Hash: 0912A562F0E14395FB209B18E1742B97653FB40750F844135D689A77CADFBEEC829B18

Function 00007FFDA34AAB70 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 375COMMON

Download Yara Rule

APIs

ctype.LIBCPMTD ref: 00007FFDA34AADB0
_Mpunct.LIBCPMTD ref: 00007FFDA34AAE10
_Mpunct.LIBCPMTD ref: 00007FFDA34AAE1B
_Mpunct.LIBCPMTD ref: 00007FFDA34AAE38
std::ios_base::width.LIBCPMTD ref: 00007FFDA34AB284

Strings

@, xrefs: 00007FFDA34AAFCD

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Mpunct$ctypestd::ios_base::width
String ID: @
API String ID: 3075750325-2766056989
Opcode ID: e67de69f98cff780475ac0c8084deb56d29bcf2359572f96fc364d3a03f4861c
Instruction ID: 3513d65cf9ec6b230d435534ee324ee6089313796b0688a9808c6093470dcaa5
Opcode Fuzzy Hash: e67de69f98cff780475ac0c8084deb56d29bcf2359572f96fc364d3a03f4861c
Instruction Fuzzy Hash: CA121B3260EBC585DA70DB55E4A43EBA7A2F7C8780F404432EA8D93B6ADE7DD544CB04

Function 00007FFDA34C6458 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFDA34C64B5

Part of subcall function 00007FFDA34C87BC: __GetUnwindTryBlock.LIBCMT ref: 00007FFDA34C87FF
Part of subcall function 00007FFDA34C87BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFDA34C8824

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDA34C658D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFDA34C67DB

Strings

csm, xrefs: 00007FFDA34C65B0
csm, xrefs: 00007FFDA34C6536
csm, xrefs: 00007FFDA34C64CF

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchState
String ID: csm$csm$csm
API String ID: 1826822863-393685449
Opcode ID: 18fba9449cf909bf85d974a39e9706e64e3fa71afd28f0598ebf155c87009170
Instruction ID: fae176c7073d47f947abdcc6007a810f52fa0f400f3940dc722b33a5b40b392b
Opcode Fuzzy Hash: 18fba9449cf909bf85d974a39e9706e64e3fa71afd28f0598ebf155c87009170
Instruction Fuzzy Hash: D7D1AE32A0A6418AFB608B69D4503BD77A2FB45798F144135EE8DA7B9BCF7EE050C704

Function 00007FFDA34D8EF8 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D9325

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b2c7bc130197246b40956ba66cd1257bddcb4cdd4c992c93ddc331ef8c3a997e
Instruction ID: f3aa70331b8a675160f8b798394a3419714276503c69db6882c0cdc777f545da
Opcode Fuzzy Hash: b2c7bc130197246b40956ba66cd1257bddcb4cdd4c992c93ddc331ef8c3a997e
Instruction Fuzzy Hash: AEC1E223B0E78651F6659B1594242BD7BA3EB82BC0F150135DA4DE3397EEBEE8458308

Function 00007FFDA34A4180 Relevance: 10.6, APIs: 7, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A41A3
CreateFileA.KERNEL32 ref: 00007FFDA34A41D2
GetFileSize.KERNEL32 ref: 00007FFDA34A4211
CloseHandle.KERNEL32 ref: 00007FFDA34A4227

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: File$CloseConcurrency::details::CreateEmptyHandleQueue::SizeStructuredWork
String ID:
API String ID: 2285079412-0
Opcode ID: e155523a2607a2c161b7ce0223fbcfffcf75895e662939dd0c3e66526e39bfe8
Instruction ID: 5ac2bb8d7d5762a7f4849a66d55f66c2c059eb9739cfd3df0656686419d47f8b
Opcode Fuzzy Hash: e155523a2607a2c161b7ce0223fbcfffcf75895e662939dd0c3e66526e39bfe8
Instruction Fuzzy Hash: 82411932A0958187E720DB20E4613AEB7A1FBC1794F504531E6DDD7BAADFBED8448B04

Function 00007FFDA34C8D0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8D91
GetLastError.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8D9F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8DC9
FreeLibrary.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8E37
GetProcAddress.KERNEL32(?,?,00000000,00007FFDA34C8F13,?,?,?,00007FFDA34C59DA,?,?,?,00007FFDA34C5995), ref: 00007FFDA34C8E43

Strings

api-ms-, xrefs: 00007FFDA34C8DB1

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 492e68bbb1773d240888386dda676b62b4bbe1757f3f4df5f2fd3b7df8b2a67b
Instruction ID: 9302599013c2b91ad236b93324d72a6eccc3d9e0b481aa3324bb456f224e348a
Opcode Fuzzy Hash: 492e68bbb1773d240888386dda676b62b4bbe1757f3f4df5f2fd3b7df8b2a67b
Instruction Fuzzy Hash: 9731F632B1B74292FE52AB0AA8205B56396FF44BA0F590535ED1DE7742DFBDE4408318

Function 00007FFDA34D2408 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2417
FlsGetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D242C
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D244D
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D247A
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D248B
FlsSetValue.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D249C
SetLastError.KERNEL32(?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24B7

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7dde353b9ac6f79d7f831a2c4234fd0554264c8c419265b3748acd9ea9a11b06
Instruction ID: c954fb03d22b116783e1fdaa7f31d57722f3683f182ac726092c5bdbedce1144
Opcode Fuzzy Hash: 7dde353b9ac6f79d7f831a2c4234fd0554264c8c419265b3748acd9ea9a11b06
Instruction Fuzzy Hash: 1321C522B0F20242FA959775667513852435F447F0F140738DD3EF67DBDEAFA8418608

Function 00007FFDA34E44E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFDA34E4515
GetLastError.KERNEL32 ref: 00007FFDA34E4521
CloseHandle.KERNEL32 ref: 00007FFDA34E4539
CreateFileW.KERNEL32 ref: 00007FFDA34E4564
WriteConsoleW.KERNEL32 ref: 00007FFDA34E4583

Strings

CONOUT$, xrefs: 00007FFDA34E4545

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: aaa7478a30f227f436a7fdc7f67f6462c4936cde7976a00747b319838b7bad40
Instruction ID: 2ce2b9f69c00bdb9b413e3cef57d249a5780974cd53b703332349dcffc4df795
Opcode Fuzzy Hash: aaa7478a30f227f436a7fdc7f67f6462c4936cde7976a00747b319838b7bad40
Instruction Fuzzy Hash: 5511E931B19B418AE3508B06E864369B3A5FB48FE0F140234EA6DD3799CF7ED8848748

Function 00007FFDA34A4360 Relevance: 10.5, APIs: 7, Instructions: 33fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4373
CreateFileA.KERNEL32 ref: 00007FFDA34A43A2
GetLastError.KERNEL32 ref: 00007FFDA34A43B5
GetFileSize.KERNEL32 ref: 00007FFDA34A43C4
CloseHandle.KERNEL32 ref: 00007FFDA34A43DA
GetLastError.KERNEL32 ref: 00007FFDA34A43E0

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ErrorFileLast$CloseConcurrency::details::CreateEmptyHandleQueue::SizeStructuredWork
String ID:
API String ID: 1161490322-0
Opcode ID: 1dea7533e81207ac8a784632e534d43140b698bbcad88c187d8879aa26368a2d
Instruction ID: 33f30d142d2e5ac23c422a689420c7e0e305e5ec8a8530734b391c8f8492169f
Opcode Fuzzy Hash: 1dea7533e81207ac8a784632e534d43140b698bbcad88c187d8879aa26368a2d
Instruction Fuzzy Hash: B8013031A09A4182E310DB14F46836EB6B1FBC1765F600234D6AD96BE5CF7ED4858B04

Function 00007FFDA3488620 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA348863F
GetLastError.KERNEL32 ref: 00007FFDA3488652
GetProcAddress.KERNEL32 ref: 00007FFDA3488666
FreeLibrary.KERNEL32 ref: 00007FFDA348867E

Strings

getaddrinfo, xrefs: 00007FFDA348865A
ws2_32.dll, xrefs: 00007FFDA3488638

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: getaddrinfo$ws2_32.dll
API String ID: 2540614322-1292075177
Opcode ID: 2e17c17b20e4e39118e914fa3b5e4c7575d2cbd19b87fa64c5de521b5d5e2b13
Instruction ID: 3f8879cbec2e4bb6bf7ec74c88f53948ce18af5539835a4c72ae5642c8a1ce4f
Opcode Fuzzy Hash: 2e17c17b20e4e39118e914fa3b5e4c7575d2cbd19b87fa64c5de521b5d5e2b13
Instruction Fuzzy Hash: 88015E36A1DB45C6E620CF10F46426AB7A1FBC8794F500535EA8DA2B29CF7CD594CB04

Function 00007FFDA34880D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34880E9
GetProcAddress.KERNEL32 ref: 00007FFDA348810F
FreeLibrary.KERNEL32 ref: 00007FFDA3488127
GetLastError.KERNEL32 ref: 00007FFDA348812D

Strings

inet_pton, xrefs: 00007FFDA3488103
ws2_32.dll, xrefs: 00007FFDA34880E2

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: inet_pton$ws2_32.dll
API String ID: 2540614322-1244057378
Opcode ID: f72124b0816627394e4800e943be552c9ae965a8f5f9275f8fed54044a445383
Instruction ID: 2064b371c2a89ee47a058e48933568aff7f6052962a11a528ce5254470eed8de
Opcode Fuzzy Hash: f72124b0816627394e4800e943be552c9ae965a8f5f9275f8fed54044a445383
Instruction Fuzzy Hash: 5F014C76A1DB41C7E620DF10F85436AB772FB847A4F600235E68E92B69CFBDD5848B04

Function 00007FFDA34882C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34882D4
GetProcAddress.KERNEL32 ref: 00007FFDA34882FA
FreeLibrary.KERNEL32 ref: 00007FFDA3488312
GetLastError.KERNEL32 ref: 00007FFDA3488318

Strings

shutdown, xrefs: 00007FFDA34882EE
ws2_32.dll, xrefs: 00007FFDA34882CD

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: shutdown$ws2_32.dll
API String ID: 2540614322-1549006702
Opcode ID: 04e719e17db4c40d27fc3eeb3ad78a178e066fcb23fb87a825b186b968d0ada3
Instruction ID: e8219428754a71e768801f46f07bd975903fcc31ae302ff990890fe0a9745f3f
Opcode Fuzzy Hash: 04e719e17db4c40d27fc3eeb3ad78a178e066fcb23fb87a825b186b968d0ada3
Instruction Fuzzy Hash: 4E015A36A1DA41C7E620DB10F46432AB361FBC47A4F500231E58E92B69CFBDD5848B08

Function 00007FFDA3488040 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BBDAB,?,?,?,?,?,?,00007FFDA34BA88D), ref: 00007FFDA3488055
GetProcAddress.KERNEL32 ref: 00007FFDA348807B
FreeLibrary.KERNEL32 ref: 00007FFDA3488093
GetLastError.KERNEL32 ref: 00007FFDA3488099

Strings

WSAStartup, xrefs: 00007FFDA348806F
ws2_32.dll, xrefs: 00007FFDA348804E

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: WSAStartup$ws2_32.dll
API String ID: 2540614322-1976915905
Opcode ID: b09a82c92f7f546557ada2d47e9566cf0baec7d7ecfa32dff5c5a9a1503d013e
Instruction ID: 1e6ff8d7c1dfb03db69305caacb9ead5e0509f0b8e7b9582ac3ebb133cb7185e
Opcode Fuzzy Hash: b09a82c92f7f546557ada2d47e9566cf0baec7d7ecfa32dff5c5a9a1503d013e
Instruction Fuzzy Hash: 55015E31A1DB41C2E620DB10F854329B361FB847A4F101235E58E92B69CFBDD5C48B04

Function 00007FFDA3488240 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BB073,?,?,?,?,00007FFDA34BAB83), ref: 00007FFDA3488250
GetProcAddress.KERNEL32 ref: 00007FFDA3488276
FreeLibrary.KERNEL32 ref: 00007FFDA348828E
GetLastError.KERNEL32 ref: 00007FFDA3488294

Strings

closesocket, xrefs: 00007FFDA348826A
ws2_32.dll, xrefs: 00007FFDA3488249

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: closesocket$ws2_32.dll
API String ID: 2540614322-181964208
Opcode ID: 3fefd687c93cc16ac5c0f73265be1874ef04f7f879d6f0608bedc8a6b0f68dc9
Instruction ID: 538bc9062aff60cd4fb7deaf7a51fa41b909b1ba243f59384fba7106b50417ba
Opcode Fuzzy Hash: 3fefd687c93cc16ac5c0f73265be1874ef04f7f879d6f0608bedc8a6b0f68dc9
Instruction Fuzzy Hash: 1D011D35A1EE42C6E620DB10F864369B371FBC4764F501231E58E92BA5CFBDD5C58B08

Function 00007FFDA34881D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BB079,?,?,?,?,00007FFDA34BAB83), ref: 00007FFDA34881DB
GetProcAddress.KERNEL32 ref: 00007FFDA3488201
FreeLibrary.KERNEL32 ref: 00007FFDA3488219
GetLastError.KERNEL32 ref: 00007FFDA348821F

Strings

ws2_32.dll, xrefs: 00007FFDA34881D4
WSACleanup, xrefs: 00007FFDA34881F5

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: WSACleanup$ws2_32.dll
API String ID: 2540614322-2677834364
Opcode ID: d4c9f652633523056b2cb113cf7c70b1b34af1ea84f87650ba350b30f5e514b2
Instruction ID: 0d6da7741c9b1baac1a856370659a99ac193668b81c80da1d03c09a86eb0045a
Opcode Fuzzy Hash: d4c9f652633523056b2cb113cf7c70b1b34af1ea84f87650ba350b30f5e514b2
Instruction Fuzzy Hash: 25F0AF35B1EE42C7F2209B14F864369B371FB847A4F501231E58E92B65CFBDD5848B08

Function 00007FFDA3488160 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BAD2F), ref: 00007FFDA348816B
GetProcAddress.KERNEL32 ref: 00007FFDA3488191
FreeLibrary.KERNEL32 ref: 00007FFDA34881A9
GetLastError.KERNEL32 ref: 00007FFDA34881AF

Strings

WSAGetLastError, xrefs: 00007FFDA3488185
ws2_32.dll, xrefs: 00007FFDA3488164

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: WSAGetLastError$ws2_32.dll
API String ID: 2540614322-1955703101
Opcode ID: fe3d982a96a16abdc97643669944ad9cefe5dc86cd7eec1d1c0fa1a680c5434b
Instruction ID: 73852047d22b292504767087b4ee06243a3562d9ceb91f45c2e8af054d6c7416
Opcode Fuzzy Hash: fe3d982a96a16abdc97643669944ad9cefe5dc86cd7eec1d1c0fa1a680c5434b
Instruction Fuzzy Hash: 4EF04F35A1EA42C7E620DB10F864369B362FB94764F501231E58E92B65CFBDD5848B08

Function 00007FFDA34C3018 Relevance: 9.2, APIs: 6, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDA34C3088
MultiByteToWideChar.KERNEL32 ref: 00007FFDA34C3126
LCMapStringEx.KERNEL32 ref: 00007FFDA34C318F
LCMapStringEx.KERNEL32 ref: 00007FFDA34C31E1
LCMapStringEx.KERNEL32 ref: 00007FFDA34C3286
WideCharToMultiByte.KERNEL32 ref: 00007FFDA34C32E0

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e599737eeba393ba2e7364258460f95dd52f47ec3c249f4a66a619b501052b22
Instruction ID: 57b604d832e6cd2e07de15317683424662ac96d48666ad83ba4cc5063f548e8b
Opcode Fuzzy Hash: e599737eeba393ba2e7364258460f95dd52f47ec3c249f4a66a619b501052b22
Instruction Fuzzy Hash: 0E81D472B0A74186EB208F19E46027A7292FF44BE4F144631FA5D93BDADFBDD4418708

Function 00007FFDA34BACA0 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 00007FFDA34BACEE

Part of subcall function 00007FFDA34C4720: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C4770
Part of subcall function 00007FFDA34C4720: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C47B1

std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BAD60
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34BADB5
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BAE2F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34BAECD
std::runtime_error::runtime_error.LIBCPMTD ref: 00007FFDA34BAF92

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: std::runtime_error::runtime_error$Concurrency::details::EmptyQueue::StructuredWork$ExceptionFileHeaderRaisestd::bad_exception::bad_exception
String ID:
API String ID: 3965443834-0
Opcode ID: 0d4e2dfe6f9cec561199eb6ced0db4a94df36823f4d8a24ec355e669d2707ef8
Instruction ID: 4c9d1476c32bb0f28531e2666e2a71eb9dabca8acbd7e83f2657a869e231c97a
Opcode Fuzzy Hash: 0d4e2dfe6f9cec561199eb6ced0db4a94df36823f4d8a24ec355e669d2707ef8
Instruction Fuzzy Hash: 21911A3270E6828AD760DB24E4A17AAB7A1EBC4744F404131E68DD3BAADF7DD945CF04

Function 00007FFDA34A8530 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 00007FFDA34A85E4

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: 7474813165e588f6f20f2e4cb041319f60019012d1210d351f19dbeef243aec6
Instruction ID: 3a492a1cde922309f3757b63f993385fcfdb975213dcd4df2fa957dfaa3e7e55
Opcode Fuzzy Hash: 7474813165e588f6f20f2e4cb041319f60019012d1210d351f19dbeef243aec6
Instruction Fuzzy Hash: 24810032A0E6C186E620DB65E4603BEB7A2FBC5740F504436E68DA7B9BDE7DD404CB44

Function 00007FFDA34ADBC0 Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FFDA34ADCD7
shared_ptr.LIBCMTD ref: 00007FFDA34ADCEE
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34ADE45
std::ios_base::width.LIBCPMTD ref: 00007FFDA34ADEAA

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::EmptyMpunctQueue::StructuredWorkshared_ptrstd::ios_base::width
String ID:
API String ID: 2515095778-0
Opcode ID: cc37aa2f08600195c4d40083c9100ee5bb4f7a66da4c1f895df5384b038f517e
Instruction ID: 41cab85c1b613af2349174f4a9d6c7e6431f1ea8b54436af76e22767d49cf53c
Opcode Fuzzy Hash: cc37aa2f08600195c4d40083c9100ee5bb4f7a66da4c1f895df5384b038f517e
Instruction Fuzzy Hash: FB81E63261DAC595DA70EB11E4603EBA762FBC8780F804432EACD93B9ADE6DD544CB44

Function 00007FFDA34C246C Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFDA34C24BD
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C24DC
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C24FE
sys_get_time.LIBCPMT ref: 00007FFDA34C2519
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C253F
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C2557

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
String ID:
API String ID: 184115430-0
Opcode ID: 2419752cfd1b9c9900042bb42ff48b6b6b5b9f09afe652682e084dd5a96abbf7
Instruction ID: 323aa0451d4b418a93e99a982619acf066312a287c271b9094cd17ea20c1ad2a
Opcode Fuzzy Hash: 2419752cfd1b9c9900042bb42ff48b6b6b5b9f09afe652682e084dd5a96abbf7
Instruction Fuzzy Hash: B0411F32B1A64286EFA48F18E47027A7362EB54B44F504031DA4DA6797DFFEE891C708

Function 00007FFDA349FBB0 Relevance: 9.1, APIs: 6, Instructions: 90threadCOMMON

Download Yara Rule

APIs

List.LIBCMTD ref: 00007FFDA349FBE6
std::_Atomic_long::operator=.LIBCONCRTD ref: 00007FFDA349FC19
atomic_compare_exchange.LIBCONCRTD ref: 00007FFDA349FC5C
GetCurrentThreadId.KERNEL32 ref: 00007FFDA349FC8F

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Atomic_long::operator=CurrentListThreadatomic_compare_exchangestd::_
String ID:
API String ID: 2550250828-0
Opcode ID: 932c88e282ccbfc92ed9550ae828c613280df863858bfd3a7e06f2706118e393
Instruction ID: 757baa7aae590ca319647eb91a65f4a8ccfb14a559e47c9a50d459118ca6bc19
Opcode Fuzzy Hash: 932c88e282ccbfc92ed9550ae828c613280df863858bfd3a7e06f2706118e393
Instruction Fuzzy Hash: 5731B931F0E74282EA20DB15E42527F6791FF81784F404136EA8D97B5BCE6DD500CB48

Function 00007FFDA34AC850 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

ctype.LIBCPMTD ref: 00007FFDA34AC9E1
_Mpunct.LIBCPMTD ref: 00007FFDA34ACA41
_Mpunct.LIBCPMTD ref: 00007FFDA34ACA81
std::ios_base::width.LIBCPMTD ref: 00007FFDA34ACE53

Strings

@, xrefs: 00007FFDA34ACBA8

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Mpunct$ctypestd::ios_base::width
String ID: @
API String ID: 3075750325-2766056989
Opcode ID: 79372846ecdc4f70b43a1b702baf31c287688e89bcffe4d267ae24acf13d0921
Instruction ID: 3e30d4ba706c94579cdc57728a214d199d24f6fb756e1d98dc784a16a37ddb1a
Opcode Fuzzy Hash: 79372846ecdc4f70b43a1b702baf31c287688e89bcffe4d267ae24acf13d0921
Instruction Fuzzy Hash: DDF10B32A0DAC585DA70DB15E4A43EFA762F7C8780F440432EACD93B6ADEADD541CB44

Function 00007FFDA34D2580 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000009D489A1DE3B,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D258F
FlsSetValue.KERNEL32(?,?,000009D489A1DE3B,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D25C5
FlsSetValue.KERNEL32(?,?,000009D489A1DE3B,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D25F2
FlsSetValue.KERNEL32(?,?,000009D489A1DE3B,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D2603
FlsSetValue.KERNEL32(?,?,000009D489A1DE3B,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D2614
SetLastError.KERNEL32(?,?,000009D489A1DE3B,00007FFDA34D0205,?,?,?,?,00007FFDA34DB486,?,?,00000000,00007FFDA34DCFC7,?,?,?), ref: 00007FFDA34D262F

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 435f29dc0b08c15ea2ffc1f0fd31f297b1446d81bcf36e33eac221e9f765d392
Instruction ID: d783be70ca006d625c2137e3a50fe9af34465ff1e23c5790b059aceac87eb0a1
Opcode Fuzzy Hash: 435f29dc0b08c15ea2ffc1f0fd31f297b1446d81bcf36e33eac221e9f765d392
Instruction Fuzzy Hash: 3A118122B0F24242FA955375A67213962935F447F0F044738E93EB67DBDEAFE8408608

Function 00007FFDA34B84A0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B853C
CreateStreamOnHGlobal.OLE32(00000018,00000018), ref: 00007FFDA34B86B9
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B8848

Strings

&, xrefs: 00007FFDA34B8610
png, xrefs: 00007FFDA34B866C

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::Concurrency::details::_CreateCriticalEmptyGlobalLock::_Queue::ReentrantScoped_lockScoped_lock::~_StreamStructuredWork
String ID: &$png
API String ID: 937857008-590921033
Opcode ID: 469256df4940998a6b6a9f97b8e87e3b9809380934d3a3bbe8bc8221eaec6767
Instruction ID: 8bf7175d463f3b2287746c48db01fb5e2121847fcc3efae83609bbb38fc1d759
Opcode Fuzzy Hash: 469256df4940998a6b6a9f97b8e87e3b9809380934d3a3bbe8bc8221eaec6767
Instruction Fuzzy Hash: 16B1F93261AA8186D760DF25E4A07AFB761FBC5784F505022E68E93B6ADF7DD844CF00

Function 00007FFDA34A9650 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FFDA34A9665
GetWindowTextW.USER32 ref: 00007FFDA34A96B7

Part of subcall function 00007FFDA34A61D0: _WChar_traits.LIBCPMTD ref: 00007FFDA34A61F6

Part of subcall function 00007FFDA34A4410: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4448
Part of subcall function 00007FFDA34A4410: WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4482
Part of subcall function 00007FFDA34A4410: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A44B5
Part of subcall function 00007FFDA34A4410: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A44D9
Part of subcall function 00007FFDA34A4410: WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4514

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A9703

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

GetLastError.KERNEL32 ref: 00007FFDA34A9743

Strings

W e: , xrefs: 00007FFDA34A976C

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ByteCharConcurrency::details::Concurrency::details::_CriticalEmptyLock::_MultiQueue::ReentrantScoped_lockScoped_lock::~_StructuredWideWindowWork$Char_traitsErrorForegroundLastTextchar_traits
String ID: W e:
API String ID: 3735979991-3170417794
Opcode ID: f1407232e072fda95da15e61cd8e4a8da2bd02a319f69da54a8653bc12c24653
Instruction ID: 4ec4733c558f5c55dfda6c2d5a00264270f2f6300ce5dc847b0538fc89c7a407
Opcode Fuzzy Hash: f1407232e072fda95da15e61cd8e4a8da2bd02a319f69da54a8653bc12c24653
Instruction Fuzzy Hash: C531493261AAC186E7209B14E4903AAB7A2FBC4780F400032E6CD93B6ADF7DC544CF44

Function 00007FFDA34B7190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57processCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34B7234
CreateProcessW.KERNEL32 ref: 00007FFDA34B727D
CloseHandle.KERNEL32 ref: 00007FFDA34B7288
CloseHandle.KERNEL32 ref: 00007FFDA34B7293

Strings

h, xrefs: 00007FFDA34B7221

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CloseHandle$Concurrency::details::CreateEmptyProcessQueue::StructuredWork
String ID: h
API String ID: 4039953145-2439710439
Opcode ID: 1fb3b1661452321f49f255d9558171575636aca6ab531ad18d52b59ca12d7b4b
Instruction ID: 3af31c94ba3a3b64fc5195f6be8886fe07902abe9e0b2099e74f2e92e9340643
Opcode Fuzzy Hash: 1fb3b1661452321f49f255d9558171575636aca6ab531ad18d52b59ca12d7b4b
Instruction Fuzzy Hash: AB210C32619BC596DB20DB50F4A43AAB7A2F7C4784F504135E68D83BA9DF7DD158CB00

Function 00007FFDA3495840 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00007FFDA34958F8
std::ios_base::failure::failure.LIBCPMTD ref: 00007FFDA349590A

Part of subcall function 00007FFDA34C4720: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C4770
Part of subcall function 00007FFDA34C4720: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C47B1

Strings

ios_base::badbit set, xrefs: 00007FFDA34958BB
ios_base::failbit set, xrefs: 00007FFDA34958D4
ios_base::eofbit set, xrefs: 00007FFDA34958E2

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ExceptionFileHeaderRaisestd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1846417002-1866435925
Opcode ID: b43a7e3578587d706e7b548345c629502e0c54278e9975b3f49c218492a832f3
Instruction ID: 48fec6a405866ab8586c6b613013d6e188dd958ea6267f4e967d955b7c75f1e0
Opcode Fuzzy Hash: b43a7e3578587d706e7b548345c629502e0c54278e9975b3f49c218492a832f3
Instruction Fuzzy Hash: 7D216D32B0E6858AE770DB14E4613AA77A5FB88380F604075E6CDD3B5ADF6DD514CB08

Function 00007FFDA34883E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,00007FFDA34BADD7), ref: 00007FFDA34883FF
GetProcAddress.KERNEL32 ref: 00007FFDA3488425
FreeLibrary.KERNEL32 ref: 00007FFDA348843D

Strings

ws2_32.dll, xrefs: 00007FFDA34883F8
send, xrefs: 00007FFDA3488419

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: send$ws2_32.dll
API String ID: 145871493-892776409
Opcode ID: c72203c53a645444ab5a65247ba5a24b2c4a71c4cc6107fc3a1fdc2c7bd87a1a
Instruction ID: e22c6cdafc4035790fa7306b1aba77462b06ce57dd63942a6981acaf5060e7a9
Opcode Fuzzy Hash: c72203c53a645444ab5a65247ba5a24b2c4a71c4cc6107fc3a1fdc2c7bd87a1a
Instruction Fuzzy Hash: 81011B76A1DB41C6D720CB14F45022AB7A1FB88BA4F500235FA8D93BA9DFBDD5948F04

Function 00007FFDA3488340 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA348835F
GetProcAddress.KERNEL32 ref: 00007FFDA3488385
FreeLibrary.KERNEL32 ref: 00007FFDA348839D

Strings

recv, xrefs: 00007FFDA3488379
ws2_32.dll, xrefs: 00007FFDA3488358

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: recv$ws2_32.dll
API String ID: 145871493-734160684
Opcode ID: 121e80b15e865c187d828cee44cba9d0fed0f36d3c849a73d0b7ed05107ab776
Instruction ID: c399aeb4a116ce890aac8dec93d0b915e09262ec30843d176553683bf652d8dd
Opcode Fuzzy Hash: 121e80b15e865c187d828cee44cba9d0fed0f36d3c849a73d0b7ed05107ab776
Instruction Fuzzy Hash: FD015B76A1DB81C7D720CB10F85422EB761FB887A4F501235EA8D93BA9CFBDD5948B04

Function 00007FFDA3488590 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34885AE
GetProcAddress.KERNEL32 ref: 00007FFDA34885D1
FreeLibrary.KERNEL32 ref: 00007FFDA34885E9

Strings

ws2_32.dll, xrefs: 00007FFDA34885A7
inet_ntop, xrefs: 00007FFDA34885C5

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: inet_ntop$ws2_32.dll
API String ID: 145871493-102659834
Opcode ID: c59f4af2208141b044d29c11331e9f013cc3aa828399f6e03293c1c1ef900ac2
Instruction ID: a7d6cec058aa267a12e1d150763dcbe2c94f47d826ef170c2ae8775ea521b95f
Opcode Fuzzy Hash: c59f4af2208141b044d29c11331e9f013cc3aa828399f6e03293c1c1ef900ac2
Instruction Fuzzy Hash: 66010576A1DB85C2D660CF10F45436AB3A2FB98794F500535EA8E92B29CFBCD1948B08

Function 00007FFDA3488480 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA348849A
GetProcAddress.KERNEL32 ref: 00007FFDA34884C0
FreeLibrary.KERNEL32 ref: 00007FFDA34884D8

Strings

ws2_32.dll, xrefs: 00007FFDA3488493
connect, xrefs: 00007FFDA34884B4

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: connect$ws2_32.dll
API String ID: 145871493-3612281207
Opcode ID: f5f71e3294bcdaee4bc318451acc9ebf704ca82ba944e65828b1c7f76f833850
Instruction ID: 7e8a198b0c658dcbd9332d1eb6801cc1abb2b525ca932df5771e8e700bc2a7d7
Opcode Fuzzy Hash: f5f71e3294bcdaee4bc318451acc9ebf704ca82ba944e65828b1c7f76f833850
Instruction Fuzzy Hash: 70014C76A1DB41C2D660DF14F85032AB761FBC47A4F500235E68E82BA9DFBDD584CB04

Function 00007FFDA3487FB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDA34BA88D), ref: 00007FFDA3487FC8
GetProcAddress.KERNEL32 ref: 00007FFDA3487FF0
FreeLibrary.KERNEL32 ref: 00007FFDA3488008

Strings

socket, xrefs: 00007FFDA3487FE4
ws2_32.dll, xrefs: 00007FFDA3487FC1

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: socket$ws2_32.dll
API String ID: 145871493-3483875929
Opcode ID: cb9d8312e756911d49cd4f51c7db7d5e4ea26f9f0e7ec16d753f30e905b98c22
Instruction ID: a603addd9121d924a5cbc9dde7251501221e431f493f6a3e2efe0e2168524ad8
Opcode Fuzzy Hash: cb9d8312e756911d49cd4f51c7db7d5e4ea26f9f0e7ec16d753f30e905b98c22
Instruction Fuzzy Hash: AB011736A1AB8186D620CB15E45022AB761FB897B4F500335E6AD82BE9CFBDD5848F04

Function 00007FFDA34D1248 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFDA34D126D
GetProcAddress.KERNEL32 ref: 00007FFDA34D1283
FreeLibrary.KERNEL32 ref: 00007FFDA34D12AA

Strings

CorExitProcess, xrefs: 00007FFDA34D127C
mscoree.dll, xrefs: 00007FFDA34D1264

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72ebaf5c356ca3ee2904821ff4c5dd1cd3c14096ca2d9aba3ba6fdd35b476235
Instruction ID: dc1c5aa2cf0f5af80a3cda695bb1508729a0fef86102d5be660a1833360dfe4a
Opcode Fuzzy Hash: 72ebaf5c356ca3ee2904821ff4c5dd1cd3c14096ca2d9aba3ba6fdd35b476235
Instruction Fuzzy Hash: 7BF0C265B1A60281FA108B64E4653796362AF85BA0F580335CA6DE53F5CFAED0888308

Function 00007FFDA3488510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA3488520
GetProcAddress.KERNEL32 ref: 00007FFDA3488546
FreeLibrary.KERNEL32 ref: 00007FFDA348855E

Strings

htons, xrefs: 00007FFDA348853A
ws2_32.dll, xrefs: 00007FFDA3488519

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: htons$ws2_32.dll
API String ID: 145871493-1975133265
Opcode ID: 439baf8cef27b03b02ca0dfe2403df779e1052c0166b6725c54574d1b49bfcac
Instruction ID: c293985f83628798d86825107d7b6ec9e8bcbca862b6098210f10b1c52ebb9f5
Opcode Fuzzy Hash: 439baf8cef27b03b02ca0dfe2403df779e1052c0166b6725c54574d1b49bfcac
Instruction Fuzzy Hash: FC016D36A1EA42C2E7609B10E46433AB3A1FF84794F500136E58ED2BA5DFBDD5859B08

Function 00007FFDA34886C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34886D0
GetProcAddress.KERNEL32 ref: 00007FFDA34886F1
FreeLibrary.KERNEL32 ref: 00007FFDA3488709

Strings

freeaddrinfo, xrefs: 00007FFDA34886E5
ws2_32.dll, xrefs: 00007FFDA34886C9

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: freeaddrinfo$ws2_32.dll
API String ID: 145871493-447766333
Opcode ID: 6b8569ae28fb1e528403060c51b49f1547483ef8ef8edf79f62fa932a7e04958
Instruction ID: 366389cc99fa89df905d79cbcd552a668f9bb3cb7fa9c382576d09a6d8a16406
Opcode Fuzzy Hash: 6b8569ae28fb1e528403060c51b49f1547483ef8ef8edf79f62fa932a7e04958
Instruction Fuzzy Hash: E1F0F93AA1EA41C2E6209B10F864369B371FBC9798F600131D58E92B65CFBDD584C708

Function 00007FFDA34C5D28 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFDA34C5E4B
__AdjustPointer.LIBCMT ref: 00007FFDA34C5E96

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2c4cd24dc23d04e538900412c8b76dc8e884207eadeb2926ca5d18de86a86aa6
Instruction ID: 18b97a368eae33db430366af634a8d02ba42a898df0e96af639b23772748bd3a
Opcode Fuzzy Hash: 2c4cd24dc23d04e538900412c8b76dc8e884207eadeb2926ca5d18de86a86aa6
Instruction Fuzzy Hash: FEB1D431B0F74281FA65DB1A906417D6392EF44B86F098476DE8DA7787DFAEE4428308

Function 00007FFDA3496740 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 00007FFDA34967E3
fpos.LIBCPMTD ref: 00007FFDA349696B
fpos.LIBCPMTD ref: 00007FFDA34969A6
fpos.LIBCPMTD ref: 00007FFDA3496A19

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: f351de1dbd54376754315496ebcd0fc187e74d0cf5171b4e2e2ccbca7ab9123b
Instruction ID: 27b67b834ee511a65b5adf130fed4193d7b314309f4b59458245827c4df1681e
Opcode Fuzzy Hash: f351de1dbd54376754315496ebcd0fc187e74d0cf5171b4e2e2ccbca7ab9123b
Instruction Fuzzy Hash: 42A18D2270EB8585EAB0CB15E46036AB7A1F7C57A4F100235EAEDD3B9ACF6DD440CB04

Function 00007FFDA34D9800 Relevance: 7.7, APIs: 5, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDA34D983F
_set_statfp.LIBCMT ref: 00007FFDA34D985D
_set_statfp.LIBCMT ref: 00007FFDA34D9886
_set_statfp.LIBCMT ref: 00007FFDA34D9AC2

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c355139fb5d490f5a378c13f74b27d4e88c3ad045c11d9cfe0408108ad209acf
Instruction ID: 097c70b41600db91b15a9690c97e0ddc7b9cd53caada28e0764ebbb3ce5d71cc
Opcode Fuzzy Hash: c355139fb5d490f5a378c13f74b27d4e88c3ad045c11d9cfe0408108ad209acf
Instruction Fuzzy Hash: 1A812B13B0EA8645F2328B35A42037B6252FF457D4F084331E94EF6796EFBEE4818608

Function 00007FFDA34977C0 Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630393fca0c67851686c251f707a3871fec54fb42ba9ee963f6652eefca2e4fa
Instruction ID: 60d5b64152aaff84b319ac6b3d5a2ddd0ea2ca5b4fac1f9c04017846a3479dfd
Opcode Fuzzy Hash: 630393fca0c67851686c251f707a3871fec54fb42ba9ee963f6652eefca2e4fa
Instruction Fuzzy Hash: AC613A3260E6828AD760DB25E4613AEB7A1FBC4744F004135E68DD3BAADE7DD941CF04

Function 00007FFDA349F070 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

Concurrency::details::_Task_impl_base::_IsCompleted.LIBCPMTD ref: 00007FFDA349F10A
Concurrency::details::_Task_impl_base::_IsCanceled.LIBCPMTD ref: 00007FFDA349F11E
Concurrency::details::_Task_impl_base::_IsPendingCancel.LIBCPMTD ref: 00007FFDA349F132

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::_Task_impl_base::_$CancelCanceledCompletedPending
String ID:
API String ID: 253852663-0
Opcode ID: 96f5ec8156682c59687e470b00a6f89af41b73d4884fafaf8d6d2f3c44f2daaa
Instruction ID: ee2e4d35468fd926b2ab8facb3e7f462ce54b9dbd14011b4bc0025f0e1c4a410
Opcode Fuzzy Hash: 96f5ec8156682c59687e470b00a6f89af41b73d4884fafaf8d6d2f3c44f2daaa
Instruction Fuzzy Hash: 4F516061B1E6C285EA30D725E8613BB6792FF81745F400036E6CD9779BCEAED8048B48

Function 00007FFDA34A4A90 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3487D30: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3487D3E
Part of subcall function 00007FFDA3487D30: _Max_value.LIBCPMTD ref: 00007FFDA3487D63
Part of subcall function 00007FFDA3487D30: _Min_value.LIBCPMTD ref: 00007FFDA3487D91

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4AC9
char_traits.LIBCPMTD ref: 00007FFDA34A4B2A
char_traits.LIBCPMTD ref: 00007FFDA34A4B4D
char_traits.LIBCPMTD ref: 00007FFDA34A4BDE

Part of subcall function 00007FFDA34A73D0: wmemset.LIBCMTD ref: 00007FFDA34A73F3

char_traits.LIBCPMTD ref: 00007FFDA34A4C06

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valuewmemset
String ID:
API String ID: 1140703174-0
Opcode ID: 28118e790413db02ba06dbb63724687c31dc690438f373b7df5c7ec3ffc14a31
Instruction ID: 9ef2c867029fe50854c9977d040ea11fe87003b8e2a44625901e0db3244c27ea
Opcode Fuzzy Hash: 28118e790413db02ba06dbb63724687c31dc690438f373b7df5c7ec3ffc14a31
Instruction Fuzzy Hash: 8B413126A1EB8182CA10EB15F0A116EB7A1FBC9B84F101531FB8D93B6ADF7DD500CB44

Function 00007FFDA34A4410 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A4448
WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4482
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A44B5
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A44D9
WideCharToMultiByte.KERNEL32 ref: 00007FFDA34A4514

Part of subcall function 00007FFDA34A6340: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A63C7

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$ByteCharMultiWide$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 3668445282-0
Opcode ID: feb59e4277cd1bc07c5903275af858b3bdc952d6bc7b52214309763333dbf615
Instruction ID: 148e54ef1d137c384dd82f00ca59e1c73079700ae36ce34984c1f5a433e7678a
Opcode Fuzzy Hash: feb59e4277cd1bc07c5903275af858b3bdc952d6bc7b52214309763333dbf615
Instruction Fuzzy Hash: D531D532609B8086E710DB11F4A03ABB7A2FBC5780F504035E6CD97BAADF7DD5448B84

Function 00007FFDA34CF278 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34CF2A3
CreateThread.KERNEL32 ref: 00007FFDA34CF2E4
GetLastError.KERNEL32 ref: 00007FFDA34CF2F2
CloseHandle.KERNEL32 ref: 00007FFDA34CF308
FreeLibrary.KERNEL32 ref: 00007FFDA34CF317

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 48142ec23890b9d666768e3bec8b18f94dd262d1b6a98ec5d17004b6353bfdbe
Instruction ID: 254c642c4378a44b0e57ebfe056d6db493a3d2d98aa59e9c2528dc2f1d39313d
Opcode Fuzzy Hash: 48142ec23890b9d666768e3bec8b18f94dd262d1b6a98ec5d17004b6353bfdbe
Instruction Fuzzy Hash: C221B03AB0A74295EE15DF69A420079A3A2BF84BC4F044432DE4DA3766DFBEE441C708

Function 00007FFDA34E4D88 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDA34E4DB0
_set_statfp.LIBCMT ref: 00007FFDA34E4DCB
_set_statfp.LIBCMT ref: 00007FFDA34E4DE7
_set_statfp.LIBCMT ref: 00007FFDA34E4E23

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: 66fee999b0592df2276595fe66a59b1db24af4072010bedc5a1abc6515b6ab52
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: F6118222F59A0309F6641168D4773FA12436F54370F290634E96EE6BD78E9EAC518308

Function 00007FFDA34D2648 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D2667
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D2686
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D26AE
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D26BF
FlsSetValue.KERNEL32(?,?,?,00007FFDA34C91C7,?,?,00000000,00007FFDA34C9462,?,?,?,?,?,00007FFDA34C93EE), ref: 00007FFDA34D26D0

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 55a71dbf9ac874c83f6ac74c021f0361749d55d11ca7e1ccf0da29cca11a1ccc
Instruction ID: 263300780ad994cb19b689362772da8c6fa7b1b33902d77bc116acc892dd37fe
Opcode Fuzzy Hash: 55a71dbf9ac874c83f6ac74c021f0361749d55d11ca7e1ccf0da29cca11a1ccc
Instruction Fuzzy Hash: B8117222F0F34241FA995365B97217952836F447E0F044339E43DB67EBDEAEE8418608

Function 00007FFDA34D24DC Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D24ED
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D250C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2534
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2545
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDA34D02A7,?,?,00000000,00007FFDA34D6655), ref: 00007FFDA34D2556

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4ea9c206f2e30472a92ba4007f45e5b12dc359bfcd63525b0d8e9d9d8d647d81
Instruction ID: 73f195dba91e885b7d225ef88e2a485c946daccf568d39822391a88dabd31b12
Opcode Fuzzy Hash: 4ea9c206f2e30472a92ba4007f45e5b12dc359bfcd63525b0d8e9d9d8d647d81
Instruction Fuzzy Hash: 01111C22F0B20245FAD9A275687257912834F417E0F044738D93EFA3D7EDAFB841820C

Function 00007FFDA34C6928 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDA34C6AC6

Strings

csm, xrefs: 00007FFDA34C6A0D
csm, xrefs: 00007FFDA34C6A6F
csm, xrefs: 00007FFDA34C6AED

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Is_bad_exception_allowed
String ID: csm$csm$csm
API String ID: 2758241748-393685449
Opcode ID: 13a2de92f2e39b7531bb161bb28b9f9a2f294045cf3d54dfe874a6e248b54c91
Instruction ID: 400167111d7e6fcf41a49bd264c26420e8dc39d9566970f91772a8370a440b95
Opcode Fuzzy Hash: 13a2de92f2e39b7531bb161bb28b9f9a2f294045cf3d54dfe874a6e248b54c91
Instruction Fuzzy Hash: 39E1D132A096828AF7509F29D4A03BC7BA2FB45758F148135DA8CA7757DF7EE481CB04

Function 00007FFDA34D82D4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D85B3

Part of subcall function 00007FFDA34E19F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E1A11

Strings

ccs, xrefs: 00007FFDA34D84EE
UTF-16LEUNICODE, xrefs: 00007FFDA34D8551
UTF-8, xrefs: 00007FFDA34D8532

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 68af55e2dee7aa88f8a662d6324b7d7729190ee39c0489d8eb327fd976cebb93
Instruction ID: c604ce50e62b96c3f53bedc4e81ad57baaab2e9ca0e0e0c578fc6822dfaceae4
Opcode Fuzzy Hash: 68af55e2dee7aa88f8a662d6324b7d7729190ee39c0489d8eb327fd976cebb93
Instruction Fuzzy Hash: 0A816773F0A20285F7B59F19C57027826A2AB11BC4F558035CA0DF7796DBBFE9019709

Function 00007FFDA34D8010 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34D82B9

Part of subcall function 00007FFDA34E1BDC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDA34E1BF9

Strings

UTF-16LEUNICODE, xrefs: 00007FFDA34D825D
ccs, xrefs: 00007FFDA34D8205
UTF-8, xrefs: 00007FFDA34D823C

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 9ca26269acad0683e8ef55a6b9071003c8b65fc42e814e871ea6335cb571c350
Instruction ID: 0f95dc26b9b73100425f0958ff30513fcdaee97fa96c411004f42afbe51b9b1b
Opcode Fuzzy Hash: 9ca26269acad0683e8ef55a6b9071003c8b65fc42e814e871ea6335cb571c350
Instruction Fuzzy Hash: 63819233F0E64289F7754B28D67037C2B929F527C4F595035CA0AF6397CAAFA8058309

Function 00007FFDA34D8B10 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 204fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00008000), ref: 00007FFDA34D8BDE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00008000), ref: 00007FFDA34D8D85

Strings

RCR, xrefs: 00007FFDA34D8BCE
SRCR, xrefs: 00007FFDA34D8DBF

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: RCR$SRCR
API String ID: 1948546556-2591298178
Opcode ID: 586b136ce8644c6ec137099a25725316719ca72ae6105a32eec3cfa5507b0a73
Instruction ID: 0584371971fc0c9718a2ee63405feb2b4f86bba77c86d9aea0ee2b04ae4c0808
Opcode Fuzzy Hash: 586b136ce8644c6ec137099a25725316719ca72ae6105a32eec3cfa5507b0a73
Instruction Fuzzy Hash: 47911513B1E6C585FB615A2494643B86BC2BB52FD4F184232D69DA73D7CABEE440C309

Function 00007FFDA34C709C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDA34C710C
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDA34C7157

Strings

MOC, xrefs: 00007FFDA34C7120
RCC, xrefs: 00007FFDA34C7128

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8cd02e8cba5055ee867d26c7a08f41aabd6380dba5d3ecf13f2aaed9126bfb2d
Instruction ID: 1f3dc11fd7dc7c4bb468a4d6b680a15e62813feeb65c7b64a277bdef36ef8989
Opcode Fuzzy Hash: 8cd02e8cba5055ee867d26c7a08f41aabd6380dba5d3ecf13f2aaed9126bfb2d
Instruction Fuzzy Hash: 4791A173B097818AE710CB69E8A02AD7BB1F744788F104126EF8C67B56DF79D195CB04

Function 00007FFDA34C56B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C56E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFDA34C577A
RtlUnwindEx.KERNEL32 ref: 00007FFDA34C57D4

Strings

csm, xrefs: 00007FFDA34C5761

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 265ea48305644b817d5518f26b2426f1599f0e92365fc373ba274e768d46161f
Instruction ID: df08a0ac18de3e59eaeb04b984e0238da87328ff5e3b8ba29df3d687dbbfd1b3
Opcode Fuzzy Hash: 265ea48305644b817d5518f26b2426f1599f0e92365fc373ba274e768d46161f
Instruction Fuzzy Hash: 0651E531B1B6068AEB54CF1AE464A7C3392FB40B99F144171DA4E93746DFBEE891C704

Function 00007FFDA34C6E2C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDA34C6E8B
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDA34C6ED7

Strings

MOC, xrefs: 00007FFDA34C6E9F
RCC, xrefs: 00007FFDA34C6EA7

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5857cf24f1b6541e0db60816518d10e6407131af82c64cb5755d45eb63a1e946
Instruction ID: 0bfd5a214d38eae89f962c306427fe785f033ed5f0ff3b262873c436e4335c11
Opcode Fuzzy Hash: 5857cf24f1b6541e0db60816518d10e6407131af82c64cb5755d45eb63a1e946
Instruction Fuzzy Hash: CF61C332A09BC586E761CB19E4503AEB7A1FB85B94F044235EB9C57B96CFBDD090CB04

Function 00007FFDA34C761C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C7644
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFDA34C772C

Strings

csm, xrefs: 00007FFDA34C777E
csm, xrefs: 00007FFDA34C7666

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 48025d63aa6b6047f6d04173f3c05d04317f6c028d3daaca8f8c7585a31a2b89
Instruction ID: 95482aed25bfdf5dd95e0219d9a1519d4dcd92b4341f3df494dfb3d0a8c0b278
Opcode Fuzzy Hash: 48025d63aa6b6047f6d04173f3c05d04317f6c028d3daaca8f8c7585a31a2b89
Instruction Fuzzy Hash: F451B432B0A2458FDB748B1990642787BA2FB50B94F144135DB5C97B97CFBDE450CB09

Function 00007FFDA34A7CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDA34A7DD8

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 36a5356689fcb8d2607656b835cc6e0f026fc37f9764631d1787b7af226b8ab8
Instruction ID: 69d9576d81460c621d15ffae99958a1ac6f79ec52a4772ea0ae79957e17500e3
Opcode Fuzzy Hash: 36a5356689fcb8d2607656b835cc6e0f026fc37f9764631d1787b7af226b8ab8
Instruction Fuzzy Hash: C6611D32A0E7C185E6709B55E0603BBBBA2FB81380F504435E68D97B9BDF6ED844CB05

Function 00007FFDA34B8110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32 ref: 00007FFDA34B8179
DeleteObject.GDI32 ref: 00007FFDA34B82F2
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34B831C

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Part of subcall function 00007FFDA34B8380: CLSIDFromString.OLE32 ref: 00007FFDA34B83C7

Strings

jpg, xrefs: 00007FFDA34B818E

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::_CreateCriticalDeleteFromGlobalLock::_ObjectReentrantScoped_lockScoped_lock::~_StreamStringchar_traits
String ID: jpg
API String ID: 3472419032-1189616361
Opcode ID: 86eb31eb1de19e8a03d488835b784c104c0a7202ed47adf5df59e174cf309532
Instruction ID: 41cca05c6ecc892be8a0c469063ad88e18f218866f0dc94959207a7ba4bbfb19
Opcode Fuzzy Hash: 86eb31eb1de19e8a03d488835b784c104c0a7202ed47adf5df59e174cf309532
Instruction Fuzzy Hash: 0E51F932619A8582EB20DB15E4903AEB7A1F7C8B84F504522EBCD93B6ADF7DC544CF44

Function 00007FFDA3487DA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34C0E18: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FFDA3487DB1), ref: 00007FFDA34C0E2D

Part of subcall function 00007FFDA34C0DFC: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FFDA3487DBB), ref: 00007FFDA34C0E05

_Subatomic.LIBCONCRTD ref: 00007FFDA3487E0E
_Subatomic.LIBCONCRTD ref: 00007FFDA3487EAA

Strings

d, xrefs: 00007FFDA3487DDD

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: PerformanceQuerySubatomic$CounterFrequency
String ID: d
API String ID: 3831891851-2564639436
Opcode ID: f36356522a71dbb2b4534055f319af7a92a399f18409b5c24a9dfa018923f8ec
Instruction ID: b68f48fd0c2a9cf5de71f5b443b1563df2bbbfd792e2a03fef1c48e129b789e0
Opcode Fuzzy Hash: f36356522a71dbb2b4534055f319af7a92a399f18409b5c24a9dfa018923f8ec
Instruction Fuzzy Hash: C231FB2270AB8582DA709B19F4A136BB7A2F7C4794F005126E6CD87B6ADF7DD1148F04

Function 00007FFDA34A9030 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDA34A904B
GetProcAddress.KERNEL32 ref: 00007FFDA34A9096

Part of subcall function 00007FFDA34918A0: char_traits.LIBCPMTD ref: 00007FFDA34918C6

Strings

advapi32.dll, xrefs: 00007FFDA34A9044
GetUserNameW, xrefs: 00007FFDA34A908A

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProcchar_traits
String ID: GetUserNameW$advapi32.dll
API String ID: 1097116792-1952898584
Opcode ID: 80e5af94b1a02d1872650a55446e3730342baa81daa6dd7ec9b8264fd25396e9
Instruction ID: 342b447f57705063547d8c2b28e1503ff03fc80b05d1dbb5e48060ff441f339f
Opcode Fuzzy Hash: 80e5af94b1a02d1872650a55446e3730342baa81daa6dd7ec9b8264fd25396e9
Instruction Fuzzy Hash: D3412B32A1DAC582E620DB14E4A53AAB361FBC4784F401132E68DD7B6ADFBDD504CB04

Function 00007FFDA34D6C48 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFDA34D6CC7
WriteFile.KERNEL32 ref: 00007FFDA34D6F8F
WriteFile.KERNEL32 ref: 00007FFDA34D6FD5
GetLastError.KERNEL32 ref: 00007FFDA34D708B

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: cf44275678ca85f22590a109bd29db2bd094186d180eb530ce0a86cdfa5a6ae4
Instruction ID: 64fd509a1ce2147b9a8c2c896a155d1ce1e373244972b347b23eb7b311bb2a59
Opcode Fuzzy Hash: cf44275678ca85f22590a109bd29db2bd094186d180eb530ce0a86cdfa5a6ae4
Instruction Fuzzy Hash: E7D11133B09A8089EB11CF79D4502AC3BB2FB457D8B544236DE5DA7B9ADE7AD006C704

Function 00007FFDA34D7608 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDA34D75F3), ref: 00007FFDA34D7724
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDA34D75F3), ref: 00007FFDA34D77AF

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c7cbed1778484a4bb857a9e1385c60b8b35516ef06df28283499c270390ff4ad
Instruction ID: d82fd284eca5c5625f1ec2129aa6a13db3f46b30d5652651ff5020f143155bcd
Opcode Fuzzy Hash: c7cbed1778484a4bb857a9e1385c60b8b35516ef06df28283499c270390ff4ad
Instruction Fuzzy Hash: 5691F523F0965185F7508F2984A06BD7FA2AB01BD8F544139DE0EB3796DE7EE481C704

Function 00007FFDA3491940 Relevance: 6.2, APIs: 4, Instructions: 203COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491962
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491B0D
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491B22

Part of subcall function 00007FFDA3485970: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA348597E
Part of subcall function 00007FFDA3485970: _Max_value.LIBCPMTD ref: 00007FFDA34859A3
Part of subcall function 00007FFDA3485970: _Min_value.LIBCPMTD ref: 00007FFDA34859D1

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA3491C57

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
String ID:
API String ID: 348937374-0
Opcode ID: 9f84a68244e8d41638f94a4cdbedc62e82daed3d618e4f6bfc3aedd44e4120fa
Instruction ID: 3b939e59ba2f10dfa8fbb1577bce5a9823a0918f13f384a2f10cf24e796a8d75
Opcode Fuzzy Hash: 9f84a68244e8d41638f94a4cdbedc62e82daed3d618e4f6bfc3aedd44e4120fa
Instruction Fuzzy Hash: 47A1FE2660EB8585DA60DB56F49036FA7A1FBC9BC0F004136EACD93B6ADF6DD4408B04

Function 00007FFDA3496AE0 Relevance: 6.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 00007FFDA3496B7A
fpos.LIBCPMTD ref: 00007FFDA3496C40
fpos.LIBCPMTD ref: 00007FFDA3496C8F
fpos.LIBCPMTD ref: 00007FFDA3496D29

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: c457bf72074166e4b9cef871bf0dead07cf29958fd0af09302adcdb228af5cb4
Instruction ID: a96a88a624f2ddc6a83958fc435b50e13e8648e466b56cacd85428d8225a9a74
Opcode Fuzzy Hash: c457bf72074166e4b9cef871bf0dead07cf29958fd0af09302adcdb228af5cb4
Instruction Fuzzy Hash: 3361352261DA8186E6609B19E45136B67A1F7C47A4F140231FBEDD7BAACF6DD440CF04

Function 00007FFDA34A4570 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFDA34A45E1
MultiByteToWideChar.KERNEL32 ref: 00007FFDA34A4609

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ByteCharConcurrency::details::EmptyMultiQueue::StructuredWideWork
String ID:
API String ID: 729679527-0
Opcode ID: 4236cccfa5501a5c365e13e92fafc250830b1abf4ab8d273c8a49ddbe665ecc1
Instruction ID: e31c9561b05c2c7f1b10926c576c27e169fd5605640129dc4468c87dbe8cb680
Opcode Fuzzy Hash: 4236cccfa5501a5c365e13e92fafc250830b1abf4ab8d273c8a49ddbe665ecc1
Instruction Fuzzy Hash: 29413D32A1E68186E760DB21E4A136EB7A2FBC5780F405435EACE97B5ACF7DD444CB04

Function 00007FFDA34A3E50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34A3E9A
type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34A3EBF
SHGetSpecialFolderPathW.SHELL32 ref: 00007FFDA34A3F13
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34A3F72

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::_CriticalFolderLock::_PathReentrantScoped_lockScoped_lock::~_Special
String ID:
API String ID: 622896846-0
Opcode ID: dc0c5afa361903b5724841c68451c963996150cd95b8e63c5463ebf210f231a9
Instruction ID: 36751dd0e7eea17e03f892a871aad2aaffcf5ad9ec5a6d4152a903782051464a
Opcode Fuzzy Hash: dc0c5afa361903b5724841c68451c963996150cd95b8e63c5463ebf210f231a9
Instruction Fuzzy Hash: 2D417E32B1E68186EA70DB14E4A03AAB7A1FBC4384F400132E68DD7B6ADF7DD504CB04

Function 00007FFDA34A1040 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::_Task_impl_base::_IsCanceled.LIBCPMTD ref: 00007FFDA34A1069
Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FFDA34A1087

Part of subcall function 00007FFDA34A04D0: Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00007FFDA34A04E5

Concurrency::details::_Task_impl_base::_CancelWithExceptionHolder.LIBCPMTD ref: 00007FFDA34A10BA
Concurrency::details::_Task_impl_base::_Cancel.LIBCPMTD ref: 00007FFDA34A10D1

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::_Task_impl_base::_$CancelConcurrency::details::$Base::CanceledChoresExceptionGroupHolderProcessorProxyRoot::ScheduleSchedulerSegmentUnrealizedVirtualWith
String ID:
API String ID: 2137011280-0
Opcode ID: a2aa80b478cab4208770f9a38a893281dc2bd3f109e1b87810c811e64ecfc72b
Instruction ID: 25229929a398f45fae63592b796de00ed5c3fc17502dc44641f0821f722c9555
Opcode Fuzzy Hash: a2aa80b478cab4208770f9a38a893281dc2bd3f109e1b87810c811e64ecfc72b
Instruction Fuzzy Hash: F8214331B1EB8681DA50EB12E46027E7766FBC5784F401431FA8E97BABDF6DE0019B04

Function 00007FFDA34C2B88 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA34C2AAC: GetModuleHandleExW.KERNEL32 ref: 00007FFDA34C2ABA

GetModuleHandleExW.KERNEL32 ref: 00007FFDA34C2BF0
FreeLibraryWhenCallbackReturns.KERNEL32 ref: 00007FFDA34C2C07

Part of subcall function 00007FFDA34C246C: GetCurrentThreadId.KERNEL32 ref: 00007FFDA34C24BD
Part of subcall function 00007FFDA34C246C: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FFDA34A240B,?,?,?,?,00007FFDA349C458), ref: 00007FFDA34C24DC

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34C2C8A

Part of subcall function 00007FFDA34C2474: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FFDA34C26B0,?,?,?,?,?,?,?,00007FFDA34C2A71), ref: 00007FFDA34C2486

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34C2C95

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Cpp_errorExclusiveHandleLockModuleThrow_std::_$AcquireCallbackCurrentFreeLibraryReleaseReturnsThreadWhen
String ID:
API String ID: 4220897459-0
Opcode ID: 553434353efcc6843571242b5b56ed9f1eb399787c4b19caa6d2ccb4c657e4b2
Instruction ID: 5633054462f24b053d6f473ad2b99fa862611ee2cbfb1f12205d6e1cc9e1edca
Opcode Fuzzy Hash: 553434353efcc6843571242b5b56ed9f1eb399787c4b19caa6d2ccb4c657e4b2
Instruction Fuzzy Hash: ED21FB20B0A60385FF559B29E8701B92263AF52740F140131D92DA63FBDEEFE894C61C

Function 00007FFDA3491240 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA3491250

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA349127D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA3491333

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: 822cb25b02a99ae88a5306ef9a32b2b0c088c945457889bc584b9dc35bc811c1
Instruction ID: 8dcbbdeaed186739bc1277ff98fb6cb9ed19be5c02430767567366bdb77d450c
Opcode Fuzzy Hash: 822cb25b02a99ae88a5306ef9a32b2b0c088c945457889bc584b9dc35bc811c1
Instruction Fuzzy Hash: B8214422A1EA4581DA60EB14F49126AB7A1FBC57A4F501132F68E93BBACE7DD540CB04

Function 00007FFDA34AB9C0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA34AB9D0

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA34AB9FD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34ABAB3

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: 18fd428ba416f35e6fa1d95c6dec4eb2c0224e670d38428d6e6994fa79728931
Instruction ID: 93503dadd02d048846ad43fefa8b252e781e4e1dc3c02b9870e65b608759acc1
Opcode Fuzzy Hash: 18fd428ba416f35e6fa1d95c6dec4eb2c0224e670d38428d6e6994fa79728931
Instruction Fuzzy Hash: 38215222B1EE8181DA50DB14F49126AB7A1FBC47A0F501132F6CE93BBACE7DD540CB04

Function 00007FFDA34AB8B0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA34AB8C0

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA34AB8ED
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34AB9A3

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: 793ac7056e05846943ffed5844e50566047ceb616486e047a5a9b9241643f175
Instruction ID: 7779539e5d19eaaeed6f8a12a878305519988e3052e6b93c5f6190cbba296080
Opcode Fuzzy Hash: 793ac7056e05846943ffed5844e50566047ceb616486e047a5a9b9241643f175
Instruction Fuzzy Hash: F8218422A1EE8581DA50DB14F49026EB3A1FBC47A0F501131F6CE93BBADE7DD540CB04

Function 00007FFDA34A5CD0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA34A5CE0

Part of subcall function 00007FFDA3493880: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDA349389B
Part of subcall function 00007FFDA3493880: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34938CE

std::locale::_Getfacet.LIBCPMTD ref: 00007FFDA34A5D0D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDA34A5DC3

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
String ID:
API String ID: 228209623-0
Opcode ID: bf104d3b9130944ff705ff286039ef5e45dc00399c4ecc11af451a56ddf4ff63
Instruction ID: 1169f65ac18eca313bd4971e7dd75416c571b2187de510240ed915e7a8bb8273
Opcode Fuzzy Hash: bf104d3b9130944ff705ff286039ef5e45dc00399c4ecc11af451a56ddf4ff63
Instruction Fuzzy Hash: 5F214122A1EA8581DA50DB14F4912AAB7B1FBC47A0F501132F6DE93BBACE7DD540CB04

Function 00007FFDA34BE4A0 Relevance: 6.0, APIs: 4, Instructions: 46threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4C1
GetCurrentThreadId.KERNEL32 ref: 00007FFDA34BE4C7
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE4DB
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDA34BE50A

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 27d73551e55d5d03b2179b481ebe71ff2a700cb18187dbb0179742bbf1b013cb
Instruction ID: a85b1261508b23a994f29778fa6721dcead41c1db702aba95c778e54d533f2f6
Opcode Fuzzy Hash: 27d73551e55d5d03b2179b481ebe71ff2a700cb18187dbb0179742bbf1b013cb
Instruction Fuzzy Hash: E601D82170A68957EB84A626F4613BA5293FBC4380F444435EF4DE37D7EDADE841DB04

Function 00007FFDA34C41E8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDA34C4214
GetCurrentThreadId.KERNEL32 ref: 00007FFDA34C4222
GetCurrentProcessId.KERNEL32 ref: 00007FFDA34C422E
QueryPerformanceCounter.KERNEL32 ref: 00007FFDA34C423E

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9ec5600b05cd82a8e10f8fc1781d40101dc96b0f7a75fb69ad6eecb34d5e0eaa
Instruction ID: b517fd4e4ba6c70d484acbff46fdfc63dd848f5b53adff3f5cb17d668341b6a6
Opcode Fuzzy Hash: 9ec5600b05cd82a8e10f8fc1781d40101dc96b0f7a75fb69ad6eecb34d5e0eaa
Instruction Fuzzy Hash: 7D117C32B15F018AEB00CF74E8652B833A4FB59758F041E35EA2D967A9DF79D194C340

Function 00007FFDA34B7140 Relevance: 6.0, APIs: 4, Instructions: 16COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFDA34B7144
OpenProcess.KERNEL32 ref: 00007FFDA34B715A
TerminateProcess.KERNEL32 ref: 00007FFDA34B716C
CloseHandle.KERNEL32 ref: 00007FFDA34B7177

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenTerminate
String ID:
API String ID: 983841585-0
Opcode ID: 597751426ef9b9c2102fe0f833c27338a46b029254865beae2c2f583087e8297
Instruction ID: b1e03702a3917c5451dd932c5a2b9f9ae72637c6dc530ef937e35ed6b43e9812
Opcode Fuzzy Hash: 597751426ef9b9c2102fe0f833c27338a46b029254865beae2c2f583087e8297
Instruction Fuzzy Hash: 73E0BF36B0994186E320DB26E814059F7B2FBCC755F544134DA8D92739DF7DD5C68B08

Function 00007FFDA34C7854 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C787E

Strings

csm, xrefs: 00007FFDA34C7A12
csm, xrefs: 00007FFDA34C78A3

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: f0672875b56e3e91f7387c99e9e7c8de2a70e4d1654d6aa75e53c9bd2162311b
Instruction ID: bed0bcdb7fd9ffc13307a1ebc512d8d5d8d9a1575459bc9aa65b01c37d89ff1a
Opcode Fuzzy Hash: f0672875b56e3e91f7387c99e9e7c8de2a70e4d1654d6aa75e53c9bd2162311b
Instruction Fuzzy Hash: 5D71B372B0A6818BD7608F29946077DBFA2FB40B84F148131DB8DA7B86DB7ED551C704

Function 00007FFDA34C7E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA34C7F3A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFDA34C7F63

Strings

csm, xrefs: 00007FFDA34C8063

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 241ff751386006dba430cfcaa452f65ea43404882c006d28022b8e43daf6fe6c
Instruction ID: 121359c83763e1817b2b8e676ec1d8986047a4d156e2bb88f155f8dab3efc516
Opcode Fuzzy Hash: 241ff751386006dba430cfcaa452f65ea43404882c006d28022b8e43daf6fe6c
Instruction Fuzzy Hash: 6751523271A74186D660DF2AE05026EB7B5F788BA1F100175EB8D9BB56CF7EE450CB08

Function 00007FFDA34D72E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDA34D73F7
GetLastError.KERNEL32 ref: 00007FFDA34D7419

Strings

U, xrefs: 00007FFDA34D73A3

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c00cc46764e3aacfe03c88eaead441a28a811676fc4d65fc1849a78bc9b4c519
Instruction ID: 92973f8b5a22be92648e85483cb4ed5fb197650bc7d921acc4721330612559f5
Opcode Fuzzy Hash: c00cc46764e3aacfe03c88eaead441a28a811676fc4d65fc1849a78bc9b4c519
Instruction Fuzzy Hash: EC41B433B19A8186EB108F25E4643AA6BA1FB887C4F444131EE4DD7799EF7DD441C744

Function 00007FFDA34C4720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C4770
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDA34C407B), ref: 00007FFDA34C47B1

Strings

csm, xrefs: 00007FFDA34C479E

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: dba6bd1a0ac2c8d099696e94e8611ae08bcb42e179612d15905ba0ed57ddee6c
Instruction ID: e45b2546f2e14a51f4caa16b0d5fa17e00e5bd7abc18eefdf9385d900e31c6db
Opcode Fuzzy Hash: dba6bd1a0ac2c8d099696e94e8611ae08bcb42e179612d15905ba0ed57ddee6c
Instruction Fuzzy Hash: 4D116D3260AB4082EB218F29F51026977E6FB88B94F584231DECC57759EF7DC551CB04

Function 00007FFDA34A12B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Concurrency::details::_Schedule_chore.LIBCPMT ref: 00007FFDA34A12C1

Part of subcall function 00007FFDA34C2B48: GetModuleHandleExW.KERNEL32 ref: 00007FFDA34C2B30
Part of subcall function 00007FFDA34C2B48: SubmitThreadpoolWork.KERNEL32 ref: 00007FFDA34C2B39
Part of subcall function 00007FFDA34C2B48: CreateThreadpoolWork.KERNEL32 ref: 00007FFDA34C2B5E

std::bad_exception::bad_exception.LIBCMTD ref: 00007FFDA34A1307

Strings

Fail to schedule the chore!, xrefs: 00007FFDA34A12FB

Memory Dump Source

Source File: 00000003.00000002.2125581909.00007FFDA3481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3480000, based on PE: true

Associated: 00000003.00000002.2125568974.00007FFDA3480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125631563.00007FFDA34EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125658938.00007FFDA3509000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125673525.00007FFDA350A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125688103.00007FFDA350B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2125706669.00007FFDA350E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3480000_regsvr32.jbxd

Similarity

API ID: ThreadpoolWork$Concurrency::details::_CreateHandleModuleSchedule_choreSubmitstd::bad_exception::bad_exception
String ID: Fail to schedule the chore!
API String ID: 2088802962-3313369819
Opcode ID: 67acc1bff8d18671174b847d0d84192052f8b113a35ee0c6946b2bbfbef70b53
Instruction ID: 5b9a93ddb6eda0ec62e966f92071ef68a7b1cebc4894853bdf1154529ceb2133
Opcode Fuzzy Hash: 67acc1bff8d18671174b847d0d84192052f8b113a35ee0c6946b2bbfbef70b53
Instruction Fuzzy Hash: 7EF04422B1EB8681EA20EB14F4653697366FB85744F400530E58D977AADFBED144C708

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ResPrompt.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
ResPrompt.dll.dll

Function 00007FFDA3485C20 Relevance: 75.5, APIs: 5, Strings: 38, Instructions: 235
synchronizationCOMMON

Function 00007FFDA34C3914 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Function 00007FFDA34860D0 Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Function 00007FFDA34D4D28 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Function 00007FFDA34DFDDC Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FFDA34D3FEC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE